I didn't activate HTTP filter. This setting is disabled.
I installed wireshark program. I can capture all TCP/UDP packets. I see that DNS query of LU is replied successfuly and LU can get IP address of the server at the beginning of the communication. Also LU can install other updates. For example, Pulse updates can be installed. I can send you wireshark log file if you need to determine the problem.
bigfoot2348,
I unplugged and plugged power cord of router and cable modem. It didn't change anything. Thank you.
I didn't activate HTTP filter. This setting is disabled.
I installed wireshark program. I can capture all TCP/UDP packets. I see that DNS query of LU is replied successfuly and LU can get IP address of the server at the beginning of the communication. Also LU can install other updates. For example, Pulse updates can be installed. I can send you wireshark log file if you need to determine the problem.
bigfoot2348,
I unplugged and plugged power cord of router and cable modem. It didn't change anything. Thank you.
Pulse updates use a different update mechanism so the fact that they work may be unrelated. It sounds like other 'regular' updates are working for you though so it may be something particular to the content of this specific update that is causing problems.
If you can zip your wireshark traces and e-mail them to me (assuming that they're small enough after compressing) I'll ask the LU guys to look at them. My e-mail address can be found in my profile by clicking on my name.
Thank you. Files received and forwarded to LiveUpdate team for analysis. I hope to have a response soon. Until then, can you tell me which language of operating system is installed on the system?
I installed English version of Windows 7 x64 Professional (from MSDN Academic Alliance). After installation, I downloaded Turkish Language Pack (MUI) and installed it. Language setting has been Turkish since then.
After analyzing the files we've determined what is happening. Your router is doing a form of search engine hijacking.
LiveUpdate is requesting a file from the LiveUpdate servers and the servers are returning a 404 (Not Found) response but your router is filtering that and actually returning a 200 (OK) response which indicates to LiveUpdate that an update is available. LiveUpdate then continues to retrieve the file and the router sends some JavaScript which LiveUpdate detects as an invalid package and flags an error.
Placing the LiveUpdate server address in the DMZ appears to bypass this filtering. Disabling the search feature in the router should solve the problem as well. Given the negative press that ISPs have been getting for search engine hijacking it's surprising to see Linksys/Cisco adding this to their router.
After analyzing the files we've determined what is happening. Your router is doing a form of search engine hijacking.
LiveUpdate is requesting a file from the LiveUpdate servers and the servers are returning a 404 (Not Found) response but your router is filtering that and actually returning a 200 (OK) response which indicates to LiveUpdate that an update is available. LiveUpdate then continues to retrieve the file and the router sends some JavaScript which LiveUpdate detects as an invalid package and flags an error.
Placing the LiveUpdate server address in the DMZ appears to bypass this filtering. Disabling the search feature in the router should solve the problem as well. Given the negative press that ISPs have been getting for search engine hijacking it's surprising to see Linksys/Cisco adding this to their router.
What exactly is the LiveUpdate main ip? I can not use domain names in the DMZ input, I must use an ip/range of ip's. Otherwise, I can not find the search option in the router.
What exactly is the LiveUpdate main ip? I can not use domain names in the DMZ input, I must use an ip/range of ip's. Otherwise, I can not find the search option in the router.
There isn't a main IP address. Symantec uses many providers distributed across the globe and they can be changed at any time.
I suggest that you talk with the router support people because this 'feature' is breaking proper network functionality and they should be able to tell you how to disable it.
I've been looking into the Linksys routers manual and found this under the QOS settings : the 'No Acknowledgement' setting.
This is what the manual states about the 'No Acknowledgement' setting under QOS :
'No Acknowledgement If you want to disable the Router’s Acknowledgement feature, so the Router will not re-send data if an error occurs, then select Enabled.
Otherwise, keep the default, Disabled.'
This is the only setting that I quickly found which may create the situation, described by Symantec
A bit reversed setting, by the way. Setting something off, by enabling.
Just try and see what happens; it doesn't do much harm to set it to Enabled.
If this is the cause, i think Linksys should change the default to 'Enabled'.
I've been looking into the Linksys routers manual and found this under the QOS settings : the 'No Acknowledgement' setting.
This is what the manual states about the 'No Acknowledgement' setting under QOS :
'No Acknowledgement If you want to disable the Router’s Acknowledgement feature, so the Router will not re-send data if an error occurs, then select Enabled.
Otherwise, keep the default, Disabled.'
This is the only setting that I quickly found which may create the situation, described by Symantec
A bit reversed setting, by the way. Setting something off, by enabling.
Just try and see what happens; it doesn't do much harm to set it to Enabled.
If this is the cause, i think Linksys should change the default to 'Enabled'.
I tried turning it off, no avail. I'll call Linksys support soon, they are much better than the Symantec Call Center, maybe they will help.
I did a little web searching and in this thread in Cisco's forum, it appears that they call the feature Web Assist and it was introduced in revision 7 of the firmware.
Thank you very much for your detailed technical explanations which I need. I am using firmware whose version is .07 If I can't solve the problem, I can request help from Cisco thanks to your detailed explanations.
Pieter, Thank you very much for your research about the problem. I am going to try this immediately when I go home. My router model is different (WRT110) but I suppose router has this setting.
This is it. The setting is not in the user manual, so Cisco does not even care to update the manuals.
For the average user this is very confusing and will never find the cause of the problem.
MAybe it's a good idea to change the subject, so others can find the cause is a Linksys router.
Is Symantec planning a circumvention in the Liveupdate code (if even possible)? Thousands may be hit by this problem, without even realizing it's their router.
This is it. The setting is not in the user manual, so Cisco does not even care to update the manuals.
For the average user this is very confusing and will never find the cause of the problem.
MAybe it's a good idea to change the subject, so others can find the cause is a Linksys router.
Is Symantec planning a circumvention in the Liveupdate code (if even possible)? Thousands may be hit by this problem, without even realizing it's their router.
Hi hvgsel
Perhaps you should post an article on this in the Tech Outpost Forum.
This is it. The setting is not in the user manual, so Cisco does not even care to update the manuals.
For the average user this is very confusing and will never find the cause of the problem.
MAybe it's a good idea to change the subject, so others can find the cause is a Linksys router.
Is Symantec planning a circumvention in the Liveupdate code (if even possible)? Thousands may be hit by this problem, without even realizing it's their router.
Symantec is currently testing a way of detecting and working around this situation in the 2011 Beta products. You might want to try those out and see if the problem goes away with them.
Thank you very much for your detailed technical explanations which I need. I am using firmware whose version is .07 If I can't solve the problem, I can request help from Cisco thanks to your detailed explanations.
Pieter, Thank you very much for your research about the problem. I am going to try this immediately when I go home. My router model is different (WRT110) but I suppose router has this setting.
I will inform you about the result
From the little bit of reading that I did on Cisco's site, the WRT100 and WRT110 use the same firmware.
This is it. The setting is not in the user manual, so Cisco does not even care to update the manuals.
For the average user this is very confusing and will never find the cause of the problem.
MAybe it's a good idea to change the subject, so others can find the cause is a Linksys router.
Is Symantec planning a circumvention in the Liveupdate code (if even possible)? Thousands may be hit by this problem, without even realizing it's their router.
Symantec is currently testing a way of detecting and working around this situation in the 2011 Beta products. You might want to try those out and see if the problem goes away with them.
Thank you Reese, but i use D-link routers which do not have the problem.
I made the remarks, because I was thinking of the many (not experienced) users with Linksys routers.
Nevertheless, i am planning testing 2011 Beta next week.
Thank you very much for your detailed technical explanations which I need. I am using firmware whose version is .07 If I can't solve the problem, I can request help from Cisco thanks to your detailed explanations.
Pieter, Thank you very much for your research about the problem. I am going to try this immediately when I go home. My router model is different (WRT110) but I suppose router has this setting.
I will inform you about the result
From the little bit of reading that I did on Cisco's site, the WRT100 and WRT110 use the same firmware.
I looked for the CWA setting, there is none on the WRT100, running 1.0.07. I'll try looking through telnet, but I doubt that will work.
EDIT: WRT series routers have no telnet access....