Xnews failure update in XP Home

As I posted here earlier, I couldn't get Xnews news reader to work
properly on my sMachine T2984 computer; it couldn't DL message counts,
headers or messages. It does get lists of group names, authenticates
connection if required and some other things so it's successfully
connected to the news server and getting some data. It fails with no
error message. Xnews has run fine for me on the eMachine for many many
years.

The eMachine has no problem running my other software - Firefox, Eudora
email ap, Kaspersky virus protection, etc. The eMachine uses DSL but
exhibits the Xnews problems using a dial-up connection with another ISP
as well. News server ports are set to 119. It fails with two separate
news servers with different groups. The same copy of Xnews that fails
runs with no problem on my Compaq backup system.

A friend sent me a ZIP of Xananews. I installed it and it has the same
problem as Xnews so it's not a problem with Xnews, but something wrong in
the eMachine, but for the life of me I can't think of what it might be.
The problem started one morning between separate turn-ons and computer
sessions with no warnings or error messages. No new software installed,
upgrades, uninstalls, or anything else.

I tried Wireshark packet sniffer but don't understand its results.

Can anyone think of anything, likely a hardware or OS fault, that could
cause such a problem?

This was a long post but I tried to anticipate any questions.

Hoping for TIA.


--
You know it's time to clean the refrigerator
when something closes the door from the inside.

KenK wrote:
As I posted here earlier, I couldn't get Xnews news reader to work
properly on my sMachine T2984 computer; it couldn't DL message counts,
headers or messages. It does get lists of group names, authenticates
connection if required and some other things so it's successfully
connected to the news server and getting some data. It fails with no
error message. Xnews has run fine for me on the eMachine for many many
years.

The eMachine has no problem running my other software - Firefox, Eudora
email ap, Kaspersky virus protection, etc. The eMachine uses DSL but
exhibits the Xnews problems using a dial-up connection with another ISP
as well. News server ports are set to 119. It fails with two separate
news servers with different groups. The same copy of Xnews that fails
runs with no problem on my Compaq backup system.

A friend sent me a ZIP of Xananews. I installed it and it has the same
problem as Xnews so it's not a problem with Xnews, but something wrong in
the eMachine, but for the life of me I can't think of what it might be.
The problem started one morning between separate turn-ons and computer
sessions with no warnings or error messages. No new software installed,
upgrades, uninstalls, or anything else.

I tried Wireshark packet sniffer but don't understand its results.

Can anyone think of anything, likely a hardware or OS fault, that could
cause such a problem?

This was a long post but I tried to anticipate any questions.

Hoping for TIA.

Xananews is another multithreaded multiserver program.

Why aren't you debugging with something a little more single-threaded ?

If you aren't running Thunderbird for anything now, install version
2.0.0.24 and test with your server. Remember to tick "Always Request Authentication",
if connecting to a news server that needs a USER and PASS field passed
to it.

(Link to the download for a US English user...)

ftp://ftp.mozilla.org/pub/mozilla.or...202.0.0.24.exe

*******

One thing I didn't see in your Wireshark trace, is AUTHINFO USER and PASS
commands sent to news.individual.net. Does Xnews have an "Always
Request Authentication" option ? If your news server requires you
to log in, the process must be "volunteered" from your end. The
protocol does not "prompt" you for a username, in the way that
FTP might. You make your news server, send USER and PASS commands,
which the server observes as attempts to authenticate, and then it
lets you in. It's a weird protocol, and if you don't send USER and
PASS, the server could just hang up on you.

Make sure Xnews is "volunteering" the USER and PASS for that server.

*******

If you don't want to test with Thunderbird, you can test this way.

http://www.anta.net/misc/telnet-trou...ing/nntp.shtml

In Command Prompt, run telnet

telnet news.individual.net nntp

Then, in their example, they're entering this text from the keyboard.
I've modified the session a bit,

AUTHINFO user my_username_on_individual_net
AUTHINFO pass my_password_on_individual_net
POST
From:
Newsgroups: misc.test
Subject: Test article
Message-ID:

This is a test.
. --- This dot means "end of message", it gets posted.
GROUP misc.test --- Now, he checks to see the message number.

The person selects the high-water mark from the last command,
which returned this in the Telnet window. The person crafting
this example, assumes no one else has submitted a message.
The 269643 is the high water mark.

211 24 269620 269643 misc.test selected

So he then sends this, to fetch the newly posted article.

ARTICLE 269643
quit

That's an example of a transaction. Done with Telnet.

Note that some servers have extremely short connection
timeout values. If there is no activity on the port for
ten seconds, the port can close. At one time, the timeout
might have been set to a couple minutes. But being
"tight *******s", the NSP sets the timeout extremely short,
so fewer sessions are connected to the server at any one
time (uses less server memory, more users can be hosted).
And that means, you almost need a "here is" script
to feed into Telnet stdin, so the commands are sent in
rapid-fire succession.

Knowing that, I'd switch over to Thunderbird, fire up
Wireshark, and test that way :-)

And yes, you can easily see what is happening in Wireshark.
If the transaction is single thread, it'll be a lot easier
to see and follow.

*******

Please review your networking setup.

DSL_provider ---- new_modem_router ----- (Ethernet cable to computer)

That's what I think it is.

Have you done something different, like add another router
in series with the above setup ?

Your news server won't send USER and PASS, if the
initial attempt to reach the server (get the 200 message)
is failing to be seen. But if the 200 message comes in,
the news client sees that, it can then send out
the AUTHINFO USER command, to pass the username to
the server.

Paul

On 18 Oct 2014, KenK wrote in
microsoft.public.windowsxp.general:

Can anyone think of anything, likely a hardware or OS fault, that
could cause such a problem?

Firewall blocking the port? Maybe somethin in you HOSTS file is
interfering?

news.individual.net also can be accessed at port 8119 - try that?

https://news.individual.net/config.php

Nil wrote in
:

On 18 Oct 2014, KenK wrote in
microsoft.public.windowsxp.general:

Can anyone think of anything, likely a hardware or OS fault, that
could cause such a problem?

Firewall blocking the port? Maybe somethin in you HOSTS file is
interfering?

news.individual.net also can be accessed at port 8119 - try that?

https://news.individual.net/config.php

Xnews worked correctly on the eMachine this morning when I started it
from force of habit. I turned it off and updated the newscr files. Then
ran it again - didn't work. sigh So I doubt it's the port address.

Firewall is part of Kaspersky Internet Security 2015. Updated 9/25. Xnews
failed 10/8 so I don't think there is a connection.

HOSTS file? No familiar with that.

--
You know it's time to clean the refrigerator
when something closes the door from the inside.

Paul wrote in :

KenK wrote:
As I posted here earlier, I couldn't get Xnews news reader to work
properly on my sMachine T2984 computer; it couldn't DL message
counts, headers or messages. It does get lists of group names,
authenticates connection if required and some other things so it's
successfully connected to the news server and getting some data. It
fails with no error message. Xnews has run fine for me on the
eMachine for many many years.

The eMachine has no problem running my other software - Firefox,
Eudora email ap, Kaspersky virus protection, etc. The eMachine uses
DSL but exhibits the Xnews problems using a dial-up connection with
another ISP as well. News server ports are set to 119. It fails with
two separate news servers with different groups. The same copy of
Xnews that fails runs with no problem on my Compaq backup system.

A friend sent me a ZIP of Xananews. I installed it and it has the
same problem as Xnews so it's not a problem with Xnews, but something
wrong in the eMachine, but for the life of me I can't think of what
it might be. The problem started one morning between separate
turn-ons and computer sessions with no warnings or error messages. No
new software installed, upgrades, uninstalls, or anything else.

I tried Wireshark packet sniffer but don't understand its results.

Can anyone think of anything, likely a hardware or OS fault, that
could cause such a problem?

This was a long post but I tried to anticipate any questions.

Hoping for TIA.

Xananews is another multithreaded multiserver program.

Why aren't you debugging with something a little more single-threaded
?

If you aren't running Thunderbird for anything now, install version
2.0.0.24 and test with your server. Remember to tick "Always Request
Authentication", if connecting to a news server that needs a USER and
PASS field passed to it.

(Link to the download for a US English user...)

ftp://ftp.mozilla.org/pub/mozilla.or...s/2.0.0.24/win
32/en-US/Thunderbird%20Setup%202.0.0.24.exe

DLed and tested. Gets group list, gets message count but doesn't DL
messages or headers. Says news server file timed out. That server does
not require authntication like individual net.

Interesting bit of news:

Xnews worked correctly on the eMachine this morning when I started it
from force of habit. I turned it off and updated the newscr files. Then
ran it again - didn't work. sigh Curiouser and curiouser!


One thing I didn't see in your Wireshark trace, is AUTHINFO USER and
PASS commands sent to news.individual.net. Does Xnews have an "Always
Request Authentication" option ? If your news server requires you
to log in, the process must be "volunteered" from your end. The
protocol does not "prompt" you for a username, in the way that
FTP might. You make your news server, send USER and PASS commands,
which the server observes as attempts to authenticate, and then it
lets you in. It's a weird protocol, and if you don't send USER and
PASS, the server could just hang up on you.

Make sure Xnews is "volunteering" the USER and PASS for that server.

One later more legible list from Wireshark includes:

news.individual,net 192.168.0.2 NNTP 97 Response 281 Authentication
accepted (UID=307388)

*******

If you don't want to test with Thunderbird, you can test this way.

http://www.anta.net/misc/telnet-trou...ing/nntp.shtml

In Command Prompt, run telnet

telnet news.individual.net nntp

Then, in their example, they're entering this text from the keyboard.
I've modified the session a bit,

AUTHINFO user my_username_on_individual_net
AUTHINFO pass my_password_on_individual_net
POST
From:
Newsgroups: misc.test
Subject: Test article
Message-ID:

This is a test.
. --- This dot means "end of message", it
gets posted. GROUP misc.test --- Now, he checks to see
the message number.

The person selects the high-water mark from the last command,
which returned this in the Telnet window. The person crafting
this example, assumes no one else has submitted a message.
The 269643 is the high water mark.

211 24 269620 269643 misc.test selected

So he then sends this, to fetch the newly posted article.

ARTICLE 269643
quit

That's an example of a transaction. Done with Telnet.

Note that some servers have extremely short connection
timeout values. If there is no activity on the port for
ten seconds, the port can close. At one time, the timeout
might have been set to a couple minutes. But being
"tight *******s", the NSP sets the timeout extremely short,
so fewer sessions are connected to the server at any one
time (uses less server memory, more users can be hosted).
And that means, you almost need a "here is" script
to feed into Telnet stdin, so the commands are sent in
rapid-fire succession.

Knowing that, I'd switch over to Thunderbird, fire up
Wireshark, and test that way :-)

And yes, you can easily see what is happening in Wireshark.
If the transaction is single thread, it'll be a lot easier
to see and follow.

*******

Please review your networking setup.

DSL_provider ---- new_modem_router ----- (Ethernet cable to
computer)

That's what I think it is.

Have you done something different, like add another router
in series with the above setup ?

No.

Your news server won't send USER and PASS, if the
initial attempt to reach the server (get the 200 message)
is failing to be seen. But if the 200 message comes in,
the news client sees that, it can then send out
the AUTHINFO USER command, to pass the username to
the server.

Paul


I'll reread this later but I think I answered your questions.

Thanks for your help as always.

Ken



--
You know it's time to clean the refrigerator
when something closes the door from the inside.

Paul wrote in :

Knowing that, I'd switch over to Thunderbird, fire up
Wireshark, and test that way :-)


Ok. Earlier this morning I ran Wireshark on an attempt to get messages with
Thunderbird. I've not had a chance to read the printed result. Hope I can
understand it. I didn't get anything out of the trace it showed on the
screen after it ran. For some reason, the printed list is always very
different - and much harder to understand.

Ken


--
You know it's time to clean the refrigerator
when something closes the door from the inside.

Paul wrote in :

Knowing that, I'd switch over to Thunderbird, fire up
Wireshark, and test that way :-)



I checked the Wireshark output from my Thunderbird connection attempt
yesterday. As usual, I got little that I could understand.

However, I noticed one often repeated line that seemed to result when T-
bird was attempting to get message info from the Optimax news server:

NOTIFY * HTTP/1.1

I tried Google but got nothing I could understand. Mean anything to you?

Today I'm going to look at the Windows and Kaspersky Internet Security
2015 firewall settings. I doubt if that's the problem but I'm getting
desperate! I'll also try Google again but all I seem to get is my own
messages on Usenet. sigh

Ken


--
You know it's time to clean the refrigerator
when something closes the door from the inside.

KenK wrote in news:XnsA3CE434E06DA4invalidcom@
130.133.4.11:

Today I'm going to look at the Windows and Kaspersky Internet Security
2015 firewall settings.

Turned off Windows firewall. No help so turned it back on. Having a problem
finding Kaspersky firewall settings. Next will try Google.

Ken


--
You know it's time to clean the refrigerator
when something closes the door from the inside.

Nil wrote in news:XnsA3CAA9A7881F0nilch1
@wheedledeedle.moc:

Firewall blocking the port?

Turned off Windows firewall. No help so turned it back on. Having a problem
finding Kaspersky firewall settings. Next will try Google.


--
You know it's time to clean the refrigerator
when something closes the door from the inside.

KenK wrote:
Paul wrote in :

Knowing that, I'd switch over to Thunderbird, fire up
Wireshark, and test that way :-)



I checked the Wireshark output from my Thunderbird connection attempt
yesterday. As usual, I got little that I could understand.

However, I noticed one often repeated line that seemed to result when T-
bird was attempting to get message info from the Optimax news server:

NOTIFY * HTTP/1.1

I tried Google but got nothing I could understand. Mean anything to you?

Today I'm going to look at the Windows and Kaspersky Internet Security
2015 firewall settings. I doubt if that's the problem but I'm getting
desperate! I'll also try Google again but all I seem to get is my own
messages on Usenet. sigh

Ken



https://ask.wireshark.org/questions/2387/ssdp-traffic

"SSDP (Simple Service Discovery protocol) is a part of UPnP
(Universal Plug and Play).

It is normal traffic for all UPnP enabled devices in your LAN.

Each device will send out a group of NOTIFY packets every
15 minutes or so while UPnP is enabled.

Many devices will also periodically send out M-SEARCH packets,
which are usually followed by response HTTP packets.
"

It's as if the Iptimax server wants to be found, and so it is
participating in UPNP ? Do you see SSDP mentioned in that
entry in Wireshark ?

Remember that you're looking at about five transactions at
once in that Wireshark trace. I don't think it's a coincidence
that they all happen at once, as if some program on your computer
(Xnews) is poking something.

When I run Thunderbird for NNTP here, there would be some DNS activity
(both to populate the Wireshark trace with names, as well as
DNS to find the E-S news server). As well as the NNTP protocol
to the INN server at E-S. And the analysis is pretty straight-forward,
as I'm using port 119, everything (username and password too)
are in plaintext, and each response uses standard numbers
(like "200" when first contacting the server). The administrator
on the INN server, can change the associated text message that
travels with the number. On some servers, this leads to user
confusion, such as when AIOE sends a terse "Banlist" message.
When it could just as easily have explained "Group closed to posting"
as a response. Looking up the number part, the "200" thing,
can help you "decode" terse custom responses like "Banlist".
You can look up the official definition of the number, to
see what it might mean.

I don't usually get routing traffic, as I tend to disable
IPV6 on OSes here. (There are a couple ways to prevent IPV6
activities, and one of them damages things, so you have to
be careful to do the background research before hammering
stuff.) I had to turn off the router in my ADSL modem/router
box, because it was being a pain with all the extra traffic
and flashing LED activity. That was related to IPV6. The separate
router box I use, just does IPV4, and that box is "quiet" when
the LAN is quiet. Some day I'll have to turn some of this stuff
back on, as IPV6 will soon be mandatory. We're close to exhaustion
and networking failures via IPV4. And it's possible that on
the Internet side of my setup, I'll need to run IPV6 again.
Even if the router does 6to4 to deal with my LAN side.
"Pauls head will explode" if he has to deal with IPV6 on
the home LAN... :-)

Paul

Paul wrote in :

KenK wrote:
Paul wrote in :

Knowing that, I'd switch over to Thunderbird, fire up
Wireshark, and test that way :-)



I checked the Wireshark output from my Thunderbird connection attempt
yesterday. As usual, I got little that I could understand.

However, I noticed one often repeated line that seemed to result when
T- bird was attempting to get message info from the Optimax news
server:

NOTIFY * HTTP/1.1

I tried Google but got nothing I could understand. Mean anything to
you?

Today I'm going to look at the Windows and Kaspersky Internet
Security 2015 firewall settings. I doubt if that's the problem but
I'm getting desperate! I'll also try Google again but all I seem to
get is my own messages on Usenet. sigh

Ken



https://ask.wireshark.org/questions/2387/ssdp-traffic

"SSDP (Simple Service Discovery protocol) is a part of UPnP
(Universal Plug and Play).

It is normal traffic for all UPnP enabled devices in your LAN.

Each device will send out a group of NOTIFY packets every
15 minutes or so while UPnP is enabled.

Many devices will also periodically send out M-SEARCH packets,
which are usually followed by response HTTP packets.
"

It's as if the Iptimax server wants to be found, and so it is
participating in UPNP ? Do you see SSDP mentioned in that
entry in Wireshark ?

No.

Remember that you're looking at about five transactions at
once in that Wireshark trace. I don't think it's a coincidence
that they all happen at once, as if some program on your computer
(Xnews) is poking something.

This was a Thunderbird trace, not Xnews, if it matters.


When I run Thunderbird for NNTP here, there would be some DNS activity
(both to populate the Wireshark trace with names, as well as
DNS to find the E-S news server). As well as the NNTP protocol
to the INN server at E-S. And the analysis is pretty straight-forward,
as I'm using port 119, everything (username and password too)
are in plaintext, and each response uses standard numbers
(like "200" when first contacting the server). The administrator
on the INN server, can change the associated text message that
travels with the number. On some servers, this leads to user
confusion, such as when AIOE sends a terse "Banlist" message.
When it could just as easily have explained "Group closed to posting"
as a response. Looking up the number part, the "200" thing,
can help you "decode" terse custom responses like "Banlist".
You can look up the official definition of the number, to
see what it might mean.

I don't usually get routing traffic, as I tend to disable
IPV6 on OSes here. (There are a couple ways to prevent IPV6
activities, and one of them damages things, so you have to
be careful to do the background research before hammering
stuff.) I had to turn off the router in my ADSL modem/router
box, because it was being a pain with all the extra traffic
and flashing LED activity. That was related to IPV6. The separate
router box I use, just does IPV4, and that box is "quiet" when
the LAN is quiet. Some day I'll have to turn some of this stuff
back on, as IPV6 will soon be mandatory. We're close to exhaustion
and networking failures via IPV4. And it's possible that on
the Internet side of my setup, I'll need to run IPV6 again.
Even if the router does 6to4 to deal with my LAN side.
"Pauls head will explode" if he has to deal with IPV6 on
the home LAN... :-)

Paul


I'm going to read this carefully later.

Ken


--
You know it's time to clean the refrigerator
when something closes the door from the inside.

KenK wrote in news:XnsA3CE434E06DA4invalidcom@
130.133.4.11:

Today I'm going to look at the Windows and Kaspersky Internet Security
2015 firewall settings.



Checked Kaspersky 2015 firewall. It has Xananews and especially Xnews under
a Low Restricted setting. These are the only aps there. From what I can
gather this shouldn't be causing my problem. But I do not have Kaspersky on
the machine that runs newsreaders ok. However, Thunderbird isn't mentioned
in the Kaspersky firewall files and it doesn't work either so that's maybe
not the problem?

Ken


--
You know it's time to clean the refrigerator
when something closes the door from the inside.

On 22 Oct 2014, KenK wrote in
microsoft.public.windowsxp.general:

Nil wrote in
news:XnsA3CAA9A7881F0nilch1 @wheedledeedle.moc:

Firewall blocking the port?

Turned off Windows firewall. No help so turned it back on. Having
a problem finding Kaspersky firewall settings. Next will try
Google.

You should never have two firewalls running at the same time. If you
have Kapersky's firewall, turn off Windows' and leave it off.

Try turning off all firewalls temporarily and see if that relieves the
problem.

KenK wrote:
KenK wrote in news:XnsA3CE434E06DA4invalidcom@
130.133.4.11:

Today I'm going to look at the Windows and Kaspersky Internet Security
2015 firewall settings.

Checked Kaspersky 2015 firewall. It has Xananews and especially Xnews under
a Low Restricted setting. These are the only aps there. From what I can
gather this shouldn't be causing my problem. But I do not have Kaspersky on
the machine that runs newsreaders ok. However, Thunderbird isn't mentioned
in the Kaspersky firewall files and it doesn't work either so that's maybe
not the problem?

Ken

If you want to present any more packet traces, you
can put them on pastebin.com . That's a site for passing
text files to people. Same rules as before - clear the
Wireshark display, start it running, collect a short trace.
Try to turn on the Name Resolution fields under View, so
the trace uses symbolic names.

After pasting into pastebin.com , collect the generated
URL and you can use that as a reference when posting.

Make sure there are no occurrences of USER or PASS with
your account username or password in the text file, before
posting. If you're working with port 119, they'll be in
the trace.

Paul

KenK wrote in
:

KenK wrote in news:XnsA3CE434E06DA4invalidcom@
130.133.4.11:

Today I'm going to look at the Windows and Kaspersky Internet
Security 2015 firewall settings.



Checked Kaspersky 2015 firewall. It has Xananews and especially Xnews
under a Low Restricted setting. These are the only aps there. From
what I can gather this shouldn't be causing my problem. But I do not
have Kaspersky on the machine that runs newsreaders ok. However,
Thunderbird isn't mentioned in the Kaspersky firewall files and it
doesn't work either so that's maybe not the problem?

Ken



Made a mistake as usual. When I looked for Thunderbird in Kaspersky
firewall list I missed entry for Mozilla, which it lists as accepted. So
if T-bird doesn't work, as it doesn't, then the Kaspersky firewall is not
the problem.

New grist for the mill:

To check for a port 119 problem, someone told me to use Xnews on

news.sff.net port 1119

I did and it worked perfectly. Then I turned off Xnews, turned it back on
- several times - and the sff news server no longer works, just like
Individual and Optimax. Wonder why it worked once? Just like Xnews worked
once on all news servers a few days ago. Weirder and weirder.

A clue?

TIA

Ken


--
You know it's time to clean the refrigerator
when something closes the door from the inside.