-
KhunRoger
AskWoody Lounger -
KhunRoger
AskWoody Lounger“But I certainly wouldn’t use Skype or Teams – far, far too many technical problems.”
Glad that my “Computer group” in Phuket, Thailand and Vancouver, Canada is not the only one that had problems with Skype, but we’re all set now. We tried Google Hangouts, WhatsApp and Skype, but didn’t try Zoom as someone said it timed out after 40 minutes.
Thanks to the local lockdown, the group “meets” every Sunday at 10am, Thai time. The group’s name is “WoodysPhuket”. I forget why.
Nil illigitimi carborundum
1 user thanked author for this post.
-
KhunRoger
AskWoody LoungerIf that doesn’t happen in the next few weeks I think we can assume the Outlook Express Error 10065 problem was caused by Peerblock.
Of course, we still haven’t got to the bottom of the original POP server switch problem!
Stay tuned!
Just to keep you guys up to date…
Since August 12th, the original problem of the server at “pop3.live.com” failing and me having to use the “pop-mail.outlook.com” server has not reoccurred. This problem may have been solved by switching DNS service from Google’s (8.8.8.8) to my ISP’s (110.164.252.222) which I did on August 22nd.
Since September 22nd I’ve had no intermittent problems collecting mail from “pop3.live.com”. That is when I stopped running Peerblock while collecting the mail.
I’ll update this thread if anything reoccurs.
Thanks to all for help and advice given.
Nil illigitimi carborundum
1 user thanked author for this post.
-
KhunRoger
AskWoody LoungerICMP to your computer is a response from another computer, so the destination is correct – your firewall/router wouldn’t allow the packets through if they were not in response to one from your PC.
Nice bit of thinking on Peerblock, seems to be the fix.
cheers, Paul
Ah! I get it now – thanks for clearing up the source/destination confusion.
I’ve just gone through all 35 capture files that I have saved and determined that all those that have ICMP messages – 5 of them – relate to port 56789, so they are all problems with Vuze and not Outlook Express.
In one capture file there were 65 ICMP messages in a 50 second period, but all were about port 56789.
So I’ll keep getting mail without Peerblock or Vuze running, and capture it all with WireShark in hope of capturing another Error 10065 event.
If that doesn’t happen in the next few weeks I think we can assume the Outlook Express Error 10065 problem was caused by Peerblock.
Of course, we still haven’t got to the bottom of the original POP server switch problem!
Stay tuned!
Nil illigitimi carborundum
-
KhunRoger
AskWoody LoungerError 10065 seems to be a routing error – the client knows where to go but has no route information. The issue is probably on your PC rather than external.
Do you have any traffic monitoring / filtering software? Maybe your AV?cheers, Paul
Sorry for the late reply – I’ve been “playing” with WireShark and watching YouTube videos on how to use it.
But your post about Error 10065 got me thinking and I found this post about it, http://goo.gl/9kNYr7 , that suggests Peerblock was the culprit in that particular case.
I do run Peerblock with my torrent client, Vuze (formerly Azureus), and I also run “NetMeter” (http://goo.gl/pmkCi6) and NetWorx (http://goo.gl/CKMJ59) which monitor up/download speeds and traffic.I found this post that explains that the “Host unreachable” message is an ICMP message: http://goo.gl/3jbX7Z , so I filtered the September 17th capture file – where 2 Hotmail accesses failed – by specifying ICMP protocol.
But then it got confusing. All 5 ICMP events that were listed in the top window showed the destination as my computer (192.168.1.30) and 5 different sources. But in the User Datagram Protocol window at the bottom, the source is 56789, which is my Vuze torrent client port number, and just above that the source is listed as 192.168.1.30 which is my computer.
So the top window has the source and destination opposite to what the detailed analysis of the messages show further down. I don’t know if this is a bug in WireShark or I’m not interpreting the data correctly.
Maybe I’ll post about it on a WireShark forum.
So the bad news is, these ICMP “Host Unreachable” messages are all about my Vuze client and nothing to do with Outlook Express even though OE produced “Socket Error 10065” messages and failed to collect mail from two accounts.
But the good news is, no “Error 10065” messages from Outlook Express since I’ve been getting mail and capturing without Peerblock and Vuze running.
Also, the original problem of the servers switching hasn’t occurred since August 12th.
This must be the longest AskWoody thread ever.
Nil illigitimi carborundum
-
KhunRoger
AskWoody LoungerAt last I just captured a “normal” failure where the first two Hotmail accounts fail and the last two work OK:
So two Gmail accounts worked, then a Hotmail account failed, a Gmail worked, another Hotmail failed and then two Hotmails worked and finally a Yahoo worked.
Immediately afterwards, I repeated the “Send / Receive All” command, and they all worked OK.
I’ve been playing with Wireshark to try to spot any anomalies when there’s a failure, but all I’ve come up with so far is that when all the 8 accounts were accessed OK, there were 8 “Client Hello” messages:
When I apply the same filter to the earlier data captured when two of the Hotmails failed, I expected to see 6 “Client Hello” messages. But that’s way too logical:
So now I’m trying to find the beginning of the first Hotmail account failure (i.e. locate the end of the 9 emails received from the 2nd Gmail account) to determine where this Hotmail account went wrong. But knowing next to nothing about the protocol makes this quite a brain ache. In fact, I’ve had enough for today!
If you can suggest what I should try to find, please do.
Nil illigitimi carborundum
-
KhunRoger
AskWoody Lounger -
KhunRoger
AskWoody LoungerThis morning at 6 minutes past midnight I had a situation where Hotmail could not access any of the usual four accounts that it tries. I tried again 4 minutes later and they all worked.
Most of this was captured by Wireshark – only the failure of the very first account was missed as I hadn’t started Wireshark at that time. I think it’s called S*d’s Law that the one time I didn’t start capturing that a failure occurred.
But this failure was not like the usual failures where the first two accounts fail and the second two work OK. And then, usually, they all always work for the rest of the day.
Also, this failure is not like the original subject of this topic which was the Hotmail servers switching from pop3.live.com to pop-mail.outlook.com.
After filtering the displayed data using the usual “ip.addr == 40.100.0.0/16” filter, nothing was displayed. So my Outlook Express was not trying to communicate with the usual Hotmail server IPs.
[The capture I did afterwards, when all accounts were accessed successfully, showed many communications with 40.100.54.2, which is owned by Hong Kong Microsoft.]
In the “failure” capture, the messages that usually go to 40.100.xxx.xxx appear to go instead to 104.27.212.30, which is owned by Cloudflare SF.
Nil illigitimi carborundum
-
KhunRoger
AskWoody LoungerSetting a capture filter for the range 40.100.0.0 will only capture data to/from that range, then it’s display filtering for in depth analysis.
cheers, Paul
Yes, I understand how that works now! I found this help page very informative:
https://wiki.wireshark.org/DisplayFilters#Display_filter_is_not_a_capture_filterThe size of the “.pcapng” capture file is about 6 MB when I get mail from all four Hotmail accounts plus the Gmail and Yahoo accounts, so I don’t think I need to specify a capture filter to reduce its size. I deliberately stop all other Internet accesses, e.g. torrent clients and browsers, to reduce the amount of other traffic.
When I use a display filter of “ipaddr==40.100.0.0/16” I can see all the Hotmail server communications. Of course, they might change the IP address to 40.xxx, but it’s easy to spot their communications because it’s basically all that’s going on.
I’ll report back as soon as I capture a failure.
Nil illigitimi carborundum
-
KhunRoger
AskWoody LoungerThe capture file is the format to use because you can load it in WS and then add more filters.
We really need the session data from a failed connection. Can you set the connections to manual, fire up WS, then run one connect?cheers, Paul
Ah, OK, I think I get it. So the WireShark captures everything if there’s no Capture Filter, but what you see in the Capture window depends on the Display Filter(s) you apply.
So today I started WireShark capturing and did a manual “Get / Receive” mail from each of my four Hotmail accounts, one by one, hoping for a failure of one or both of the first two accounts as sometimes happens, but they all worked OK. So I’ll repeat that process until I capture a failure.
The IP address of Hotmail is now 40.100.29.210 today. Yesterday it was 40.100.29.34. I ran a “WhoIs” on the addresses and it appears that Microsoft owns every address from 40.74.0.0 to 40.125.127.255: https://rdpguard.com/free-whois.aspx?ip=40.100.29.210#
Thanks for your help with this and please let me know if there’s anything more I should be doing.
Nil illigitimi carborundum
-
KhunRoger
AskWoody LoungerWhat I have determined so far is that the IP address that my Outlook Address goes to to get my mail is 40.100.29.34. My local IP is 192.168.1.30.
I don’t know how to save the data as a plain text file, so I took a screen capture:
This data is from collecting mail from one Hotmail account. There was no mail.
So I guess I need to get the capture started, with the filter set to 40.100.29.34, every time I get all my emails and see if I can capture the failures.…
OK, I just did that, but no errors. It would be nice if I could reduce the size of the capture file and also if I could save it as a text file so that I can extract just the salient data.
The capture file from getting all my emails a few minutes ago is 1.2 MB. There were 21 emails, so a lot of communications. If you can suggest a way of reducing the size eg. by changing the filter, that would be helpful. I really want to convert it to text though. There must be a way – I’ll investigate more.
Nil illigitimi carborundum
-
KhunRoger
AskWoody LoungerIf you are willing to get into some serious “tech” you could load Wireshark and capture the data when you first connect and fail. Reading through that should show where the issue lies – I promise to help.
cheers, Paul
Wow – I had forgotten all about WireShark! I just spent half an hour trying to remember what I’d used it for years ago. Hooray for “Everything Search” and “Agent Ransack”!
So I used it around August 2010 to determine how a program on my PC was able to reset my ZyXel modem. I think it was a button on the web interface page of the modem. So, after hitting the button, I captured the data to the modem and found the command. Being a hoarder, I still have the image of data –
So I then found out how to send that command from a program I wrote in “Liberty Basic”. That program was a bit naughty in that it scoured some torrent sites for UK TV programs… but I guess we shouldn’t talk about that.
So when the Internet stopped working, my program would reset the modem:
The first thing I must do now is familiarise myself with WireShark again and capture some data.
I’m not sure what to look for in the captured data, but I guess the server name – pop3.live.com – would be a start and the responses to it.
I’ll let you know how I get on but if you can suggest anything else I’d appreciate it.
Thanks again for reminding me about WireShark!
Nil illigitimi carborundum
-
KhunRoger
AskWoody LoungerIf you are willing to get into some serious “tech” you could load Wireshark and capture the data when you first connect and fail. Reading through that should show where the issue lies – I promise to help.
cheers, Paul
I’ve tried 4 times to reply to your post and each time I get this:
I’ll break my reply into sections and see if I can identify the problem. It’s not as if there are any expletives in my response, although I’d really like to use a few right now!
——————————————————————————————–
Problem found:Apparently if you type “data” followed immediately be a colon you get that WordFence error.
You try it!
Now back to my original response…
Nil illigitimi carborundum
-
KhunRoger
AskWoody LoungerThey look like network errors to me. The trouble is working out where the issue lies.
Check your network card and router for bad packets that seem to happen about the same time as the errors.
Another machine with that Outlook client on it would eliminate the PC as the culprit.cheers, Paul
These errors – where initial access(es) to Hotmail accounts fail and then subsequently work – may well be due to network errors, but they are a fairly recent development (although in the past they may have happened, but very infrequently), and they are significantly different from the original problem I reported where I had to edit several Hotmail account properties to change servers in order to access my email.
So that original “server switch” problem hasn’t reoccurred since August 12th.
This new “initial access” problem is a curious irritation and requires only repeating the “Send / Receive Mail” command, which is no problem.
Having said all that, I would like to nail down where the problem is occurring, provided I don’t upset my system. With that in mind, I should say that the network hardware I use is part of my Gigabyte motherboard. I don’t have a network card in this PC or my other PC and laptops. Also, they run Windows 10 normally – I wouldn’t like to move my Outlook Express profile data to one of them even though they can also boot XP.
If you can say what utilities I should run or what logged data I can inspect – on the PC or in the router – to help identify where these errors may be occurring I would certainly like to try and report back.
FYI, yesterday there was another occurrence of the first two accounts failing and then everything working perfectly for the rest of the day.
Nil illigitimi carborundum
-
KhunRoger
AskWoody LoungerSince changing to my ISPs DNS service, I haven’t had to switch from the old pop3.live.com and smtp.live.com servers to the new pop-mail.outlook.com and smtp-mail.outlook.com servers.
(I hope tomorrow I don’t have to retract that.)
However, there have been what I have previously called “glitches”, where one or more Hotmail accounts cannot be immediately accessed but a minute later they work perfectly.
These events give me a gut feeling that the servers I am trying to reach have “gone to sleep” and it takes a few attempts to “wake them up” and access my email.
The accounts that fail are always the first one(s) that my Outlook Express tries to access. When the first two accounts fail, the remaining two work fine. Repeating the “Send / Receive All” command has always resulted in all accounts working OK.
Following are images from the 4 events where there were problems collecting mail. These images were generated by a macro that I wrote that takes a screenshot of the “Tasks” tab after mail has been successfully retrieved and also takes a screenshot of the “Errors” tab when there is a problem. So all 4 of these images contain a snapshot of both tabs.
Event 1. 2018/08/23: Here, one message could not be retrieved – according to the error message – and caused two errors. After getting all mail a second time there were no problems. I have no idea what the problem was or which message had the problem. This was an odd occurrence.
Event 2. 2018/08/28: This is the usual “glitch”. The first two accounts fail and the second two work. After repeating the “Send / Receive All” command, they all work without problems:
Event 3. 2018/09/04: Another example of the above:
Event 4. 2018/09/06: The third example of the above:
If anyone has another idea of what is causing this – apart from my “sleeping server” idea – I’d love to hear it!
Nil illigitimi carborundum
![]() |
Patch reliability is unclear, but widespread attacks make patching prudent. Go ahead and patch, but watch out for potential problems. |
SIGN IN | Not a member? | REGISTER | PLUS MEMBERSHIP |

Plus Membership
Donations from Plus members keep this site going. You can identify the people who support AskWoody by the Plus badge on their avatars.
AskWoody Plus members not only get access to all of the contents of this site -- including Susan Bradley's frequently updated Patch Watch listing -- they also receive weekly AskWoody Plus Newsletters (formerly Windows Secrets Newsletter) and AskWoody Plus Alerts, emails when there are important breaking developments.
Get Plus!
Welcome to our unique respite from the madness.
It's easy to post questions about Windows 11, Windows 10, Win8.1, Win7, Surface, Office, or browse through our Forums. Post anonymously or register for greater privileges. Keep it civil, please: Decorous Lounge rules strictly enforced. Questions? Contact Customer Support.
Search Newsletters
Search Forums
View the Forum
Search for Topics
Recent Topics
-
Red x next to folder on OneDrive iPadOS
by
dmt_3904
47 minutes ago -
Are manuals extinct?
by
Susan Bradley
2 hours, 40 minutes ago -
Canonical ditching Sudo for Rust Sudo -rs starting with Ubuntu
by
Alex5723
5 hours, 49 minutes ago -
Network Issue
by
Casey H
12 hours, 21 minutes ago -
Fedora Linux is now an official WSL distro
by
Alex5723
17 hours, 49 minutes ago -
May 2025 Office non-Security updates
by
PKCano
18 hours, 15 minutes ago -
Windows 10 filehistory including onedrive folder
by
Steve Bondy
20 hours, 10 minutes ago -
pages print on restart (Win 11 23H2)
by
cyraxote
19 hours, 26 minutes ago -
Windows 11 Insider Preview build 26200.5581 released to DEV
by
joep517
22 hours, 22 minutes ago -
Windows 11 Insider Preview build 26120.3950 (24H2) released to BETA
by
joep517
22 hours, 23 minutes ago -
Proton to drop prices after ruling against “Apple tax”
by
Cybertooth
1 day, 5 hours ago -
24H2 Installer – don’t see Option for non destructive install
by
JP
14 hours, 7 minutes ago -
Asking Again here (New User and Fast change only backups)
by
thymej
1 day, 17 hours ago -
How much I spent on the Mac mini
by
Will Fastie
16 hours, 31 minutes ago -
How to get rid of Copilot in Microsoft 365
by
Lance Whitney
11 hours, 41 minutes ago -
Spring cleanup — 2025
by
Deanna McElveen
1 day, 22 hours ago -
Setting up Windows 11
by
Susan Bradley
18 hours, 1 minute ago -
VLC Introduces Cutting-Edge AI Subtitling and Translation Capabilities
by
Alex5723
1 day, 18 hours ago -
Powershell version?
by
CWBillow
1 day, 19 hours ago -
SendTom Toys
by
CWBillow
6 hours, 10 minutes ago -
Add shortcut to taskbar?
by
CWBillow
1 day, 23 hours ago -
Sycophancy in GPT-4o: What happened
by
Alex5723
2 days, 15 hours ago -
How can I install Skype on Windows 7?
by
Help
2 days, 14 hours ago -
Logitech MK850 Keyboard issues
by
Rush2112
1 day, 21 hours ago -
We live in a simulation
by
Alex5723
3 days, 5 hours ago -
Netplwiz not working
by
RetiredGeek
2 days, 16 hours ago -
Windows 11 24H2 is broadly available
by
Alex5723
3 days, 18 hours ago -
Microsoft is killing Authenticator
by
Alex5723
20 hours, 1 minute ago -
Downloads folder location
by
CWBillow
4 days ago -
Remove a User from Login screen
by
CWBillow
2 days, 20 hours ago
Recent blog posts
Key Links
Want to Advertise in the free newsletter? How about a gift subscription in honor of a birthday? Send an email to sb@askwoody.com to ask how.
Mastodon profile for DefConPatch
Mastodon profile for AskWoody
Home • About • FAQ • Posts & Privacy • Forums • My Account
Register • Free Newsletter • Plus Membership • Gift Certificates • MS-DEFCON Alerts
Copyright ©2004-2025 by AskWoody Tech LLC. All Rights Reserved.