Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've just recently moved across town. Previously, I had Dynamic DNS set up so I could remotely connect to my desktop (primarily to use TightVNC over SSH). My ISP was Comcast and I'm in the Denver, Colorado area.

Currently, I'm still with Comcast and still in Denver. My router connects to the internet just fine and my Dynamic DNS record over at DynDNS did get updated with my router's current external IP address. So my router, DynDNS, and public DNS records all agree what my IP address is.

However, I can't actually connect to anything from the outside world. My trace route to Google looks something like:

Tracing route to []

  1 (this is the internal IP address of my router)
  2  *  *  *  Request timed out.

This is what the trace route looks like from an outside source to my DynDNS domain name:

traceroute to (

 1  illuminati-130                
 3  vermiculite               
 4  csm-ct-gw                 
 9  *  *  *                                         {Times Out}

It's not just PING that times out. When I try and initiate an ssh connection from the outside (which used to work), that times out as well. Again, all I did was turn everything else, move them to the new location, and turned them back on. No settings were changed with DynDNS, the router, Cygwin, etc.

Now my guess is, whatever is sitting just beyond my router (what the modem connects to) is gumming things up. Even though the routes aren't EXACTLY the same, that appears to be the spot that the trace route either stops or doesn't get a response. My question is, for Comcast networks (particularly in Denver), what would be the device that typically sits there? Could that be refusing all incoming connections? Is there anything I can do about it?

That device seems to not respond to PING but does forward it along when I'm going outwards. But it looks like it eats it when the request is coming in. It's hard to prove that from these logs but I'm assuming that's the case because my router used to accept connections from the outside and I haven't changed anything on it.

share|improve this question
up vote 2 down vote accepted

Pings from the internet are generally disabled by ISPs. Pings are ICMP messages, and therefore treated differently than regular traffic. The other possibility is that the pings are being blocked by your router, why not log into your router and look for a setting that says something about responding to pings/icmp packets.

There are several ports that Comcast blocks, as of last month they block 25, 68, 135-139, 445, 520, and 1080.

Let the Trace Route run until it is done, some routers won't respond which appears as a timeout, but the trace route is still running, and routers at the end may still respond.

share|improve this answer
I understand that pings/traceroute are different but I'm trying to use them to understand why I can't connect via ssh/TightVNC(these are being blocked along with ping, that's why I started troubleshooting). There is a genuine connection problem and what I posted is the limit of my network diagnostic skills. What would the next step be? – colithium May 31 '10 at 4:39
Ah, ok Is it possible that the IP address you used in port forwarding on your router is still correct? Maybe your computer's IP changed and it's redirecting traffic to the wrong local IP. I'd suggest running Wireshark to determine whether or not you are getting any packets coming through. – Nick May 31 '10 at 4:55
face palm I didn't even check that because I had a static IP address assigned. Totally forgot that that goes with the physical interface and I am using wireless at my new location because I haven't run a cable yet. Needless to say, everything is working. Just goes to show you that even someone who is aware of the dangers of relying on trace route can fall for it... – colithium May 31 '10 at 9:18

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.