Page 1 of 1

Connection problems to WPN - with MX Monitor or without!

PostPosted: Wed Oct 27, 2004 6:56 pm
by Keyser_Soze
I've been experiencing problems connecting to WinMX through MX Monitor lately. I can't seem to connect to the WinMX network through MX Monitor whatsoever. I can connect to WinMX just by starting WinMX alone, but it takes a long time to connect to the network and I can only get approx 300+ chatrooms to list rather than the usual 1000+ chatrooms. (Only the other day I couldn't get more than a dozen rooms to list). I've not changed my pc setup in anyway that should have had this effect and I've uninstalled both WinMX and MX Monitor and reinstalled both (twice!) - and I still have the same problem. Now is this just me or is anyone else experiencing problems?

PostPosted: Wed Oct 27, 2004 7:01 pm
by Unbiased_Opinion
I just fired up CrustyMX (a joke) with MXMoni and it worked fine. Done a search and too many results for eminem. :lol:

Downloading some track I already have fine as well.

If you are really desperate and haven't installed anything recently that's important try a system restore if you have XP or course.

PostPosted: Thu Oct 28, 2004 6:09 am
by Solomon
What version of MX is it? 3.31 works fine with Moni (usually) but it can cause problems with 3.53.

It might be a port issue, but I cant really see how Moni would affect the ports.

PostPosted: Thu Oct 28, 2004 7:07 am
by Ooble
Try the patch at

PostPosted: Thu Oct 28, 2004 7:32 am
by DaBlade
Simple solution: Use secondaty connection.
If that fails, then google for the following site:
MX Central.
Also, this is a site that specializes in chat problems:

PostPosted: Mon Nov 01, 2004 8:06 am
by Keyser_Soze
Thanks for assuming I'm a newbie. :?

I think I know what the problem is linked to but your answer --^ was of little help to me anyway. No worries though. ;)

Thanks for the tip Ooble. It doesn't help me with this but is useful to know for something else. Thanks.

PostPosted: Tue Nov 02, 2004 5:08 pm
by bincoder
There is nothing wrong with your WinMX, pc, and (most likely) not your isp either.

The WinMX network is being flooded by someone or something and it is difficult if not impossible to maintain a good primary or secondary connection.

Whatever is screwing up the network is also keeping some ppl's chat servers from functioning. Eg: The room opens, it shows in the roomlist, anyone on your local LAN can enter it w/o a problem, and nobody from the internet can enter.

If that happens to you, you will not be able to host a WinMX room using either WinMX or RoboMX. (and I suspect any others using the protocol)

Even using Robo as a private, unlisted room, nobody from outside your own local network will be able to enter.

From what I read though, this issue of p2p software being unable to get to their own network to get search results, room listings, etc. is not only effecting WinMX, but Bearshare, Emule, Bittorrent, Limewire and Gnutella too.

Funny thing is that in WinMX, if you do get a trade going, it will proceed normally without any loss in speed or stability.

I have tried changing ports, pc's (known to work with winmx before), and even forcing my isp ip number to change. None of that made any difference.

The ppl trying to enter the room usually see a 'socket error' and a very few get a 'timeout error'.

The isp's all seem to be saying that they are not blocking any new ports from the usual ones, and are not blocking the server sites or protocols used. Although they do admit that something is wrong somewhere (on the internet in general) but they don't know what.

Another symptom I read abt is that if you are on a primary connection, there will be large surges of SPM connections to your pc, which will just as suddenly disappear, as if half the users of WinMX have turned on their secondary at the same moment.

It is known that whatever is going on is NOT a trojan or virus, so reformating a pc won't help.

Nor is it likely that your isp or backbone server is doing blocks, that would violate free speech (blocking a chatroom) and no doubt result in zillions of dollars in lawsuits.

From what i've seen so far, in WinMX, there are huge numbers of search and other WPN requests being sent through the network. They have false ip numbers so that, if you try to trace the source, nothing is there and the software will try to send the data until it times out. That is effectively, blocking or degrading the real network traffic greatly.

Who or what is sending out all that fake traffic is unknown. Maybe the MPAA, RIAA, US gov, or just some hacker who has 'poisoned' the network with some add-on software. (but that would have no effect on other p2p software)

Anyway, something is widespread, very wrong, and growing in p2p.

We would all be better off to stop trying to make it work by making changes to WinMX or our pc's, and to start reading and searching the internet for similar strange things going on with other p2p software and among different isp's.

Whatever it is, it is a clear violation of free speech rights to block access to chatrooms and it would be very nice to see whoever is doing it prosecuted, and sued for billions of dollars.
No matter if it's the MPAA, RIAA, isp's, hackers or gov.

PostPosted: Tue Nov 02, 2004 6:18 pm
by DaBlade
First of all, AT&T is obviously behind this.
Second of all, the only thing that can put such pressure on the WPN is a poorly written shit-of-an-app called QuickMX. If..say 100000 people whould use it, it whould put such an undescribable pressure on the connected primaries that it whould be virtually impossible to do anything with them. Ergo: network collapse.
Boycott QuickMX!!! :evil:

PostPosted: Tue Nov 02, 2004 7:26 pm
by Dazzle
I dont have any of those other programs installed so the battle will commence on winmx for me.
I also have noticed this trend , it may have been made possible by the reverse engineering of the protocol used to conect to the wpns servers (another own goal).
Still I would like you all to help out on this one as we are still not sure who or what is flooding the network , KM has reported that the flooding consists of repeated requests for primary connection information, and I hope this proves to be their achilles heel : )
Could all those who know how, get a copy of the nushi protocol analyser and try to log as much info about connections of the type listed crossing their connection (you can only be of help if you are using the primary network), also the source code room are advising users who can ,to switch to primary connection to strengthen the network .
Get the nushi prog here .
and get protocol info from here
thanx in advance ppl :)

PostPosted: Wed Nov 03, 2004 12:24 pm
by -KM-
the attacks seem to be dieing down (but to bbe honest i am probably more confused by what the hell is happening than anyone else... lol) so many things that should be unrelated seem to have happened all at the same time in relation to p2p apps (and winmx seems to have had the most "issues")... someone is doing something in the p2p world, but as for doing anything about it... well, you cant (the idiots in TSC who have no idea how the winmx protocols even work have suggested everyone switch to primary... the truth is that will just cause more problems as the network is allready overloaded with primaries) but on the plus side things aren't too bad and aren't getting any worse, they even look like they might be getting better

PostPosted: Wed Nov 03, 2004 11:43 pm
by bincoder
Mine is still totally AFU.

I can't open a room, I can't get a refreshed room listing. (if I try to, the network conn drops and all I get is around 200 listings).

Also, today, another admin told me that his Shareaza program refuses to connect to its network. hmmm.. yet another p2p app going south. He said that its been that way for a week.

I am getting my downloads as usual at the normal speed, but search results still are crap, refreshing the connection (on secondary) takes forever.

Ima still think its the RIAA, MPAA or US Gov. despite the fact that its also happening outside the US. Since the RIAA and MPAA are so much more above the LAW than God himself is. (US constitution?? whats that?)

Even the Bush (yuck) administration (recently renewed, double yuck) (Ashcroft, major... eeewww!) seems to consider file sharing a far greater danger to the US than Al-Queda ever will be. lol

I have tried the packet sniffer for WinMX but it only is confusing me. -.-

I see many (asian?) connections, but it doesn't look like its a high speed flooding of the primary.
What I have noticed is in WinMX, looking at the bandwidth display on a primary, (no files being searched, no room open, no sharing or xfers) that when I first start WinMX, I get a large amount of traffic in WPN packets. After that is overwith, if I refresh the roomlist, it displays a much smaller (and short lived) peak in that traffic. When I get to around 200 or so rooms, the little purple peak of WPN packets comes to a stop.

Also noticed that in the display in the window 'bar' (showing number of P, S, and SPM's) that S always equals zero. (so nobody on earth is using any secondaries according to it) it stays that way as long as WinMX is running. Primaries grow and shrink at a normal rate (normally get 4 and after awhile it rises to 8 or 9), SPM's start low and rise to around 12,000 or so eventually (looks normal) but the secondary connections never happen.

My outgoing primary traffic, as displayed on the bandwith display,hangs out around 7k or so, rising and falling with reasonable peaks and valleys.

Incoming is also looking normal, but fixed at a max. value (don't know if that is normal or not) can be effected by changing WinMX settings but is still totally flat at whichever level its going at. I think it was around 8k or so. (tried faster, slower, and still cannot open a unblocked room)

Don't mean to babble but maybe you can glean something from the above information. :)

PostPosted: Thu Nov 04, 2004 12:12 am
by bincoder
Me again,

Wonder if this thread should be moved to general file sharing since its having widespread effects on software other than WinMX...

also... I'm trying to decide if I should switch from cable to Qwest DSL...
Anyone know if this p2p problem is less likely to happen on DSL?? So far, it seems to me that cable access is growing more unstable by the day, in spite of its much better speeds, cable companies luv to block ports and deny you permission to run any kind of server. And mine disconnects at least twice a day (something it never did for months at a time before they 'upgraded' it) while Qwest DSL doesn't care if you run a server or even if you are using the connection for a business, same price (cheap) :shock:

I don't want to go to DSL if its just going to have the same problems i'm getting now with WinMX, so what are your opinions on that? Is anyone with DSL having weird problems with p2p as well?

I ran a tracert to Google and found that Cox cable runs thru too many hops (of course) and that once getting thru all of the Cox addresses, it connects to Googles chain of addys. (there is no connection to anything involving AT&T from here to Google)
Phx, AridZona. :wink:

PostPosted: Thu Nov 04, 2004 5:52 pm
by -KM-
bincoder wrote:I ran a tracert to Google and found that Cox cable runs thru too many hops (of course) and that once getting thru all of the Cox addresses, it connects to Googles chain of addys. (there is no connection to anything involving AT&T from here to Google)

a tracert doesn't show everywhere the data is going, only the list of routers that responded to the packet sent, it could be caused by either the data being tunneled across part of the network or it could simply be routers set to not respond to the ICMP traffic... if a tracert where to be believed then you'd think pretty much every ISP in the world was connected to every other one :-)

as for why they would not be set to respond to the ICMP traffic, i dont know but i would assume that if they where to respond to every tracert everyone did then it would create q bit of bandwidth, admitedly only about 0.001% increase, but that could still work out to quite a few extra users they can squeeze on to the internet

PostPosted: Thu Nov 04, 2004 8:23 pm
by LANjackal
bincoder wrote:Also, today, another admin told me that his Shareaza program refuses to connect to its network. hmmm.. yet another p2p app going south. He said that its been that way for a week.

I use Shareaza and I've been experiencing similar issues. I've been unable to connect to the Gnutella network via the client for weeks. I've tried everything from port forwarding to reinstalling the software, but nothing works. My sofware firewall is set to allow the program full access to the internet, so I have no clue what's going on.

As for WinMX, I haven't noticed any performance issues. Everything seems to be normal on my end. I'm running version 3.53, by the way. In my experience WinMX's connections tend to be far more fickle than those of other clients. If I go an hour without a reconnection event, I'm usually happy.

I'll continue using the various clients and report any issues experienced.

Strange network behaviour.

PostPosted: Sun Nov 07, 2004 9:00 am
by passer
Regarding Bincoder's observation that something weird is going on - I have also noticed of late some strange patterns when connecting in. I usually connect as Primary, and my profile would settle down after connection to about 5/6 primaries and 6/9 secondaries. Lately however, the balance is often very uneven, such as 12 Primaries and 0 secondaries, or 3 primaries and 12 secondaries. If I connect as a secondary, it takes longer than it used to, and the connection is much less stable, sometimes only lasting a few minutes. On the bandwidth screen, I see occasional large purple spikes (not apparently related to searches) which take up my whole available incoming capacity (I'm a 512 DSL), last for about half a minute, and kill all my connections, and all ULs/DLs. I had assumed that this was some sort of ISP activity, but I'm catching conspiracy theoryitis now!
So, nothing much new here, but recently, my son did a search on the film Dodgeball, prior to its release, and called me in to check the results. He got 8000+ results returned. All but 5 of them were similarly false. All the users had 800 files in their list, and on browsing, all the files were movie-sized avi files, with aleged multiple copies of new films. Most interesting was that ALL the WinMx clients were hacked versions, showing "37 of 4 available" or "17 of 89 available" or similar nonsense. (If you care to check, they're all still there, but the search request I just put in produced an instantaneous response of 8700+ results, and killed all of my connectivity, with large purple spike, as described above. It recovered fine, but all current activity was lost). Now, I've seen a lot of this type of hack recently. They appear in my UL queue, they will respond to a WHOIS, but they never succeed in connecting. If you try to DL from them, you get "Connection Refused". What occurs to me is that if the media companies are setting up a seeding operation to thwart downloaders (and I saw a not dissimilar pattern of activity prior to the release of the last Avril Lavigne album, with seeded files which DL'ed OK but contained about 20 seconds of old audio and then faded down to 4 minutes of silence), presumably all on the same server and using the same pool of shared files, then they may be successfully clogging up the network by spoofing thousands of clients which then proceed to connect and disconnect (up and down like the proverbial whore's drawers), causing general disruption and mayhem. As designed. So perhaps that's what is causing the slowness and instability and so on.
Sorry if this is covered elsewhere, and for being so long-winded.

PostPosted: Sun Nov 07, 2004 1:08 pm
by Solomon
Its always been possible to lose your connection, as either primary or secondary, by searching for certain files. Do a video search for divx, for example, and your computer/WinMX will probably freeze up for a few seconds as WinMX tries to parse all the data. Looking at the Bandwidth window will show you a puce coloured blob, with very high bandwidth usage. This is completely normal.

What isnt normal is that someone, either a group of friends or more likely an "agency", is deliberately causing a problem. You have 2 choices - dont search for stuff that causes a problem, or limit the ammount of results, by being specific in your search terms, or choosing only T1 and T3 sources.

Re: Strange network behaviour.

PostPosted: Mon Nov 15, 2004 8:10 am
by Libertad
passer wrote:*** but I'm catching conspiracy theoryitis now!
So, nothing much new here, but recently, my son did a search on the film Dodgeball, prior to its release, and called me in to check the results. He got 8000+ results returned. All but 5 of them were similarly false. All the users had 800 files in their list, and on browsing, all the files were movie-sized avi files, with aleged multiple copies of new films.***


Thanks for that tip..

I did a little investigating and found that [some of] this crap [all fake users i tested] is coming from California. No surprise there I suppose.

Insofar as this is causing an overload, and is done for malicious reasons, IMHO it can legally be classified as a denial of service attack on the winmx network infrastructure.

PostPosted: Mon Nov 15, 2004 11:38 am
by sumfuka
I'm having similar problems here, too, but can hopefully shed a bit of light on what's going on...

Running a primary connection here, people/groups/whoever working for, I assume, the RIAA/MPAA appear to run some kind of third-party secondary clients (guesswork) that seek connections into any primary user that they find on the WPN. These companies hook into primary users as secondaries and commonly upload large lists of files that they're trying to protect, like Dodgeball, Star Wars, Eminem, etc. O.K, no problem with that as such (can't really blame them, IMO), but, the problem here is that when a secondary user who is connected to me initiates a search for one of these highly spammed files, the flood of UDP search results from the WPN back to me effectively annihilates my router, which goes into 'protect' mode, resulting briefly in a total loss of Internet connectivity (all P=x primary TCP links drop when this happens).

Given that these companies are seemingly connecting into, possibly, ANY and EVERY primary they come across on the network, to use as a fake spamming machine, the weight of all those primaries responding is just too much for the hardware to handle here. It's effectively a distributed denial of service attack as the UDP search results come in from thousands of machines. Though, maybe other hardware copes better in this regard, so, it might not be a problem for some people.

I don't know which companies are behind it all (who cares), but there's quite a few specific IP ranges that can be blocked if you don't particularly want be a host for fake spammers (it won't cure a DOS problem at all, though)...

209.11.134.* "globix" -- seems very big, and static ip, so easily blocked.

The following are not easy to block, probably pretty useless really as it appears they're using dynamic IP addresses within popular domestic ISP ranges. To block these to /24 would probably just end up blocking legitimate users, so, not recommended to block unless you're prepared to continually detect & update the IP addresses they're using as they change. pacbell pacbell pacbell
68.120.137.* pacbell pacbell demon covad covad covad covad blueyonder dcomms

Still, this list is probably only a very small fraction of the total number of systems they have running around the world...

Just FYI. :)

PostPosted: Sun Nov 21, 2004 2:05 am
by bincoder
While tracking the bw used by ip address in winmx running as primary, only a chatroom no file xfers or shares, I found two that were causing sky high outgoing bw consumption (75k :shock: ).
One traced to japan, I disconnected that ip and winmx went back to normal (8-10k).

A little while later same problem... this time it was from taiwan and same cure, disconnect it then firewall it.

After a little while another address will connect and eat outgoing bandwidth of your winmx.

This is either NOT the RIAA, MPAA, etc. (just ordinary hackers from the usual places) OR it is the RIAA, MPAA, etc. (outsourcing the job of shutting down p2p in order to avoid issues of legality, and do so cheaply).

IMHO :wink:

PostPosted: Sun Nov 21, 2004 11:36 am
by sumfuka
Heh, that just sounds like your links to other primaries, perfectly normal (they consume bandwidth processing search queries floating around the wpn).

PostPosted: Mon Nov 22, 2004 4:45 am
by bmh67wa
bincoder wrote:also... I'm trying to decide if I should switch from cable to Qwest DSL...

I'm on Qwest DSL (using a local ISP) and WinMX, along with SoulSeek, Filetopia, and BitSpirit. All work fine. I immediately connect to a Primary and get several Secondaries. Transfers and chat is fine too. I wish I had only 300 rooms to sift through instead of over 1000! It just may be an ISP issue. I sure hope that Qwest doesn't follow the others!

(knocking on wood)