Topic Options
#3552 - 01/12/20 08:55 PM "No package loss but no intenet" question... Please can someone help me to make sense out of this?
Maya Offline


Registered: 01/12/20
Posts: 2
Hi,
I don't have huge knowledge about this so hopefully Im not missing something quite obvious here..

I have been having prolonged but very hard to prove issues with internet for the past year and half (well ever since we moved here). The issue is that some of the days (sometimes 5 out of the week, sometimes only 1 out of fortnight) I lose internet connection after midnight for some time... generally it's about an hour but I can't say it's always like this. What is really odd about it is, that the router is still saying I have connection (all lights are green) yet nothing connected to internet works... no tv, mobile phone, laptop, nothing... ISP always say they cannot see any interruption in connection and I cannot prove any issues..

I have been looking for some monitoring tool for ages, even tried to write my own script to log for me the times when connection fails but then I came across PingPlotter ...

I have monitoring set up and it has been running well and here and there showing some crazy graphs but in general there had been no outages (apart from when we had short power failure at which point it was inevitable of course..)

However tonight I managed to finally capture the network behaviour during one of these outages.... at around 00:04 my internet stopped working on my phone so I went to check what is PingPlotter showing and I was surprised to see that there were currently only 4 hops (when usually I had around 10) and was really quite surprised that although I really had no internet, the plotter was still all in green and seemingly happy with everything.. This situation was happening for an hour and thdn at 1:04 the internet came back...

The odd and 'invisible' outage had precisely coincided with when the target name www.google.com changed from 216.58.206.132 to 62.24.138.17 and then spot on hour later it changed again from 62.24.138.17 to 216.58.206.132 . At this point the number of hops gone back to normal 10ish and internet was fine again...

Would you have ANY idea what is going on? Why does PingPlotter still have information making it believe I have internet pouring in when in fact I have none? Why are there only 4 hops? Any suggestions on what can I do about it?

I have attached the monitoring file from last few days which in the last just over an hour is showing the change of IP address and number of hops but is not showing internet outage and also some screenshots just to show what our connectivity was like at the time of the outage and shortly afterwards.

Any help will be much appreciated
Thank you x


Attachments
www.google.com ending 13.01. 1am.pp2 (138 downloads)
Outage1.JPG (45 downloads)
Outage2.jpg (44 downloads)
Outage3.jpg (48 downloads)



Edited by Maya (01/13/20 05:48 PM)

Top
#3554 - 01/13/20 05:50 PM Re: No package loss but no intenet question... [Re: Maya]
Hayla Offline
Pingman Staff


Registered: 10/16/17
Posts: 90
Hey Maya!

Thanks for getting in touch. I would like to offer some validation here - this is WEIRD. I have done a lot of networking over the years and this one is pretty interesting to me - that is to say, you are not missing anything!

So I took a look through everything, and I do see quite a few occurrences within your .pp2 file of a service interruption. However - I don't believe it's to your ISP's fault. At least not the specific pattern of red and high latency that I've included. I'm not sure about everything else yet.

If you take a look at the attached (hopefully) pictures, I grabbed some screenshots that stuck out to me and could give us a breadcrumb to follow. There seemed to be only one "chunk" of time where this issue happened, but it happened quite a few times. The pattern that you see in the attached screenshots looks kind of like stairs, right? And they all look like the exact same pattern. This pattern is originating from "inside the house" - hop 1 is your router, and the problems are showing up from the get-go. This could also explain why the ISP didn't see an interruption - because if the issue is localized to within your four walls, but the ISP is still doing fine, it most likely won't show them any issues.

Usually 1 of 3 things is happening when we see this type of pattern:

1. Bandwidth is saturated, which is the most likely in my opinion (and is the most common I've seen). This would mean that your network has too much traffic for your router to handle. Now, you might be saying "Hey! But I wasn't even downloading anything!" - and that's valid. However, I have seen several occurrences where these outages happen every night at the same time, and patterns look like bandwidth saturation - and it's because stuff is downloading updates! A lot of devices want to download updates at the same time every day, and a lot of those updates are pretty big. It could even be the router itself updating (which seems like a likely one to me).

2. The router has bad hardware. I see this happen a lot, but it's not really all that common in this specific pattern, at those specific times. It's usually more sporadic - we could see a *similar* pattern, and we would see the "no internet" symbol on your computer - but I don't know if I would place my bets on this. Still a possibility.

3. The router could have some form of rate-limiting enabled. Check your router and see if you can find anything that leads you to believe it's throttling anything.

My first recommendation would be to check the logs on the router. Since it seems that we caught an instance of the router misbehaving, it seems like we can probably start with your router (this is also the easiest place to start, and PingPlotter gave me a reason to scrutinize it for a bit). Check the logs (and if you're having a hard time finding them, send me a picture of your router or a model number or something and I can probably steer you to the right spot). I'd be curious to see if there's anything interesting in the logs.

My second recommendation is to run Windows Network Diagnostics on your computer. It should be built-in (and it might be called network troubleshooting) but it could also help you explain why you have no connectivity but yet PingPlotter is still going through. For example, there could be a DNS problem, and Windows might be able to catch something like that. Regardless, if PingPlotter data is getting through just fine, that means there's definitely some form of connection. Windows Network Diagnostics could potentially help you figure out why exactly ICMP (our) packets are going through, but nothing else is. You could also run Wireshark while there's an outage and while you're trying to surf the web and send me the results (let me know if you want to do that and I can help you get set up - this is just getting a little long so I'm omitting that for simplicity).

Third recommendation, if none of that helped, is to take this to your ISP and show them that the route changed, and right when that happened, you lost service. The screenshots you sent me were very helpful. I don't have insight into why there's a different route there because I'm not an ISP. However, your ISP should be able to look into this routing and figure out if there's any trend. With this, we have to remember that the IP and the route in your trace to *Google* changed while there was an outage - and that doesn't dictate what all the other traffic is doing, but could be a breadcrumb you send to your ISP. It also may be helpful to run a few of these traces side-by-side - for example, you could trace to Google, Netflix, and pingplotter.com for example. The more diverse data you can give your ISP, the better - and try to see if you can notice any patterns like that route change. The issue could potentially *not* be with the router, despite what we saw in those screenshots (since you've had outages when PingPlotter said it was A-OK). Never say never.

My fourth and last recommendation is, well, to try a new router. I understand we all don't have money to burn on routers (I sure don't), and that's usually the first thing people have you do, but it definitely would be a great spot to start in nailing down what this issue is just based on the fact that I saw some issues to begin with, and I ran with that.

I hope this helps you - and let me know if you have any questions!


Attachments
Screen Shot 2020-01-13 at 3.24.34 PM.png (38 downloads)
Screen Shot 2020-01-13 at 3.24.20 PM.png (73 downloads)

_________________________
Regards,
Hayla

Top
#3555 - 01/13/20 08:23 PM Re: No package loss but no intenet question... [Re: Hayla]
Maya Offline


Registered: 01/12/20
Posts: 2
Hello Hayla,

thanks for your reply, awesome amount of info there smile

So trying to make it down the list of your recommendations.. Sadly I'm having issues logging into my admin user on my router which means I probably don't have a way of accessing the logs from the outage. I have thought about factory reset but would then have to way for another outage to gather data about it..

The router in question is actually the second one and the issues are virtually identical - ISP was keen to be helpful and agreed to swap the router for newer one but this has not resolved the problem.

The network diagnostic is currently showing fine, obviously would need to try that during the outage.

also I'm a bit confused at what time are you seeing that steps like behaviour as when I see it on my end, it's around 2-3pm, but yours seems to have diffrent times .. could it be because I'm in UK??

Also, would the step like issues be any linked to the lack of internet during that last hour of the report? In the afternoon when the red lines and step like graph were occurring there is a high chance that TV was on as well as up to 3 kindles, 3 mobile phones, laptop, raspberry pi and Alexa... so I wouldn't be surprised if there was some overload issue at that time... but the hour of no internet was happening right after midnight, when it was just one laptop and non-active mobile... I also get the updates, but for the whole hour?

And what is your opinion on the sudden small number of hops and how can it be that PingPlotter is still showing green yet obviously from my wifi setting there internet has stalled?

Also, I have wireshark but after install I read that it's not meant to be used for network availability issues so I started using pingplotter instead... so I don't know how to use wireshark at all... so if it was any help I could try it but please let me know what to do...

thanks for all the help so far
Maya

Top
#3558 - 01/14/20 04:11 PM Re: No package loss but no intenet question... [Re: Maya]
Hayla Offline
Pingman Staff


Registered: 10/16/17
Posts: 90
Hey Maya,

I definitely understand - this is a weird one and I l haven't seen a weird one like this in a while!

If the ISP has swapped the router before, you can probably contact them for the login information for the router. Either that, or you may be able to Google the default login for your router (if you haven't done so) and see if that works (I notice ISPs tend to leave the login at the default).

Regarding seeing different times, yes - it's because I'm in Idaho, USA - and that time will show up to be whatever the local time converts to.

The step like issues definitely *could* be linked. The strange thing to me is that we saw those step-like issues (which I can confirm would cause some serious connectivity problems) in one instance. For the other instances of your outages, it seemed like the only thing weird was that the route had changed to show a small number of hops for one trace. THAT is the head-scratcher here.

Regarding the hops switching, I have to say that I think it's interesting, but I don't have a lot of insight into what that would mean for you. Your ISP would have a better idea - so you might want to tell them what you told me (that the outage happened exactly when the route changed drastically, and that pings are still going through but nothing else is). If PingPlotter is showing green, but your computer says "no Internet connection" - that means that pings are working, but the rest of the traffic isn't (and it would make sense why your ISP said they couldn't see an outage in this case). This is why I'm interested in seeing what Wireshark has to say.

To use Wireshark, just open it up (but do this while you notice the outage, preferably during a time when your computer says there's no internet but PingPlotter is working). You'll be looking at a screen that has a search-like bar, and it probably has a list of a few different network adapters beneath it with some squiggly lines next to it. If you see an adapter named "ethernet" or "wifi" and it has some squiggles next to it, double-click it. If there's only one in the list, or only one thing with squiggles, click that one. Then, this will open up something that just captures your traffic. Let that do its thing, maybe try a Google search or something (knowing it won't work), and keep PingPlotter running. After about a minute or so, go ahead and press the red square to stop it. You can then head to File -> Save As..., and save the file. Send that file to us (but I wouldn't recommend sending it on the forums - feel free to email us at support@pingman.com with the file attached and ask for Hayla).
_________________________
Regards,
Hayla

Top

Moderator:  Connor, Pete Ness, Poe, Taylor Edginton 
Search

Who's Online
0 registered (), 10 Guests and 2 Spiders online.
Key: Admin, Global Mod, Mod