Newsreader problem on XP Home

[KenK]

After working earlier yesterday, Xnews won't read new messages or access
forums. It tries to read the first one, then hangs. Just says
'connecting', then 'timed out'. No error messages. I am posting from my
Compaq backup computer. Doesn't work on private or Usenet server. Tried
an edit to one newsgroup file (added a space to one line, then removed
it) - it did not get accidently write protected so should work.

I tried several other older or backup versions of Xnews and newsgroup
files; same problem. Even tried the version I am running here on the
backup system.

Only difference is failed Xnews uses DSL, working version dial-up. All
other software on main eMachine computer works fine - Firefox, Eudora,
Kaspersky virus protection, etc. In a few minutes I'm going to run a full
scan on main system - virus?

Xnews had run with no problems for decades.

Any help or suggestions greatly appreciated.

Perhaps Email to ken dot knecht at gmail dot com - more convenient, but
will still check here and email from time to time

Help! This is a great annoyance!

TIA

 

[Paul]

After working earlier yesterday, Xnews won't read new messages or access
forums. It tries to read the first one, then hangs. Just says
'connecting', then 'timed out'. No error messages. I am posting from my
Compaq backup computer. Doesn't work on private or Usenet server. Tried
an edit to one newsgroup file (added a space to one line, then removed
it) - it did not get accidently write protected so should work.

I tried several other older or backup versions of Xnews and newsgroup
files; same problem. Even tried the version I am running here on the
backup system.

Only difference is failed Xnews uses DSL, working version dial-up. All
other software on main eMachine computer works fine - Firefox, Eudora,
Kaspersky virus protection, etc. In a few minutes I'm going to run a full
scan on main system - virus?

Xnews had run with no problems for decades.

Any help or suggestions greatly appreciated.

Perhaps Email to ken dot knecht at gmail dot com - more convenient, but
will still check here and email from time to time

Help! This is a great annoyance!

TIA

Are you using port 119 on the news server ? Check
where you specify the news server name, as there could
be a port number right next to it. The port numbers
are associated with whether encryption is being used
or not. Port 119 (what I use) is unencrypted and
you can watch both the username and password, on
the fly.

To watch the traffic, get and install Wireshark.
In the "View" menu, remember to turn on symbolic
translation of all three items for the IP addresses.
This is to make the log easier to read. Wireshark
is available for multiple platforms, like Windows, Linux,
MacOSX.

http://en.wikipedia.org/wiki/Wireshark

The program uses winpcap to capture all the packets, and
the Wireshark parses the captured info and displays it.
Packets are captured to RAM by default, meaning the
trace has an eventual size limit. You can change it
over to storing the packets on the hard drive. And then
the trace could run longer.

What you're looking for, is the back and forth between
the server and your machine. You might get a hint as
to what is wrong that way. When using port 119, the
packets are especially easy to read and understand,
in plain English.

UK ISPs have been known to filter USENET before.
They do that to stop movie downloading, but it also
affected innocent text message posters. The filtering
may be intended to drop the download rate, but making
USENET slow for everyone.

If you look at the trace and there are a number of
"black" entries with "TCP Duplicate" packets or
"RST" packets, then these are networking issues of
one sort or another, and could be the fault of your
ISP. If instead, the trace entries are the normal
gray color, packets are sent and received without
trouble, but say, communication stops with your
NSP after the password is sent, then the authentication
process at the NSP has died. You can do some
simple analysis like that, to determine whether
the problem is at your end, or their end.

If using encrypted ports, well, you can't really follow
the protocol. And can only notice "black" packets
indicating "trouble on the line", a routing problem
perhaps.

If you include screenshots of a Wireshark trace, remember
to blank out your username and password being transmitted
to the server

Examples of common port numbers, can be seen here.

http://www.eternal-september.org/index.php?showpage=techinfo

If you exhaust all other possibilities, then a phone call
to the less-than-helpful ISP tech support will be required.
They'll swear up and down, they don't block port 119. They
do block ports like the email forwarding port, to prevent
spamming. So *all* ISPs do block at least one port from
the outside, to prevent themselves from getting blacklisted
on email. ISPs with deep packet inspection equipment,
also spot illegal email forwarding on any port, rather than
just the "usual" port. My ISP has the equipment to do that,
and no human has to lift a finger to stop email forwarding.
The networking equipment is "built like a fort" Just
hope they don't put port 119 on the list... Your Wireshark
packet trace can help you figure that out.

Validate the Wireshark packet trace, on your dialup session.
I think it works with that, but haven't had a chance to do
such a test here. The naming convention for a dialup connection
could be quite different, so I don't know what you'll face to
get that working. The Wireshark trace you collect there, will
be your "reference", so you know what to look for.

HTH,
Paul

 

[KenK]

Are you using port 119 on the news server ? Check
where you specify the news server name, as there could
be a port number right next to it. The port numbers
are associated with whether encryption is being used
or not. Port 119 (what I use) is unencrypted and
you can watch both the username and password, on
the fly.

To watch the traffic, get and install Wireshark.
In the "View" menu, remember to turn on symbolic
translation of all three items for the IP addresses.
This is to make the log easier to read. Wireshark
is available for multiple platforms, like Windows, Linux,
MacOSX.

http://en.wikipedia.org/wiki/Wireshark

The program uses winpcap to capture all the packets, and
the Wireshark parses the captured info and displays it.
Packets are captured to RAM by default, meaning the
trace has an eventual size limit. You can change it
over to storing the packets on the hard drive. And then
the trace could run longer.

What you're looking for, is the back and forth between
the server and your machine. You might get a hint as
to what is wrong that way. When using port 119, the
packets are especially easy to read and understand,
in plain English.

UK ISPs have been known to filter USENET before.
They do that to stop movie downloading, but it also
affected innocent text message posters. The filtering
may be intended to drop the download rate, but making
USENET slow for everyone.

If you look at the trace and there are a number of
"black" entries with "TCP Duplicate" packets or
"RST" packets, then these are networking issues of
one sort or another, and could be the fault of your
ISP. If instead, the trace entries are the normal
gray color, packets are sent and received without
trouble, but say, communication stops with your
NSP after the password is sent, then the authentication
process at the NSP has died. You can do some
simple analysis like that, to determine whether
the problem is at your end, or their end.

If using encrypted ports, well, you can't really follow
the protocol. And can only notice "black" packets
indicating "trouble on the line", a routing problem
perhaps.

If you include screenshots of a Wireshark trace, remember
to blank out your username and password being transmitted
to the server

Examples of common port numbers, can be seen here.

http://www.eternal-september.org/index.php?showpage=techinfo

If you exhaust all other possibilities, then a phone call
to the less-than-helpful ISP tech support will be required.
They'll swear up and down, they don't block port 119. They
do block ports like the email forwarding port, to prevent
spamming. So *all* ISPs do block at least one port from
the outside, to prevent themselves from getting blacklisted
on email. ISPs with deep packet inspection equipment,
also spot illegal email forwarding on any port, rather than
just the "usual" port. My ISP has the equipment to do that,
and no human has to lift a finger to stop email forwarding.
The networking equipment is "built like a fort" Just
hope they don't put port 119 on the list... Your Wireshark
packet trace can help you figure that out.

Validate the Wireshark packet trace, on your dialup session.
I think it works with that, but haven't had a chance to do
such a test here. The naming convention for a dialup connection
could be quite different, so I don't know what you'll face to
get that working. The Wireshark trace you collect there, will
be your "reference", so you know what to look for.

HTH,
Paul

Port on one of the servers was 0, changed it to 119. The Usenet port
already was set to 119. No help.

Printed out your message. Will digest it later and give your suggestions
a try.

My virus scan came up with nothing. I still can't figure out why Xnews
was running normally, I shut off the system because of rain in the area,
then about three hours later turned it back on and Xnews was kaput.
Strange. I suspect something changed on my net connection. but I don't
know what or why. DSL? CenturyLink is my DSL and I guess my ISP.

Thanks much Paul. I'll keep you aware of any good news.

Ken

 

[Bert]

In KenK

After working earlier yesterday, Xnews won't read new messages or
access forums. It tries to read the first one, then hangs. Just says
'connecting', then 'timed out'.

Are you able to access the internet using any other programs? Web
browser? Email? Anything?

 

[Paul]

In KenK


Are you able to access the internet using any other programs? Web
browser? Email? Anything?

The second post...

"All other software on main eMachine computer works fine - Firefox,
Eudora, Kaspersky virus protection, etc."

The reason for me suggesting Wireshark, is not all News clients have
one to one error messages. There might be several ways to achieve a
"Timed out" condition, and with the aid of a packet sniffer, you can
see which stage the process stops at. It's not like there is a
lot to look at - either the authentication step never comes back,
or the subsequent read or post commands aren't working. Sometimes,
I see "Xover" messages from the server, but no idea why there are
two ways to get messages. Xover seems to appear when the server
is rebuilding the database or something.

Paul

 

[KenK]

In KenK


Are you able to access the internet using any other programs? Web
browser? Email? Anything?

Everything else I tried - Firefox, Eudora, Kaspersky virus checker, etc.
work ok as far as I can tell.

 

[KenK]

I'll keep you aware of any good news.

Well, news anyhow. More Xnews news. Switched eMachine from DSL to dial-up
for a test. Xnews still has same problem. Can't think of anything else
different between the two machines. <sigh> Will try your other suggestions
tomorrow.

Ken

 

[Bert]

In KenK

Well, news anyhow. More Xnews news. Switched eMachine from DSL to
dial-up for a test. Xnews still has same problem. Can't think of
anything else different between the two machines. <sigh> Will try your
other suggestions tomorrow.

Can you ping the news server? How about tracert?

Are you ->sure you have the host name of your news server entered
correctly?

 

[KenK]

In KenK


Can you ping the news server?

Usenet server responds properly.

How about tracert?

What's tracert? Too busy to Google it now.

Are you ->sure you have the host name of your news server entered
correctly?

This is the news reader I've been running for decades. Then the other day
the problem started. I copied this version I am running on my backup
system (Compaq) with its data files to the main machine (eMachine) and it
fails the same way. Also tried running with same ISP on both machines.
Only thing I can think of that's different is the computer itself but the
eMachine runs everything else I use with no problems.

After I try Paul's suggestions with Wireshark, if there's no success, I'm
about to try a different newsreader but really hate the idea of setting
it up and suspect it may not work either.

 

[KenK]

To watch the traffic, get and install Wireshark.

I DLed version 1.10.10 today. I tried a later version but it said it might
not work right with XP. Dled a tutorial. Will read it and Wikipedia
Wireshark article later today. May get a chance to try it tomorrow or
Monday. Hope I can understand the results and figure out the indicated
problem.

 

[KenK]

How about tracert?

Never mind. Finally got a minute. DLed info about it on Wiki and from MS I
found with Google and printed it. Will read it later today.

 

[KenK]

To watch the traffic, get and install Wireshark.
In the "View" menu, remember to turn on symbolic
translation of all three items for the IP addresses.
This is to make the log easier to read.

Couldn't find that option.

Here is the capture data from Xnews' failed attempt to read the newsrc
files:

Frame 1: 76 bytes on wire (608 bits), 76 bytes captured (608 bits) on
interface 0
Ethernet II, Src: Intel_5a:b1:0c (00:11:11:5a:b1:0c), Dst: Actionte_
8f:86:00 (10:5f:06:8f:86:00)
Internet Protocol Version 4, Src: 192.168.0.2 (192.168.0.2), Dst:
192.168.0.1 (192.168.0.1)
User Datagram Protocol, Src Port: 2194 (2194), Dst Port: domain (53)
Domain Name System (query)

No. Time Source Destination
Protocol Length Info
2 0.029927000 192.168.0.1 192.168.0.2 DNS
92 Standard query response 0xd9c3 A 98.100.194.170

Frame 2: 92 bytes on wire (736 bits), 92 bytes captured (736 bits) on
interface 0
Ethernet II, Src: Actionte_8f:86:00 (10:5f:06:8f:86:00), Dst: Intel_
5a:b1:0c (00:11:11:5a:b1:0c)
Internet Protocol Version 4, Src: 192.168.0.1 (192.168.0.1), Dst:
192.168.0.2 (192.168.0.2)
User Datagram Protocol, Src Port: domain (53), Dst Port: 2194 (2194)
Domain Name System (response)

No. Time Source Destination
Protocol Length Info
3 0.037305000 192.168.0.2 192.168.0.1 DNS
79 Standard query 0x97e2 A news.individual.net

Frame 3: 79 bytes on wire (632 bits), 79 bytes captured (632 bits) on
interface 0
Ethernet II, Src: Intel_5a:b1:0c (00:11:11:5a:b1:0c), Dst: Actionte_
8f:86:00 (10:5f:06:8f:86:00)
Internet Protocol Version 4, Src: 192.168.0.2 (192.168.0.2), Dst:
192.168.0.1 (192.168.0.1)
User Datagram Protocol, Src Port: 2195 (2195), Dst Port: domain (53)
Domain Name System (query)

No. Time Source Destination
Protocol Length Info
4 0.038982000 192.168.0.2 98.100.194.170 TCP
62 mnp-exchange > nntp [SYN] Seq=0 Win=65535 Len=0 MSS=1460
SACK_PERM=1

Frame 4: 62 bytes on wire (496 bits), 62 bytes captured (496 bits) on
interface 0
Ethernet II, Src: Intel_5a:b1:0c (00:11:11:5a:b1:0c), Dst: Actionte_
8f:86:00 (10:5f:06:8f:86:00)
Internet Protocol Version 4, Src: 192.168.0.2 (192.168.0.2), Dst:
98.100.194.170 (98.100.194.170)
Transmission Control Protocol, Src Port: mnp-exchange (2197), Dst Port:
nntp (119), Seq: 0, Len: 0

No. Time Source Destination
Protocol Length Info
5 0.067195000 192.168.0.1 192.168.0.2 DNS
95 Standard query response 0x97e2 A 130.133.4.11

Frame 5: 95 bytes on wire (760 bits), 95 bytes captured (760 bits) on
interface 0
Ethernet II, Src: Actionte_8f:86:00 (10:5f:06:8f:86:00), Dst: Intel_
5a:b1:0c (00:11:11:5a:b1:0c)
Internet Protocol Version 4, Src: 192.168.0.1 (192.168.0.1), Dst:
192.168.0.2 (192.168.0.2)
User Datagram Protocol, Src Port: domain (53), Dst Port: 2195 (2195)
Domain Name System (response)

No. Time Source Destination
Protocol Length Info
6 0.069410000 192.168.0.2 130.133.4.11 TCP
62 onehome-help > nntp [SYN] Seq=0 Win=65535 Len=0 MSS=1460
SACK_PERM=1

Frame 6: 62 bytes on wire (496 bits), 62 bytes captured (496 bits) on
interface 0
Ethernet II, Src: Intel_5a:b1:0c (00:11:11:5a:b1:0c), Dst: Actionte_
8f:86:00 (10:5f:06:8f:86:00)
Internet Protocol Version 4, Src: 192.168.0.2 (192.168.0.2), Dst:
130.133.4.11 (130.133.4.11)
Transmission Control Protocol, Src Port: onehome-help (2199), Dst Port:
nntp (119), Seq: 0, Len: 0

No. Time Source Destination
Protocol Length Info
7 0.152706000 98.100.194.170 192.168.0.2 TCP
62 nntp > mnp-exchange [SYN, ACK] Seq=0 Ack=1 Win=16384 Len=0 MSS=
1452 SACK_PERM=1

Frame 7: 62 bytes on wire (496 bits), 62 bytes captured (496 bits) on
interface 0
Ethernet II, Src: Actionte_8f:86:00 (10:5f:06:8f:86:00), Dst: Intel_
5a:b1:0c (00:11:11:5a:b1:0c)
Internet Protocol Version 4, Src: 98.100.194.170 (98.100.194.170), Dst:
192.168.0.2 (192.168.0.2)
Transmission Control Protocol, Src Port: nntp (119), Dst Port: mnp-
exchange (2197), Seq: 0, Ack: 1, Len: 0

No. Time Source Destination
Protocol Length Info
8 0.152794000 192.168.0.2 98.100.194.170 TCP
54 mnp-exchange > nntp [ACK] Seq=1 Ack=1 Win=65535 Len=0

Frame 8: 54 bytes on wire (432 bits), 54 bytes captured (432 bits) on
interface 0
Ethernet II, Src: Intel_5a:b1:0c (00:11:11:5a:b1:0c), Dst: Actionte_
8f:86:00 (10:5f:06:8f:86:00)
Internet Protocol Version 4, Src: 192.168.0.2 (192.168.0.2), Dst:
98.100.194.170 (98.100.194.170)
Transmission Control Protocol, Src Port: mnp-exchange (2197), Dst Port:
nntp (119), Seq: 1, Ack: 1, Len: 0

No. Time Source Destination
Protocol Length Info
9 0.263941000 130.133.4.11 192.168.0.2 TCP
62 nntp > onehome-help [SYN, ACK] Seq=0 Ack=1 Win=14600 Len=0 MSS=
1452 SACK_PERM=1

Frame 9: 62 bytes on wire (496 bits), 62 bytes captured (496 bits) on
interface 0
Ethernet II, Src: Actionte_8f:86:00 (10:5f:06:8f:86:00), Dst: Intel_
5a:b1:0c (00:11:11:5a:b1:0c)
Internet Protocol Version 4, Src: 130.133.4.11 (130.133.4.11), Dst:
192.168.0.2 (192.168.0.2)
Transmission Control Protocol, Src Port: nntp (119), Dst Port: onehome-
help (2199), Seq: 0, Ack: 1, Len: 0

No. Time Source Destination
Protocol Length Info
10 0.264055000 192.168.0.2 130.133.4.11 TCP
54 onehome-help > nntp [ACK] Seq=1 Ack=1 Win=65535 Len=0

Frame 10: 54 bytes on wire (432 bits), 54 bytes captured (432 bits) on
interface 0
Ethernet II, Src: Intel_5a:b1:0c (00:11:11:5a:b1:0c), Dst: Actionte_
8f:86:00 (10:5f:06:8f:86:00)
Internet Protocol Version 4, Src: 192.168.0.2 (192.168.0.2), Dst:
130.133.4.11 (130.133.4.11)
Transmission Control Protocol, Src Port: onehome-help (2199), Dst Port:
nntp (119), Seq: 1, Ack: 1, Len: 0

No. Time Source Destination
Protocol Length Info
11 0.267921000 98.100.194.170 192.168.0.2 NNTP
95 Response: 200 Optimax-NNTP, Optimax-Hamster V1.24

Frame 11: 95 bytes on wire (760 bits), 95 bytes captured (760 bits) on
interface 0
Ethernet II, Src: Actionte_8f:86:00 (10:5f:06:8f:86:00), Dst: Intel_
5a:b1:0c (00:11:11:5a:b1:0c)
Internet Protocol Version 4, Src: 98.100.194.170 (98.100.194.170), Dst:
192.168.0.2 (192.168.0.2)
Transmission Control Protocol, Src Port: nntp (119), Dst Port: mnp-
exchange (2197), Seq: 1, Ack: 1, Len: 41
Network News Transfer Protocol

No. Time Source Destination
Protocol Length Info
12 0.271780000 192.168.0.2 98.100.194.170 NNTP
67 Request: MODE READER

Frame 12: 67 bytes on wire (536 bits), 67 bytes captured (536 bits) on
interface 0
Ethernet II, Src: Intel_5a:b1:0c (00:11:11:5a:b1:0c), Dst: Actionte_
8f:86:00 (10:5f:06:8f:86:00)
Internet Protocol Version 4, Src: 192.168.0.2 (192.168.0.2), Dst:
98.100.194.170 (98.100.194.170)
Transmission Control Protocol, Src Port: mnp-exchange (2197), Dst Port:
nntp (119), Seq: 1, Ack: 42, Len: 13
Network News Transfer Protocol

No. Time Source Destination
Protocol Length Info
13 0.386297000 98.100.194.170 192.168.0.2 NNTP
67 Response: 200 ignored

Frame 13: 67 bytes on wire (536 bits), 67 bytes captured (536 bits) on
interface 0
Ethernet II, Src: Actionte_8f:86:00 (10:5f:06:8f:86:00), Dst: Intel_
5a:b1:0c (00:11:11:5a:b1:0c)
Internet Protocol Version 4, Src: 98.100.194.170 (98.100.194.170), Dst:
192.168.0.2 (192.168.0.2)
Transmission Control Protocol, Src Port: nntp (119), Dst Port: mnp-
exchange (2197), Seq: 42, Ack: 14, Len: 13
Network News Transfer Protocol

No. Time Source Destination
Protocol Length Info
14 0.388486000 192.168.0.2 98.100.194.170 NNTP
81 Request: GROUP sdforum.newsreaders

Frame 14: 81 bytes on wire (648 bits), 81 bytes captured (648 bits) on
interface 0
Ethernet II, Src: Intel_5a:b1:0c (00:11:11:5a:b1:0c), Dst: Actionte_
8f:86:00 (10:5f:06:8f:86:00)
Internet Protocol Version 4, Src: 192.168.0.2 (192.168.0.2), Dst:
98.100.194.170 (98.100.194.170)
Transmission Control Protocol, Src Port: mnp-exchange (2197), Dst Port:
nntp (119), Seq: 14, Ack: 55, Len: 27
Network News Transfer Protocol

No. Time Source Destination
Protocol Length Info
15 0.461482000 130.133.4.11 192.168.0.2 NNTP
175 Response: 200 The server welcomes 184-98-134-233.phnx.qwest.net
(184.98.134.233). Authorization required for reading and posting.

Frame 15: 175 bytes on wire (1400 bits), 175 bytes captured (1400 bits)
on interface 0
Ethernet II, Src: Actionte_8f:86:00 (10:5f:06:8f:86:00), Dst: Intel_
5a:b1:0c (00:11:11:5a:b1:0c)
Internet Protocol Version 4, Src: 130.133.4.11 (130.133.4.11), Dst:
192.168.0.2 (192.168.0.2)
Transmission Control Protocol, Src Port: nntp (119), Dst Port: onehome-
help (2199), Seq: 1, Ack: 1, Len: 121
Network News Transfer Protocol

No. Time Source Destination
Protocol Length Info
16 0.504541000 98.100.194.170 192.168.0.2 NNTP
89 Response: 211 176 1 176 sdforum.newsreaders

Frame 16: 89 bytes on wire (712 bits), 89 bytes captured (712 bits) on
interface 0
Ethernet II, Src: Actionte_8f:86:00 (10:5f:06:8f:86:00), Dst: Intel_
5a:b1:0c (00:11:11:5a:b1:0c)
Internet Protocol Version 4, Src: 98.100.194.170 (98.100.194.170), Dst:
192.168.0.2 (192.168.0.2)
Transmission Control Protocol, Src Port: nntp (119), Dst Port: mnp-
exchange (2197), Seq: 55, Ack: 41, Len: 35
Network News Transfer Protocol

No. Time Source Destination
Protocol Length Info
17 0.652692000 192.168.0.2 130.133.4.11 TCP
54 onehome-help > nntp [ACK] Seq=1 Ack=122 Win=65414 Len=0

Frame 17: 54 bytes on wire (432 bits), 54 bytes captured (432 bits) on
interface 0
Ethernet II, Src: Intel_5a:b1:0c (00:11:11:5a:b1:0c), Dst: Actionte_
8f:86:00 (10:5f:06:8f:86:00)
Internet Protocol Version 4, Src: 192.168.0.2 (192.168.0.2), Dst:
130.133.4.11 (130.133.4.11)
Transmission Control Protocol, Src Port: onehome-help (2199), Dst Port:
nntp (119), Seq: 1, Ack: 122, Len: 0

No. Time Source Destination
Protocol Length Info
18 0.652769000 192.168.0.2 98.100.194.170 TCP
54 mnp-exchange > nntp [ACK] Seq=41 Ack=90 Win=65446 Len=0

Frame 18: 54 bytes on wire (432 bits), 54 bytes captured (432 bits) on
interface 0
Ethernet II, Src: Intel_5a:b1:0c (00:11:11:5a:b1:0c), Dst: Actionte_
8f:86:00 (10:5f:06:8f:86:00)
Internet Protocol Version 4, Src: 192.168.0.2 (192.168.0.2), Dst:
98.100.194.170 (98.100.194.170)
Transmission Control Protocol, Src Port: mnp-exchange (2197), Dst Port:
nntp (119), Seq: 41, Ack: 90, Len: 0

No. Time Source Destination
Protocol Length Info
19 5.028631000 Actionte_8f:86:00 Intel_5a:b1:0c ARP
60 Who has 192.168.0.2? Tell 192.168.0.1

Frame 19: 60 bytes on wire (480 bits), 60 bytes captured (480 bits) on
interface 0
Ethernet II, Src: Actionte_8f:86:00 (10:5f:06:8f:86:00), Dst: Intel_
5a:b1:0c (00:11:11:5a:b1:0c)
Address Resolution Protocol (request)

No. Time Source Destination
Protocol Length Info
20 5.028655000 Intel_5a:b1:0c Actionte_8f:86:00 ARP
42 192.168.0.2 is at 00:11:11:5a:b1:0c

Frame 20: 42 bytes on wire (336 bits), 42 bytes captured (336 bits) on
interface 0
Ethernet II, Src: Intel_5a:b1:0c (00:11:11:5a:b1:0c), Dst: Actionte_
8f:86:00 (10:5f:06:8f:86:00)
Address Resolution Protocol (reply)

No. Time Source Destination
Protocol Length Info
21 24.532861000 192.168.0.1 239.255.255.250 SSDP
385 NOTIFY * HTTP/1.1

Frame 21: 385 bytes on wire (3080 bits), 385 bytes captured (3080 bits)
on interface 0
Ethernet II, Src: Actionte_8f:86:00 (10:5f:06:8f:86:00), Dst: IPv4mcast_
7f:ff:fa (01:00:5e:7f:ff:fa)
Internet Protocol Version 4, Src: 192.168.0.1 (192.168.0.1), Dst:
239.255.255.250 (239.255.255.250)
User Datagram Protocol, Src Port: ssdp (1900), Dst Port: ssdp (1900)
Hypertext Transfer Protocol

No. Time Source Destination
Protocol Length Info
22 24.533388000 192.168.0.1 239.255.255.250 SSDP
330 NOTIFY * HTTP/1.1

Frame 22: 330 bytes on wire (2640 bits), 330 bytes captured (2640 bits)
on interface 0
Ethernet II, Src: Actionte_8f:86:00 (10:5f:06:8f:86:00), Dst: IPv4mcast_
7f:ff:fa (01:00:5e:7f:ff:fa)
Internet Protocol Version 4, Src: 192.168.0.1 (192.168.0.1), Dst:
239.255.255.250 (239.255.255.250)
User Datagram Protocol, Src Port: ssdp (1900), Dst Port: ssdp (1900)
Hypertext Transfer Protocol

No. Time Source Destination
Protocol Length Info
23 24.533882000 192.168.0.1 239.255.255.250 SSDP
321 NOTIFY * HTTP/1.1

Frame 23: 321 bytes on wire (2568 bits), 321 bytes captured (2568 bits)
on interface 0
Ethernet II, Src: Actionte_8f:86:00 (10:5f:06:8f:86:00), Dst: IPv4mcast_
7f:ff:fa (01:00:5e:7f:ff:fa)
Internet Protocol Version 4, Src: 192.168.0.1 (192.168.0.1), Dst:
239.255.255.250 (239.255.255.250)
User Datagram Protocol, Src Port: ssdp (1900), Dst Port: ssdp (1900)
Hypertext Transfer Protocol

No. Time Source Destination
Protocol Length Info
24 24.534516000 192.168.0.1 239.255.255.250 SSDP
395 NOTIFY * HTTP/1.1

Frame 24: 395 bytes on wire (3160 bits), 395 bytes captured (3160 bits)
on interface 0
Ethernet II, Src: Actionte_8f:86:00 (10:5f:06:8f:86:00), Dst: IPv4mcast_
7f:ff:fa (01:00:5e:7f:ff:fa)
Internet Protocol Version 4, Src: 192.168.0.1 (192.168.0.1), Dst:
239.255.255.250 (239.255.255.250)
User Datagram Protocol, Src Port: ssdp (1900), Dst Port: ssdp (1900)
Hypertext Transfer Protocol

No. Time Source Destination
Protocol Length Info
25 25.511982000 192.168.0.2 130.133.4.11 TCP
54 onehome-help > nntp [FIN, ACK] Seq=1 Ack=122 Win=65414 Len=0

Frame 25: 54 bytes on wire (432 bits), 54 bytes captured (432 bits) on
interface 0
Ethernet II, Src: Intel_5a:b1:0c (00:11:11:5a:b1:0c), Dst: Actionte_
8f:86:00 (10:5f:06:8f:86:00)
Internet Protocol Version 4, Src: 192.168.0.2 (192.168.0.2), Dst:
130.133.4.11 (130.133.4.11)
Transmission Control Protocol, Src Port: onehome-help (2199), Dst Port:
nntp (119), Seq: 1, Ack: 122, Len: 0

No. Time Source Destination
Protocol Length Info
26 25.512344000 192.168.0.2 98.100.194.170 TCP
54 mnp-exchange > nntp [FIN, ACK] Seq=41 Ack=90 Win=65446 Len=0

Frame 26: 54 bytes on wire (432 bits), 54 bytes captured (432 bits) on
interface 0
Ethernet II, Src: Intel_5a:b1:0c (00:11:11:5a:b1:0c), Dst: Actionte_
8f:86:00 (10:5f:06:8f:86:00)
Internet Protocol Version 4, Src: 192.168.0.2 (192.168.0.2), Dst:
98.100.194.170 (98.100.194.170)
Transmission Control Protocol, Src Port: mnp-exchange (2197), Dst Port:
nntp (119), Seq: 41, Ack: 90, Len: 0

No. Time Source Destination
Protocol Length Info
27 25.625361000 98.100.194.170 192.168.0.2 TCP
60 nntp > mnp-exchange [ACK] Seq=90 Ack=42 Win=65495 Len=0

Frame 27: 60 bytes on wire (480 bits), 60 bytes captured (480 bits) on
interface 0
Ethernet II, Src: Actionte_8f:86:00 (10:5f:06:8f:86:00), Dst: Intel_
5a:b1:0c (00:11:11:5a:b1:0c)
Internet Protocol Version 4, Src: 98.100.194.170 (98.100.194.170), Dst:
192.168.0.2 (192.168.0.2)
Transmission Control Protocol, Src Port: nntp (119), Dst Port: mnp-
exchange (2197), Seq: 90, Ack: 42, Len: 0

No. Time Source Destination
Protocol Length Info
28 25.631541000 98.100.194.170 192.168.0.2 TCP
60 nntp > mnp-exchange [FIN, ACK] Seq=90 Ack=42 Win=65495 Len=0

Frame 28: 60 bytes on wire (480 bits), 60 bytes captured (480 bits) on
interface 0
Ethernet II, Src: Actionte_8f:86:00 (10:5f:06:8f:86:00), Dst: Intel_
5a:b1:0c (00:11:11:5a:b1:0c)
Internet Protocol Version 4, Src: 98.100.194.170 (98.100.194.170), Dst:
192.168.0.2 (192.168.0.2)
Transmission Control Protocol, Src Port: nntp (119), Dst Port: mnp-
exchange (2197), Seq: 90, Ack: 42, Len: 0

No. Time Source Destination
Protocol Length Info
29 25.631590000 192.168.0.2 98.100.194.170 TCP
54 mnp-exchange > nntp [ACK] Seq=42 Ack=91 Win=65446 Len=0

Frame 29: 54 bytes on wire (432 bits), 54 bytes captured (432 bits) on
interface 0
Ethernet II, Src: Intel_5a:b1:0c (00:11:11:5a:b1:0c), Dst: Actionte_
8f:86:00 (10:5f:06:8f:86:00)
Internet Protocol Version 4, Src: 192.168.0.2 (192.168.0.2), Dst:
98.100.194.170 (98.100.194.170)
Transmission Control Protocol, Src Port: mnp-exchange (2197), Dst Port:
nntp (119), Seq: 42, Ack: 91, Len: 0

No. Time Source Destination
Protocol Length Info
30 25.706886000 130.133.4.11 192.168.0.2 NNTP
61 Response: 205 .

Frame 30: 61 bytes on wire (488 bits), 61 bytes captured (488 bits) on
interface 0
Ethernet II, Src: Actionte_8f:86:00 (10:5f:06:8f:86:00), Dst: Intel_
5a:b1:0c (00:11:11:5a:b1:0c)
Internet Protocol Version 4, Src: 130.133.4.11 (130.133.4.11), Dst:
192.168.0.2 (192.168.0.2)
Transmission Control Protocol, Src Port: nntp (119), Dst Port: onehome-
help (2199), Seq: 122, Ack: 2, Len: 7
Network News Transfer Protocol

No. Time Source Destination
Protocol Length Info
31 25.706980000 130.133.4.11 192.168.0.2 TCP
60 nntp > onehome-help [FIN, ACK] Seq=129 Ack=2 Win=14600 Len=0

Frame 31: 60 bytes on wire (480 bits), 60 bytes captured (480 bits) on
interface 0
Ethernet II, Src: Actionte_8f:86:00 (10:5f:06:8f:86:00), Dst: Intel_
5a:b1:0c (00:11:11:5a:b1:0c)
Internet Protocol Version 4, Src: 130.133.4.11 (130.133.4.11), Dst:
192.168.0.2 (192.168.0.2)
Transmission Control Protocol, Src Port: nntp (119), Dst Port: onehome-
help (2199), Seq: 129, Ack: 2, Len: 0

No. Time Source Destination
Protocol Length Info
32 25.707012000 192.168.0.2 130.133.4.11 TCP
54 onehome-help > nntp [ACK] Seq=2 Ack=130 Win=65407 Len=0

Frame 32: 54 bytes on wire (432 bits), 54 bytes captured (432 bits) on
interface 0
Ethernet II, Src: Intel_5a:b1:0c (00:11:11:5a:b1:0c), Dst: Actionte_
8f:86:00 (10:5f:06:8f:86:00)
Internet Protocol Version 4, Src: 192.168.0.2 (192.168.0.2), Dst:
130.133.4.11 (130.133.4.11)
Transmission Control Protocol, Src Port: onehome-help (2199), Dst Port:
nntp (119), Seq: 2, Ack: 130, Len: 0

No. Time Source Destination
Protocol Length Info
33 67.120560000 192.168.0.1 224.0.0.1 IGMPv3
60 Membership Query, general

Frame 33: 60 bytes on wire (480 bits), 60 bytes captured (480 bits) on
interface 0
Ethernet II, Src: Actionte_8f:86:00 (10:5f:06:8f:86:00), Dst: IPv4mcast_
00:00:01 (01:00:5e:00:00:01)
Internet Protocol Version 4, Src: 192.168.0.1 (192.168.0.1), Dst:
224.0.0.1 (224.0.0.1)
Internet Group Management Protocol

No. Time Source Destination
Protocol Length Info
34 69.060522000 192.168.0.2 224.0.0.22 IGMPv3
54 Membership Report / Join group 239.255.255.250 for any sources

Frame 34: 54 bytes on wire (432 bits), 54 bytes captured (432 bits) on
interface 0
Ethernet II, Src: Intel_5a:b1:0c (00:11:11:5a:b1:0c), Dst: IPv4mcast_
00:00:16 (01:00:5e:00:00:16)
Internet Protocol Version 4, Src: 192.168.0.2 (192.168.0.2), Dst:
224.0.0.22 (224.0.0.22)
Internet Group Management Protocol

Sorry, but makes no sense to me.

Ken

 

[Paul]

Couldn't find that option.

You want View : Name Resolution, then tick MAC, Network, and Transport Layer.

In the Info column, you should be seeing messages like this.

Response: 200 mx02.eternal-september.org InterNetNews NNRP server INN 2.6.0
Request: AUTHINFO user myusername
Response: 381 Enter password
Request: AUTHINFO pass mypassword
Response: 281 Authentication succeeded
Request: GROUP microsoft.public.windowsxp.general
Response: 211 4691 86654 119566 microsoft.public.windowsxp.general

On port 119, the information is visible in plaintext. The "response"
for example, is actual text in the packet.

The server can also send error messages. The number can effectively
indicate an error has happened, while the message text can even be
adjusted by the NSP administrator. So not all NSPs have the same
error message text, although the number they map to tells you
the general class of error.

Here is the capture data from Xnews' failed attempt to read the newsrc files:

<<edited...>>

Frame 1: 192.168.0.1 192.168.0.2 DNS 92 Standard query response 0xd9c3 A 98.100.194.170

Frame 2: 192.168.0.2 192.168.0.1 DNS 79 Standard query 0x97e2 A news.individual.net

Frame 3: 192.168.0.2 98.100.194.170 TCP 62 mnp-exchange > nntp [SYN]

Frame 4: Dest Port: nntp (119)
192.168.0.1 192.168.0.2 DNS 95 Standard query response 0x97e2 A 130.133.4.11

Frame 5: Src Port: domain (53)
192.168.0.2 130.133.4.11 TCP onehome-help > nntp [SYN]
Frame 6: 98.100.194.170 192.168.0.2 TCP nntp > mnp-exchange [SYN, ACK]

Frame 7: Src Port: nntp (119)
192.168.0.2 98.100.194.170 TCP mnp-exchange > nntp [ACK]

Frame 8: 130.133.4.11 192.168.0.2 TCP nntp > onehome-help [SYN, ACK]

Frame 9: Src Port: nntp (119)
192.168.0.2 130.133.4.11 TCP onehome-help > nntp [ACK]

Frame 10: 98.100.194.170 192.168.0.2 NNTP Response: 200 Optimax-NNTP, Optimax-Hamster V1.24

Frame 11: Src Port: nntp (119)
192.168.0.2 98.100.194.170 NNTP Request: MODE READER

Frame 12: 98.100.194.170 192.168.0.2 NNTP Response: 200 ignored

Frame 13: Src Port: nntp (119)
192.168.0.2 98.100.194.170 NNTP Request: GROUP sdforum.newsreaders

Frame 14: 130.133.4.11 192.168.0.2 NNTP Response: 200 The server welcomes
184-98-134-233.phnx.qwest.net
Authorization required for reading and posting.

Frame 15: Src Port: nntp (119)
98.100.194.170 192.168.0.2 NNTP Response: 211 176 1 176 sdforum.newsreaders

Frame 16: Src Port: nntp (119)
192.168.0.2 130.133.4.11 TCP onehome-help > nntp [ACK]

Frame 17: 192.168.0.2 98.100.194.170 TCP mnp-exchange > nntp [ACK]

Frame 18: Actionte_8f:86:00 Intel_5a:b1:0c ARP Who has 192.168.0.2? Tell 192.168.0.1

Frame 19: Intel_5a:b1:0c Actionte_8f:86:00 ARP 192.168.0.2 is at 00:11:11:5a:b1:0c

Frame 20: 192.168.0.1 239.255.255.250 SSDP NOTIFY * HTTP/1.1

Frame 21: Src Port: ssdp (1900)
192.168.0.1 239.255.255.250 SSDP NOTIFY * HTTP/1.1

Frame 22: Src Port: ssdp (1900)
192.168.0.1 239.255.255.250 SSDP NOTIFY * HTTP/1.1

Frame 23: Src Port: ssdp (1900)
192.168.0.1 239.255.255.250 SSDP NOTIFY * HTTP/1.1

Frame 24: Src Port: ssdp (1900)
192.168.0.2 130.133.4.11 TCP onehome-help > nntp [FIN, ACK]

Frame 25: 192.168.0.2 98.100.194.170 TCP mnp-exchange > nntp [FIN, ACK]

Frame 26: 98.100.194.170 192.168.0.2 TCP nntp > mnp-exchange [ACK]

Frame 27: Src Port: nntp (119)
98.100.194.170 192.168.0.2 TCP nntp > mnp-exchange [FIN, ACK]

Frame 28: Src Port: nntp (119)
192.168.0.2 98.100.194.170 TCP mnp-exchange > nntp [ACK]

Frame 29: 130.133.4.11 192.168.0.2 NNTP Response: 205 .

Frame 30: Src Port: nntp (119)
130.133.4.11 192.168.0.2 TCP nntp > onehome-help [FIN, ACK]

Frame 31: Src Port: nntp (119)
192.168.0.2 130.133.4.11 TCP onehome-help > nntp [ACK]

Frame 32: 192.168.0.1 224.0.0.1 IGMPv3 Membership Query, general

Frame 33: 192.168.0.2 224.0.0.22 IGMPv3 Membership Report / Join group
239.255.255.250 for any sources

Frame 34: 192.168.0.2 224.0.0.22 Internet Group Management Protocol

Sorry, but makes no sense to me.

Ken

If Name Resolution was fully turned on, the trace would be a bit easier to read.

I'm guessing you have a couple routers in a row.

192.168.0.1 could be the gateway address of the *nearest* router
192.168.0.2 could be the IP address of your computer. Using ipconfig /all from
the Command Prompt, might help you verify it. The Name Resolution feature
only works for public IPs, so it will not say "oh, 192.169.0.2 is
your computer". It isn't that clever. When numbers are left in the
trace, you have to do extra work to figure those out.
98.100.194.170 Public IP address as acquired by your *furthest* modem/router
from rr.com. Note that Xnews is attempting to do NNTP protocol,
to your router! It should not talk to 98.100.194.170, it should
be talking to news.individual.net. So, yes, I see a problem, a
difference between how mine works and how yours works.
130.133.4.11 news.individual.net , where the NNTP protocol really should be pointed.

I'm no networking expert, but what could be happening is...

1) Computer makes boneheaded mistake, and attempts to do NNTP
protocol, directly, with *nearest* router.
2) Nearest router tries to "play it cool". Nearest router attempts
to use SSDP (simple service discovery protocol), to find a service
on your LAN that does NNTP. It tries to find a local NNTP service
on your behalf. Of course, this fails.
3) There is an ARP (address resolution protocol), so it's attempting
something with one of your local addresses.
4) The IGMPV3, I haven't a clue.

So the goofy part, is the very first part.

The second funny thing, is the response in Frame 10 and Frame 14.
*Two* newsservers are responding. My suspicion is "Optimax-Hamster V1.24"
is running locally. Whereas the 200 Authorization Required one is
coming from news.individual.net.

I cannot find any really good Google reference to Optimax-Hamster,
which is not helping matters. And the so-called Xnews help pages
aren't clarifying things for me.

Somehow, Xnews seems a bit confused about who to talk to first.

In Frame 29, the response is 205, but there is no text. Looking up
205 here gives...

http://tools.ietf.org/html/rfc3977

205 NNTP Service exits normally

And that is news.individual.net giving up on you, because
you did not send enough additional protocol to carry on a
session.

You have two NNTP sessions going on at the same time.
Optimax-Hamster has the full attention of Xnews. The
responses from individual.net are getting ignored,
until that server closes the session.

We need someone who knows Xnews better than I do, to help you.

I hope my editing doesn't foul up that trace, as it's hard
work to not erase something important for later.

Paul

 

[KenK]

You want View : Name Resolution, then tick MAC, Network, and Transport
Layer.

In the Info column, you should be seeing messages like this.

Response: 200 mx02.eternal-september.org InterNetNews NNRP server
INN 2.6.0 Request: AUTHINFO user myusername
Response: 381 Enter password
Request: AUTHINFO pass mypassword
Response: 281 Authentication succeeded
Request: GROUP microsoft.public.windowsxp.general
Response: 211 4691 86654 119566 microsoft.public.windowsxp.general

On port 119, the information is visible in plaintext. The "response"
for example, is actual text in the packet.

The server can also send error messages. The number can effectively
indicate an error has happened, while the message text can even be
adjusted by the NSP administrator. So not all NSPs have the same
error message text, although the number they map to tells you
the general class of error.

It helped, but not as much as you show. Evidently there are other options
I should have set.

If Name Resolution was fully turned on, the trace would be a bit
easier to read.

The second funny thing, is the response in Frame 10 and Frame 14.
*Two* newsservers are responding. My suspicion is "Optimax-Hamster
V1.24" is running locally. Whereas the 200 Authorization Required one
is coming from news.individual.net.

I cannot find any really good Google reference to Optimax-Hamster,
which is not helping matters. And the so-called Xnews help pages
aren't clarifying things for me.

Optimax is the name of the private news server I look at. I _think_
Hamster is the name of the news server software it uses. Individual net
is my Usenet server.

Somehow, Xnews seems a bit confused about who to talk to first.

From watching Xnews loading message counts, it seems to alternate between
loading counts between the news servers. Xnews will show messages from
more than one server.

In Frame 29, the response is 205, but there is no text. Looking up
205 here gives...

http://tools.ietf.org/html/rfc3977

205 NNTP Service exits normally

And that is news.individual.net giving up on you, because
you did not send enough additional protocol to carry on a
session.

The newest Wireshark data shows Individual net requesting and accepting
the authentication.

You have two NNTP sessions going on at the same time.
Optimax-Hamster has the full attention of Xnews. The
responses from individual.net are getting ignored,
until that server closes the session.

No, Xnews handles more than one server simultaniously <sp?> and you can
very easily switch between them for reading and sending messages once the
message counts have been loaded.

We need someone who knows Xnews better than I do, to help you.

I have given up. It seems to be that the eMachine for some reason does
not process the news server files correctly. The same software and files
copied to my backup machine work fine - as they are as I type this on my

Paul

Can you suggest another news reader? I hope it works on the eMachine. A
friend suggests Xananews but there are a LOT of entries on uninstalling
it on Google - a bad omen.

Ken

 

[Paul]

Can you suggest another news reader? I hope it works on the eMachine. A
friend suggests Xananews but there are a LOT of entries on uninstalling
it on Google - a bad omen.

Ken

Every news client has a purpose, or set of features intended for
things a user might want to do with it.

I use an older copy of Thunderbird, with HTML parsing turned off.
It's no good for downloading movies, doesn't have good filters
or scoring. About all it can do, is basic posting with threaded
viewing of the results.

I'm using 2.0.0.24, but many other versions are available.

ftp://ftp.mozilla.org/pub/mozilla.org/thunderbird/releases/

It's even available for more than one platform.

As long as you tick "Always request authentication" when the
server needs a username/password, you'll be fine.

Paul