W2K DUN ICS website access issue

  • Thread starter Thread starter JeZ
  • Start date Start date
J

JeZ

I have minimal tech experience and am completely lost on
this problem

I set up a LAN with 2 PCs both running W2K and plugged
straight into each other

The Host is running ICS on DUN Internet access. The Client
was happy with this upto about 2 weeks ago when it started
refusing to access some sites (e.g. ebay,
friendsreunited). Others (google, support.microsoft.com)
are fine

The actual error is essentially "Cannot find Server or DNS
error"

I have tried the MS Technical Database but find the
articles I sourced too technical, contradictory or had the
right symptoms but the wrong causes !

support.microsoft.com/default.aspx?scid=kb;en-us;300202
support.microsoft.com/default.aspx?scid=kb;en-us;250603
support.microsoft.com/default.aspx?scid=kb;en-us;307311#6
support.microsoft.com/default.aspx?scid=kb;EN-US;237254
support.microsoft.com/default.aspx?scid=fh;EN-GB;win2000

Adaware & eTrust AntiVirus and Firewall seem happy

All help *very* much appreci8ed

JeZ
 
The Host is running ICS on DUN Internet access. The Client
was happy with this upto about 2 weeks ago when it started
refusing to access some sites (e.g. ebay,
friendsreunited). Others (google, support.microsoft.com)
are fine

The actual error is essentially "Cannot find Server or DNS
error"

What DNS server is the ICS machine set to use?

This is likely the KEY - maybe your ISP's DNS server
number had changed or is flaky?

Ping the site, what do you get?

Nslookup www.ebay.com (or whatever)

What do you see? (ignore any "reverse lookup errors" AT THE TOP.)
 
What DNS server is the ICS machine set to use?

Presumably the Host on the LAN ? Under Local Area
Network / Properties / Internet Protocol (TCP/IP) /
Properties the Client settings are to obtain IP & DNS
server addresses automatically . . but DNS Server isn't
installed on the Host under Add/Remove Programs /
Add/Remove Windows Components !??!
Ping the site, what do you get?

C:\>nslookup ebay.co.uk
*** Can't find server name for address 192.168.0.1: Non-
existent domain
*** Default servers are not available
Server: UnKnown
Address: 192.168.0.1

Non-authoritative answer:
Name: ebay.co.uk
Address: 66.135.192.41
 
In
JeZ said:
Presumably the Host on the LAN ? Under Local Area
Network / Properties / Internet Protocol (TCP/IP) /
Properties the Client settings are to obtain IP & DNS
server addresses automatically . . but DNS Server isn't
installed on the Host under Add/Remove Programs /
Add/Remove Windows Components !??!


C:\>nslookup ebay.co.uk
*** Can't find server name for address 192.168.0.1: Non-
existent domain
*** Default servers are not available
Server: UnKnown
Address: 192.168.0.1

Non-authoritative answer:
Name: ebay.co.uk
Address: 66.135.192.41

This maybe an MTU issue. Known issue when it comes to dialup/ADSL and
NAT/ICS.

Follow the instructions in this article to determine what your actual MTU
is. Default is 1500. ANything lower, it seems the browser can't handle it.

314825 - How to Troubleshoot Black Hole Router Issues [pings and
connectivity are questionable] MTU settings discussed here too.:
http://support.microsoft.com/?id=314825

HOW TO Change the PPPoE MTU Size in Windows XP (Q283165):
http://support.microsoft.com/?id=283165

MTU changes, orignally Q259783 but that was withdrawn. Here are the
instructions.:
http://gw.renner.bei.t-online.de/windowsxp/mtu.htm

--
Regards,
Ace

Please direct all replies to the newsgroup so all can benefit.

Ace Fekay, MCSE 2000, MCSE+I, MCSA, MCT, MVP
Microsoft Windows MVP - Active Directory
 
Please see A] thru' C] below

Please re-note that the Client PC can reach some websites
OK just not specific ones (e.g. ebay)

A] IPConfig /all from ICS (Gateway) PC

Windows 2000 IP Configuration

Host Name . . . . . . . . . . . . :
Primary DNS Suffix . . . . . . . :
Node Type . . . . . . . . . . . . : Broadcast
IP Routing Enabled. . . . . . . . : Yes
WINS Proxy Enabled. . . . . . . . : No

Ethernet adapter Local Area Connection:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : 3Com EtherLink
10/100 PCI TX NIC (3C
905B-TX)
Physical Address. . . . . . . . . : 00-50-04-35-8C-
23
DHCP Enabled. . . . . . . . . . . : No
IP Address. . . . . . . . . . . . : 192.168.0.1
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . :
DNS Servers . . . . . . . . . . . :

PPP adapter Tiscali:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : WAN (PPP/SLIP)
Interface
Physical Address. . . . . . . . . : 00-53-45-00-00-
00
DHCP Enabled. . . . . . . . . . . : No
IP Address. . . . . . . . . . . . : 80.225.12.196
Subnet Mask . . . . . . . . . . . : 255.255.255.255
Default Gateway . . . . . . . . . : 80.225.12.196
DNS Servers . . . . . . . . . . . : 212.74.112.66
212.74.112.67
NetBIOS over Tcpip. . . . . . . . : Disabled

The ICS machine then must hav its CLIENT DNS properties
set to a reliable DNS server

For the ICS (Gateway) PC DUN Connection the DNS server is
set to be automatically found *BUT* for the Local Area
Conection there is no DNS server set to correspond with
the fixed IP address of 192.168.0.1


B] IPConfig /all from Client PC

Host Name . . . . . . . . . . . . :
Primary DNS Suffix . . . . . . . :
Node Type . . . . . . . . . . . . : Mixed
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No

Ethernet adapter Local Area Connection:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Intel(R)
PRO/100+ Management Adapter
Physical Address. . . . . . . . . : 00-90-27-59-81-
D4
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
IP Address. . . . . . . . . . . . : 192.168.0.2
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.0.1
DHCP Server . . . . . . . . . . . : 192.168.0.1
DNS Servers . . . . . . . . . . . : 192.168.0.1
Lease Obtained. . . . . . . . . . : 01 July 2003
20:43:13
Lease Expires . . . . . . . . . . : 08 July 2003
20:43:13


C]>This maybe an MTU issue. Known issue when it comes to
dialup/ADSL and NAT/ICS.

I understand this to a point but hope the following data
will be more of an insight for you ? :)

n.b. Although ebay gives "Request timed out" for 0b of
data on both PCs, the ICS (Gateway) PC can still reach it
via the browser

ICS (Gateway) PC
================
ping -f -l 1472 192.168.0.1
Pinging 192.168.0.1 with 1472 bytes of data:
Reply from 192.168.0.1: bytes=1472 time<10ms TTL=128

ping -f -l 0 www.ebay.co.uk
Pinging www.ebay.co.uk [66.135.192.41] with 0 bytes of
data:
Request timed out.

ping -f -l 1472 www.google.co.uk
Pinging www.google.com [216.239.37.99] with 1472 bytes of
data:
Reply from 216.239.37.99: bytes=1472 time=370ms TTL=55

Client PC
=========
ping -f -l 548 192.168.0.1
Pinging 192.168.0.1 with 548 bytes of data:
Reply from 192.168.0.1: bytes=548 time<10ms TTL=128

ping -f -l 0 ebay.co.uk
Pinging ebay.co.uk [66.135.192.41] with 0 bytes of data:
Request timed out.

ping -f -l 1472 www.google.co.uk
Pinging www.google.com [216.239.39.99] with 1472 bytes of
data:
Reply from 216.239.39.99: bytes=1472 time=440ms TTL=55

Much obliged for the continued help

JeZ
 
For the ICS (Gateway) PC DUN Connection the DNS server is
set to be automatically found *BUT* for the Local Area
Conection there is no DNS server set to correspond with
the fixed IP address of 192.168.0.1

Good -- in this situation we do not want the machine set to
anything internal (you don't have a "real" DNS server on the
inside.
DNS Servers . . . . . . . . . . . : 212.74.112.66
212.74.112.67

Try:
nslookup www.ebay. com 212.74.112.66
AND
nslookup www.ebay. com 212.74.112.67

Do both give good (and the same) results? Do this from both
the ICS and the other client. Same results?
 
ICS (Gateway) PC
================
C:\>nslookup www.ebay.com 212.74.112.66

Server: mk-cache-1.ns.uk.tiscali.com
Address: 212.74.112.66
Non-authoritative answer:
Name: pages.ebay.com
Addresses: 66.135.192.87, 66.135.192.88, 66.135.208.87,
66.135.208.88
Aliases: www.ebay.com

C:\>nslookup www.ebay.com 212.74.112.67

Server: mk-cache-2.ns.uk.tiscali.com
Address: 212.74.112.67
Non-authoritative answer:
Name: pages.ebay.com
Addresses: 66.135.192.88, 66.135.208.87, 66.135.208.88,
66.135.192.87
Aliases: www.ebay.com

Client PC
=========
C:\>nslookup www.ebay.com 212.74.112.66

Server: mk-cache-1.ns.uk.tiscali.com
Address: 212.74.112.66
Non-authoritative answer:
Name: pages.ebay.com
Addresses: 66.135.192.88, 66.135.208.87, 66.135.208.88,
66.135.192.87
Aliases: www.ebay.com

C:\>nslookup www.ebay.com 212.74.112.67

Server: mk-cache-2.ns.uk.tiscali.com
Address: 212.74.112.67
Non-authoritative answer:
Name: pages.ebay.com
Addresses: 66.135.208.88, 66.135.192.87, 66.135.192.88,
66.135.208.87
Aliases: www.ebay.com
 
In
JeZ said:
Please see A] thru' C] below

Please re-note that the Client PC can reach some websites
OK just not specific ones (e.g. ebay)

A] IPConfig /all from ICS (Gateway) PC

Windows 2000 IP Configuration

Host Name . . . . . . . . . . . . :
Primary DNS Suffix . . . . . . . :
Node Type . . . . . . . . . . . . : Broadcast
IP Routing Enabled. . . . . . . . : Yes
WINS Proxy Enabled. . . . . . . . : No

Ethernet adapter Local Area Connection:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : 3Com EtherLink
10/100 PCI TX NIC (3C
905B-TX)
Physical Address. . . . . . . . . : 00-50-04-35-8C-
23
DHCP Enabled. . . . . . . . . . . : No
IP Address. . . . . . . . . . . . : 192.168.0.1
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . :
DNS Servers . . . . . . . . . . . :

PPP adapter Tiscali:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : WAN (PPP/SLIP)
Interface
Physical Address. . . . . . . . . : 00-53-45-00-00-
00
DHCP Enabled. . . . . . . . . . . : No
IP Address. . . . . . . . . . . . : 80.225.12.196
Subnet Mask . . . . . . . . . . . : 255.255.255.255
Default Gateway . . . . . . . . . : 80.225.12.196
DNS Servers . . . . . . . . . . . : 212.74.112.66
212.74.112.67
NetBIOS over Tcpip. . . . . . . . : Disabled

The ICS machine then must hav its CLIENT DNS properties
set to a reliable DNS server

For the ICS (Gateway) PC DUN Connection the DNS server is
set to be automatically found *BUT* for the Local Area
Conection there is no DNS server set to correspond with
the fixed IP address of 192.168.0.1


B] IPConfig /all from Client PC

Host Name . . . . . . . . . . . . :
Primary DNS Suffix . . . . . . . :
Node Type . . . . . . . . . . . . : Mixed
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No

Ethernet adapter Local Area Connection:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Intel(R)
PRO/100+ Management Adapter
Physical Address. . . . . . . . . : 00-90-27-59-81-
D4
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
IP Address. . . . . . . . . . . . : 192.168.0.2
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.0.1
DHCP Server . . . . . . . . . . . : 192.168.0.1
DNS Servers . . . . . . . . . . . : 192.168.0.1
Lease Obtained. . . . . . . . . . : 01 July 2003
20:43:13
Lease Expires . . . . . . . . . . : 08 July 2003
20:43:13


C]>This maybe an MTU issue. Known issue when it comes to
dialup/ADSL and NAT/ICS.

I understand this to a point but hope the following data
will be more of an insight for you ? :)

n.b. Although ebay gives "Request timed out" for 0b of
data on both PCs, the ICS (Gateway) PC can still reach it
via the browser

ICS (Gateway) PC
================
ping -f -l 1472 192.168.0.1
Pinging 192.168.0.1 with 1472 bytes of data:
Reply from 192.168.0.1: bytes=1472 time<10ms TTL=128

ping -f -l 0 www.ebay.co.uk
Pinging www.ebay.co.uk [66.135.192.41] with 0 bytes of
data:
Request timed out.

ping -f -l 1472 www.google.co.uk
Pinging www.google.com [216.239.37.99] with 1472 bytes of
data:
Reply from 216.239.37.99: bytes=1472 time=370ms TTL=55

Client PC
=========
ping -f -l 548 192.168.0.1
Pinging 192.168.0.1 with 548 bytes of data:
Reply from 192.168.0.1: bytes=548 time<10ms TTL=128

ping -f -l 0 ebay.co.uk
Pinging ebay.co.uk [66.135.192.41] with 0 bytes of data:
Request timed out.

ping -f -l 1472 www.google.co.uk
Pinging www.google.com [216.239.39.99] with 1472 bytes of
data:
Reply from 216.239.39.99: bytes=1472 time=440ms TTL=55

Much obliged for the continued help

JeZ

Well, I get a timeout too with ebay, since they have ICMP blocked. That is
normal with many sites. Ping uses ICMP. ICMP is an intrusive protocol since
it ferrets out hosts and gives up what's active on your network. I have it
blocked myself too.

I think Herb maybe on to something with the routing issue, but then MTU is
related to "routing" since a NAT/ICS device does exactly that with an IP
translation. But if you like, try to drop the MTU (on the client) to 1472,
and see if it helps, if not, drop it to 1460 and see what happens. As I
said, I've seen this issue a few times in relation to ICS with dialup/ADSL.


--
Regards,
Ace

Please direct all replies to the newsgroup so all can benefit.

Ace Fekay, MCSE 2000, MCSE+I, MCSA, MCT, MVP
Microsoft Windows MVP - Active Directory
 
You can use telnet ADDRESSorNAME 80 to visit web sites:

Type then: GET / HTTP/1.0 (enter enter)

Even a failure response from the GET is ok because it tells you
that the HTPP server was talking to you.


Ace Fekay said:
In JeZ <[email protected]> posted his concerns then I replied
down below:
Please see A] thru' C] below

Please re-note that the Client PC can reach some websites
OK just not specific ones (e.g. ebay)

A] IPConfig /all from ICS (Gateway) PC

Windows 2000 IP Configuration

Host Name . . . . . . . . . . . . :
Primary DNS Suffix . . . . . . . :
Node Type . . . . . . . . . . . . : Broadcast
IP Routing Enabled. . . . . . . . : Yes
WINS Proxy Enabled. . . . . . . . : No

Ethernet adapter Local Area Connection:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : 3Com EtherLink
10/100 PCI TX NIC (3C
905B-TX)
Physical Address. . . . . . . . . : 00-50-04-35-8C-
23
DHCP Enabled. . . . . . . . . . . : No
IP Address. . . . . . . . . . . . : 192.168.0.1
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . :
DNS Servers . . . . . . . . . . . :

PPP adapter Tiscali:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : WAN (PPP/SLIP)
Interface
Physical Address. . . . . . . . . : 00-53-45-00-00-
00
DHCP Enabled. . . . . . . . . . . : No
IP Address. . . . . . . . . . . . : 80.225.12.196
Subnet Mask . . . . . . . . . . . : 255.255.255.255
Default Gateway . . . . . . . . . : 80.225.12.196
DNS Servers . . . . . . . . . . . : 212.74.112.66
212.74.112.67
NetBIOS over Tcpip. . . . . . . . : Disabled

The ICS machine then must hav its CLIENT DNS properties
set to a reliable DNS server

For the ICS (Gateway) PC DUN Connection the DNS server is
set to be automatically found *BUT* for the Local Area
Conection there is no DNS server set to correspond with
the fixed IP address of 192.168.0.1


B] IPConfig /all from Client PC

Host Name . . . . . . . . . . . . :
Primary DNS Suffix . . . . . . . :
Node Type . . . . . . . . . . . . : Mixed
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No

Ethernet adapter Local Area Connection:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Intel(R)
PRO/100+ Management Adapter
Physical Address. . . . . . . . . : 00-90-27-59-81-
D4
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
IP Address. . . . . . . . . . . . : 192.168.0.2
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.0.1
DHCP Server . . . . . . . . . . . : 192.168.0.1
DNS Servers . . . . . . . . . . . : 192.168.0.1
Lease Obtained. . . . . . . . . . : 01 July 2003
20:43:13
Lease Expires . . . . . . . . . . : 08 July 2003
20:43:13


C]>This maybe an MTU issue. Known issue when it comes to
dialup/ADSL and NAT/ICS.

I understand this to a point but hope the following data
will be more of an insight for you ? :)

n.b. Although ebay gives "Request timed out" for 0b of
data on both PCs, the ICS (Gateway) PC can still reach it
via the browser

ICS (Gateway) PC
================
ping -f -l 1472 192.168.0.1
Pinging 192.168.0.1 with 1472 bytes of data:
Reply from 192.168.0.1: bytes=1472 time<10ms TTL=128

ping -f -l 0 www.ebay.co.uk
Pinging www.ebay.co.uk [66.135.192.41] with 0 bytes of
data:
Request timed out.

ping -f -l 1472 www.google.co.uk
Pinging www.google.com [216.239.37.99] with 1472 bytes of
data:
Reply from 216.239.37.99: bytes=1472 time=370ms TTL=55

Client PC
=========
ping -f -l 548 192.168.0.1
Pinging 192.168.0.1 with 548 bytes of data:
Reply from 192.168.0.1: bytes=548 time<10ms TTL=128

ping -f -l 0 ebay.co.uk
Pinging ebay.co.uk [66.135.192.41] with 0 bytes of data:
Request timed out.

ping -f -l 1472 www.google.co.uk
Pinging www.google.com [216.239.39.99] with 1472 bytes of
data:
Reply from 216.239.39.99: bytes=1472 time=440ms TTL=55

Much obliged for the continued help

JeZ

Well, I get a timeout too with ebay, since they have ICMP blocked. That is
normal with many sites. Ping uses ICMP. ICMP is an intrusive protocol since
it ferrets out hosts and gives up what's active on your network. I have it
blocked myself too.

I think Herb maybe on to something with the routing issue, but then MTU is
related to "routing" since a NAT/ICS device does exactly that with an IP
translation. But if you like, try to drop the MTU (on the client) to 1472,
and see if it helps, if not, drop it to 1460 and see what happens. As I
said, I've seen this issue a few times in relation to ICS with dialup/ADSL.


--
Regards,
Ace

Please direct all replies to the newsgroup so all can benefit.

Ace Fekay, MCSE 2000, MCSE+I, MCSA, MCT, MVP
Microsoft Windows MVP - Active Directory
 
ISSUE 001
=========
try to drop the MTU (on the client) to 1472

Easy to say but not so easy to do !

What I believe is the relevant article for W2K
[http://support.microsoft.com/?id=120642] talks about (a)
EnablePMTUBHDetect (b) EnablePMTUDiscovery & (c) MTU - in
that order

(b) set to 1 seemed ideal but didn't appear to work

I would *really* appreci8 an ABC-easy-as-123 guide to (c)
please :) i.e how do I -

1/ find out the "ID for Adapter" as in "Key:
Tcpip\Parameters\Interfaces\ID for Adapter" ? I am
assuming that as it is in italics I need to replace that
text with a value ?

2/ enter the "Valid Range: 68 - the MTU of the underlying
network" ? Do I literally put "68-1472" in the "Value
data:" box ?

ISSUE 002
=========
You can use telnet ADDRESSorNAME 80 to visit web sites:

Type then: GET / HTTP/1.0 (enter enter)

I would *really* appreci8 an ABC-easy-as-123 guide to this
too please :)

If I do cmd/telnet www.ebay.co.uk 80 I get a connection
but a blank screen

Then typing GET <ENTER> results in

HTTP/1.1 400 Bad Request
Server: Microsoft-IIS/4.0
Date: Thu, 03 Jul 2003 21:31:57 GMT
Content-Type: text/html
Content-Length: 87

<html><head><title>Error</title></head><body>The parameter
is incorrect. </body></html>

Connection to host lost.

I don't understand how telnet links to the browser for
visiting the webiste !

CheerZ

JeZ
 
In
JeZ said:
ISSUE 001
=========
try to drop the MTU (on the client) to 1472

Easy to say but not so easy to do !

What I believe is the relevant article for W2K
[http://support.microsoft.com/?id=120642] talks about (a)
EnablePMTUBHDetect (b) EnablePMTUDiscovery & (c) MTU - in
that order

(b) set to 1 seemed ideal but didn't appear to work

I would *really* appreci8 an ABC-easy-as-123 guide to (c)
please :) i.e how do I -

1/ find out the "ID for Adapter" as in "Key:
Tcpip\Parameters\Interfaces\ID for Adapter" ? I am
assuming that as it is in italics I need to replace that
text with a value ?

2/ enter the "Valid Range: 68 - the MTU of the underlying
network" ? Do I literally put "68-1472" in the "Value
data:" box ?

ISSUE 002
=========
You can use telnet ADDRESSorNAME 80 to visit web sites:

Type then: GET / HTTP/1.0 (enter enter)

I would *really* appreci8 an ABC-easy-as-123 guide to this
too please :)

If I do cmd/telnet www.ebay.co.uk 80 I get a connection
but a blank screen

Then typing GET <ENTER> results in

HTTP/1.1 400 Bad Request
Server: Microsoft-IIS/4.0
Date: Thu, 03 Jul 2003 21:31:57 GMT
Content-Type: text/html
Content-Length: 87

<html><head><title>Error</title></head><body>The parameter
is incorrect. </body></html>

Connection to host lost.

I don't understand how telnet links to the browser for
visiting the webiste !

CheerZ

JeZ

Issue 001:
Follow the article I previously posted, not the one you were looking at:
http://support.microsoft.com/?id=314825

Issue 002:
As long as you can connect, the connection was established. I get the same
thing when I tried what you did. I usually just use that to see if a machine
responds on 80. The browser preforms more than just that to retieve a page.


--
Regards,
Ace

Please direct all replies to the newsgroup so all can benefit.

Ace Fekay, MCSE 2000, MCSE+I, MCSA, MCT, MVP
Microsoft Windows MVP - Active Directory
 
Issue 001:
Follow the article I previously posted, not the one you were looking at:
http://support.microsoft.com/?id=314825

But this is for XP not W2K !

However, it does give more info cheers - why are these KB
articles all over the place ?

I presume you suggest I try Method 1 then 3 ?

Issue 002:
As long as you can connect, the connection was established. I get the same
thing when I tried what you did. I usually just use that to see if a machine
responds on 80. The browser preforms more than just that
to retieve a page.

OK. I didn't realise you were saying use this to check the
connection can be established, I thought it was a
different way of actually viewing the pages DOH!

JeZ
 
Back
Top