ICS Web-browsing Problem: the Real Solution

    As it turns out, I was correct that there was a problem with the ICS functionality, which leaves one necessary piece of information not known by the ICS client computers. Microsoft Knowledge Base Article 319661 describes this problem occurring, where the root cause of the problem is a mis-matching of MTU (Maximum Transmission Unit) size, and servers that block ICMP messages for security reasons prevent Window XP from handling this.

    Specifically, the problem is a mis-match of the MTU for the Ethernet adapter on the client computer, and the MTU for the PPPoE used to access the Internet; where the default MTU for the Ethernet adapter is 1500, but the MTU used by PPPoE is at most 1492. (The Windows XP PPPoE driver uses a default MTU of 1480. And with Bell Sympatico as my ISP, I had set my PPPoE MTU to 1454.) While this smaller MTU, which is used by the access to the Internet, is what the client ICS systems know nothing about.

   Article 319661 also states that ICS provided by Windows XP SP1 (Service Pack 1) finally resolves this problem, by using a method called MSS clamping, to limit the effective MTU size to what is supported by the connection to the Internet. Thus Microsoft's recommended solution is to upgrade the system providing ICS to Windows XP SP1.

    Otherwise, the recommended solution-- when using a version of Windows prior to Windows XP SP1-- is to do some testing to determine the correct MTU value to use. Then on each client system, manually set the MTU for the Ethernet adapter using ICS to this determined value.

Testing to determine the MTU value

    From the command prompt (a DOS window) on the system directly connected to the Internet, type one of the following commands to find the Internet Gateway, which should be the other end of the PPPoE link:

• For Windows 98 and Me:   WINIPCFG
• For Windows 2000 or XP:   IPCONFIG

    In either case, the IP address for the Internet Gateway should be a decimal number of the format xxx.xxx.xxx.xxx

    Next, from a command prompt on a client computer, the following command will be used, with several different values for packet size, to determine the largest MTU size that works:

PING -f -l nnnn xxx.xxx.xxx.xxx

• -f  tells the command not to fragment the packet.
• -l nnnn  sets the size of packet, where nnnn corresponds to the value for MTU being tested.
• xxx.xxx.xxx.xxx  is the Gateway IP address, that was determined by the command typed in on the ICS server.

    I would suggest running the above command, with the following sequence of packet size values:

• 1500  -- which should result in either an error message about needing to fragment the packet, or 100% packet loss.
  • If this first PING command does not fail, then either an MTU mis-match is not the problem, or the IP address is not located at the other end of the PPPoE connection.
• 1420  -- which hopefully is low enough that the command will succeed with 0% packet loss.
• Increase the packet size by steps of 10, until the error message or 100% packet loss again occurs.
• Decrease the packet size by steps of 2, until the command again succeeds with 0% packet loss. This resulting value is the correct MTU for the client systems.

Setting the MTU on Client Systems

    Once the MTU value to use (or to try) has been established, then on every client system, the Ethernet adapter connected to the network using ICS must have the MTU set to that value. Several sites on the Internet provide instructions on how to edit the System Registry to do this. However, the simple answer is to just download the DrTCP program, then use that to set the MTU for the Ethernet adapter.