21583c35   
   From: m@rtij.nl.invlalid   
      
   On Fri, 20 Nov 2009 14:24:57 -0800, Don wrote:   
      
   >> - I would start tcpdump and look which host is sending the Network is   
      
   Correction, get wireshark so you can really look at the packets.   
      
   >> unreachable error. This may give some clue on where to start searching   
   >> further.   
      
   >   
   > I ran wget 74.125.67.100 repeatedly, and waited for symptoms.  Output of   
   >   
   > tcpdump 'tcp port 80 and host 74.125.67.100'   
      
   Ah, but now you don't get the icmp errors. Start a full session, no   
   filter (except filtering out known local traffic and the ssh session you   
   use) and find out which host exactly sends those icmp-errors.   
      
   >   
   > at the time of the symptoms, is:   
   >   
   > 16:06:14.628041 IP don-desktop.local.34499 > gw-in-f100.1e100.net.www:   
   > Flags [S], seq 2205816329, win 5840, options [mss 1460,sackOK,TS val   
   > 2409508 ecr 0,nop,wscale 7], length 0   
   >   
   > FWIW, right now, MTU on the router happens to be set to 1300.   
      
   As I don't see a DF in the above packet, that should be immaterial.   
      
   M4   
      
   --- SoupGate-Win32 v1.05   
    * Origin: you cannot sedate... all the things you hate (1:229/2)