Computers on LAN cannot find each other.

[Joe_User]

I have a DLink DI-524 router, and two computers. Computer A is a Windows XP running a web server (XAMPP). Computer B is a Windows 2000 hosting a shared folder. Now here's the problem. On computer A, I can type in http://localhost, and it'll pull up the server just fine. I can also type in 127.0.0.1, and 192.168.0.110 (Computer A's IP), and it'll still pull up alright on Computer A. However, when I go to computer B and type in 192.168.0.110, it cannot find it.

Computer B has a shared folder, incoming. I can configure Windows to open \\192.168.0.112\incoming on Computer B, but that address won't work with Computer A. Neither computer has a firewall running (that blocks port 80), both computers are connected, so I'm thinking it might be the router.

NOTE: I updated the firmware (on a wired connection) right before the problem occurred.

[johnwill]

Can you PING each computer from the other by IP address and by name? If not, that's the first thing that needs to be addressed.

[Joe_User]

I don't know why I forgot about that.

Even though, it wasn't much use. I used Computer A to ping Computer B on its IP address, and all requests timed out.

[johnwill]

OK, you have a firewall issue. You need to disable the firewalls until you get it working, and you should only have one firewall running.

[Joe_User]

I don't know...

When I go into the D-Link settings, there is a setting under the "Advanced" tab that specifically lists firewall rules. However, there is one rule that caught my eye.

Enabled
Action: Deny
Name: Default
Source: *,* (Anywhere in the world)
Destination: LAN,* (Anywhere on the LAN)
Protocol: *,* (All protocols, All ports)

Unfortunately, there's no way to delete this rule. And when I clicked to return the system to the latest factory settings, it reverted to the most recent firmware update (which is causing the problem). I'll check with D-Link's support line to see if they'll be of any help to me.

[johnwill]

Forget the D-Link router, that firewall has nothing to do with the LAN side of the router. The firewall's I'm talking about are software firewalls on your computers.

[Joe_User]

No, there are no firewalls on either computer.

(The D-Link's firewall stealths all ports except 113).

[johnwill]

If you can't ping, you almost surely have a software firewall blocking the access. There really are not many other reasons this can happen. The fact that you have Internet access on the machines means the TCP/IP stack is working.

You are dragging a red herring in with the router's configuration, it has NOTHING to do with what happens between computers on the LAN side of the router.

[Joe_User]

Well, unless there's a software firewall hidden from plain sight (and every firewall I've used definitely does not do that), I don't know what else it could be.

On a side note, I emailed a tech support person at D-Link that is helping me (somewhat) fix the problem. Since he thinks the problem is with file sharing, he told me what to do to create a workgroup.

Now here's the weird thing. Computer 1 can only see itself on the workgroup. However, Computer 2 can see Computer 1 (and even ping it), but it can't access any shared folders on it. And when I checked the logs, I get this

Apr/02/2002 00:56:05 Target IP(192.168.0.1), Target Port(80) Packet Dropped
Apr/02/2002 00:56:05 Spoof IP(192.168.0.100), Spoof Port(1421)
Apr/02/2002 00:56:05 Spoof Attack fromd MAC(00-0f-b5-5c-5f-ad) Detect,

[johnwill]

Well, I have to disagree with the buy at D-Link, this has nothing to do with the router. The LAN side of a SOHO router is a simple unmanaged switch, and there is no filtering capability between computers on the LAN. I have two D-Link routers in my closet, and I've setup a host of others. Once again, failure to PING on your local network is a firewall of some kind.

How about posting a Hijackthis log for each computer so we can see what's running?

[Joe_User]

Here are the logs.
XPLog for computer A
2KLog for computer B

[johnwill]

Uhh... the 2K machine has ZoneAlarm installed, that's the firewall that I was talking about.

O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs LLC - C:\WINNT\system32\ZoneLabs\vsmon.exe

[Joe_User]

That's odd, I don't have ZoneAlarm running on my system. The only security products I have are AVG, Ad-Aware, and Spybot: S&D.

And when I try to kill vsmon (via task manager), it gives me an "Access Denied" error.

[johnwill]

You might want to ask in the security forum about removing ZA when you're in this situation, I know how I'd do it, but it's hacking at the registry, and I don't want to lead you down the wrong path and kill your system.

One way might be to install ZA and then uninstall it. Obviously, something got left behind on a ZA install.

[Joe_User]

Well, I re-installed Zone Alarm, and clicked the option to not start it automatically. And when I uninstalled it, it seemed that vsmon.exe was left behind in the uninstallation (Later, I read online that it is purposefully left behind). So, while it was still not running, I removed it from the system32 folder (to prevent it from starting up), and things now seem to be working normally.

Anyway, thank you for helping me with this problem.

[johnwill]

Interesting, I wonder why they leave garbage behind.