Solved

Severe Packet Loss with Cable Modem

Posted on 2000-04-28
9
790 Views
Last Modified: 2010-04-17
I have an RCA Cable Modem on an @home network and have been experiencing significant packet loss the past two weeks. I have talked to at least six level 1 techs and three level 2 techs. The problem seems to last from 1 to 3 minutes, and then goes away, for anywhere between 5 and 10 minutes. While acting up I experience 80 to 100% packet loss on the device which Visual Reports shows as hop 1 (hop 0 is my IP). I believe this device (10.76.118.1) is what controls the cable on which there may be up to 200 homes in my immediate neighborhood (what do you call that list of homes, all of which see the internet traffic sent to my modem, and what do you call the 10.76.118.1 device - is it a router, or something else). The man who installed my service lives within 1 mile of my house, however his hop 1 device is different from mine - his is 10.76.119.1, and both 10.76.119.1 and 10.76.118.1 share the next hop, which is 24.10.24.1. Interestingly when someone does a tracert to me, they don't see 10.76.118.1, so it must have one ip for outgoing traffic, and a different ip for incoming traffic.

I don't know whether 10.76.118.1 is failing, or whether one of the up to 200 homes it feeds may have a trojan sending out a Denial of Service Flood, and perhaps that is what is taking 10.76.118.1 out of service for several minutes.

Any idea how to shoot this problem? @home tech support seems to want to blame everything but 10.76.118.1, and because the problem goes away, they think they somehow fixed it, despite the fact that it comes back 5 or 10 minutes later.
0
Comment
Question by:singleton
  • 5
  • 3
9 Comments
 
LVL 3

Expert Comment

by:apadua
ID: 2762955
The first thing you want to do is log the situation. monitor access to 24.10.24.1 24 hours a day. http://www.neoworx.com has an app called neotrace. It's pretty cool, and will keep a ping going every few seconds. Create a log so you can complain with proof. Does your cable modem have any other type of management services? Ask them if they can't install some type of snmp or other to monitor your port up/down status. Could just be the link, since it's the next hop that fails you. Can you ping your own cable modem even though the link during your failed period? This way you know if the problem is with your modem or not.

Good luck,

Andre
0
 
LVL 11

Author Comment

by:singleton
ID: 2762971
>> Can you ping your own cable modem even though the link during your failed period?

I am not sure what the ip address of my cable modem is.

I know that when I have the firewall up, my cable company can ping my modem, but not my computer.

The first three hops that Visual Route shows are:
------------------------------------------------------------
 0  206.154.183.4  ip4-techshow.busprod.com
 1  10.76.118.1   -                                
 2  24.10.24.1    r1-fe1-0-100bt.tulsa1.ok.home.net

It is my understanding that 206.154.183.4 is my computer.  I suppose 10.76.118.1 could be my modem, but I have told that ip to techs over and over, and the same techs who said they could ping my modem have not identified that as being my modem.

And the man who installed my modem, and who lives less than a mile from me, has 24.10.24.1 on his tracert as well, and he said that he and I are not on the same cable, so I have just assumed that 10.76.118.1 is something a the head of the cable for my neighborhood, i.e. that everyone with that same ip in their route, shares in the bandwidth to our neighborhood.
0
 
LVL 11

Author Comment

by:singleton
ID: 2764180
>> The first thing you want to do is log the situation. monitor access to 24.10.24.1 24 hours a day. http://www.neoworx.com has an app called neotrace. It's pretty cool, and will keep a ping going every few seconds. Create a log so you can complain with proof.

How do I do that logging?  I got neotrace and have it running, and it gives a graphical picture that changes every few seconds, but how do I get it to set up a log with the data in a form I can send to @home?
0
 
LVL 1

Accepted Solution

by:
elvey earned 100 total points
ID: 2815698
I had somewhat similar trouble with PacBell - high latency and low throughput on a core router.
It took over a dozen calls/emails and 4 weeks to get it resolved.  Getting the names of the people I spoke to, and tracking numbers, and referencing them was key - I finally got to someone in the NOC (Network Operations Center - where the really smart people are) and they resolved it.  This is what will get it resolved, along with not losing my cool, and helping them to troubleshoot.  VisualRoute helps, as does traceroute ("tracert" under Windows).  If the problem depends on the time of day, it's probably congestion related.
10.x.x.x addresses such as 10.76.118.1 are for internal networks - they can't be part of the Internet except when NAT is used (Network Address Translation).
206.154.183.4 is not your IP address.
Because you are behind a NAT firewall, the web based VisualRoute won't work.
However, it makes it less likely that someone on your pipe has a trojan.
NeoTrace logging isn't thorough, but you can use what's
If this doesn't resolve your problem, please provide the full output of the visual route, and tell me your OS, and view statistics while listening to a RealAudio/video stream.
0
How to run any project with ease

Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
- Combine task lists, docs, spreadsheets, and chat in one
- View and edit from mobile/offline
- Cut down on emails

 
LVL 11

Author Comment

by:singleton
ID: 2815853
If the problem depends on the time of day, it's probably congestion related.

I will agree that congestion seemed to cause it to happen, but what would happen is that for from one to 3 minutes I would experience 80 to 100% packet loss, beginning at the first hop.

10.x.x.x addresses such as 10.76.118.1 are for internal networks - they can't be  part of the Internet except when NAT is used (Network Address Translation).

I don't understand. Others could ping 10.76.118.1, although they would not see it when they did a tracert to me.

206.154.183.4 is not your IP address.

Actually it turned out that it was an IP address in my machine. I had a NIC which had used that address, and hence it showed it when Visual Route showed my routing, although my real IP (the one my USB connection used, was 24.10.27.136

Because you are behind a NAT firewall, the web based VisualRoute won't work.

Still not sure I understand bening behind a NAT firewall. I do have the Zone Alarm firewall installed, but I told it to allow the Visual Route activity, and got the same results whether ZA was up or not.

Also don't understand "Web based Visual Route"; I was using the program downloaded from VR, and I had even licensed it.

However, it makes it less likely that someone on your pipe has a trojan.

NeoTrace logging isn't thorough, but you can use what's

You did not finish this sentence. How do I do logging under NeoTrace?

If this doesn't resolve your problem, please provide the full output of the visual route, and tell me your OS, and view statistics while listening to a RealAudio/video stream.

Operating System is Win98. Don't understand how I could be listening to a RA/RV stream, because when the problem occurred, I could not get ANYTHING through, not even a DNS request, until the thing broke loose.

The problem may be solved, in that we took out the NIC that had 206.154.183.4 configured for it, plus the USB connection to the cable modem, and installed a new NIC and that is what I am currently using, and it seems to work ok now, but if you can clarify the points I raised above, plus tell me how to do a trace across time with NeoTrace, I will go ahead and award the points to close this question out.
0
 
LVL 1

Expert Comment

by:elvey
ID: 2816300
Ok, here goes.
If you let neotrace run for a while, it will ping each hop over and over and when you hit the copy or print buttons, you get a result that includes average and max ping latency, which (just barely) provides the performance over time info needed.

You're right; 80-100% packet loss could only occur on the initial hop if one of the cable modems [in your subnet or, what I'd call your shared collision space] was malfunctioning.

You say "Others could ping 10.76.118.1, although they would not see it when they did a tracert to me."  That shouldn't happen.  10.x.x.x addresses are defined as for use only on internal networks.  Correctly configured Internet routers should not allow traffic to/from such addresses.

Actually, now that I have your correct IP, I can see that in fact you are NOT behind a NAT firewall, so all that stuff is irrelevant.

The RA/RV suggestion was just to get an idea of how performance was when things were working.

Here's what I get when I trace to what was your IP: (the variable width formatting will make this hard to read; hothing I can do about that...)
NeoTrace  Version 2.10 - Shareware (11-05-99)
Destination: 24.10.27.136


-#--------------Node Name---------------IP Address------Location-----------RT*--High---Low---Avg-Tot---D
 1                         matthewelvey 10.123.123.123  37.785N,122.436W    0    0    0    0   1   0
 2                  router.<mydomain> -my linux router 10.123.123.1    Unknown             0    0    0    0   5   0
 3 <my pacbell assigned IP> Unknown            20   30   20   26   5   0
 4         core1-fe4-1-0.snfc21.pbi.net 216.102.187.129 Unknown            10   20   10   13   5   0
 5           edge1-ge2-0.snfc21.pbi.net 209.232.130.71  Unknown            20   20   10   16   5   0
 6 sfra1sr3-so-0-1-3-0.ca.us.prserv.net 165.87.161.14   Unknown            20   20   10   16   5   0
 7                                      24.7.70.29      Unknown            10   20   10   10   5   0
 8           c1-pos3-1.snjsca1.home.net 24.7.66.38      37.325N,122.000W   20   20   10   13   5   0
 9                                      24.7.65.166     Unknown            30   30   20   26   5   0
10                                      24.7.65.177     Unknown            41   50   41   47   5   0
11           c1-pos3-0.ftwotx1.home.net 24.7.65.122     Unknown            50   60   50   53   4   0
12                                      24.7.74.130     Unknown            50   60   50   56   4   0
13      r2-fe0-0-100bt.rdc1.tx.home.net 24.4.0.3        Unknown            50   60   50   53   4   0
14                                      10.0.192.6      Unknown              -   71   71   71   7   6
15              ubr2.tulsa1.ok.home.net 24.10.24.26     Unknown            70   71   70   70   4   0
16         c286247-a.tulsa1.ok.home.com 24.10.27.136    Unknown              -    0    0    0   8   8
--------------------------------------------------------------------------------------------------------
*All times in milliseconds (ms), D=Dropped packets
--------------------------------------------------------------------------------------------------------
May 17, 2000 1:15:21
NeoTrace Copyright ©1997-1999 NeoWorx inc
http://www.neoworx.com

Hope that wraps it up.
0
 
LVL 11

Author Comment

by:singleton
ID: 2817240
I guess neotrace does not have the capability that some were telling me it had, which was to show  what I was experiencing, periods of 1-3 minutes with no connectivity, followed by periods where things were perfectly normal.

The man who actually installed my system came up with an interesting solution:

don.bat:
echo **********************************************************>>don.txt
echo.|time >> don.txt
ping -n 25 10.76.118.1 >> don.txt
don2.bat


don2.bat:
echo **********************************************************>>don.txt
echo.|time >>don.txt
ping -n 25 10.76.118.1 >> don.txt
don.bat

You could run don.bat in a dos window, and it would generate a report which would show the time that failures were occuring.

It did show what I thought I was seeing, but he also ran it on another machine at my house, connected via a hub to the same modem, and it did not show it, which proved the problem was my computer, not my modem or the zone controller that fed it.

I will go ahead and award the points to close out this question, but if you have anything else to add in comments, please feel free to continue the discussion.
0
 
LVL 1

Expert Comment

by:elvey
ID: 2818109
Thanks!  

Wow, a clueful service person.  I've supervised four DSL installs, and only 2 of 7 installers had a clue about anything.

Can you swap out the network card?
I assume the tech brought a laptop, and ran the batch file on both at the same time?

Network cards fail fairly often, but you can get cheap new ones for under $20. (more for PCMCIA cards).
0
 
LVL 11

Author Comment

by:singleton
ID: 2818262
Yes, he seemed more knowledgeable than most of not only the level 1, but also the level 2 techs I had worked with on the problem. I asked that I be allowed to talk to someone in NOC (Network Operations Center - where the really smart people are), or at least a supervisor of the last level 2 tech I worked with, who could not find his ass with both hands and a flashlight, and was told someone would call, but they never did, but fortunately I got the email address of my installer, and he was a big help. He did not know everything, and was willing to admit that, and to learn from me when I taught him things he did not know, and to try to dig out answers to questions I did not have the answer for.

Yes he brought a laptop and a 4 port hub, and ran it on both at the same time. He even left the laptop for several hours of testing, and the laptop only saw one problem, while my machine saw several sets of problems.

It could be my card had failed, but it was pretty good card (an Intel 10/100 card), however did install his NIC, rather than using my old Nic, but that was fine with me,as long as we got it to work.
0

Featured Post

How to run any project with ease

Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
- Combine task lists, docs, spreadsheets, and chat in one
- View and edit from mobile/offline
- Cut down on emails

Join & Write a Comment

Quality of Service (QoS) options are nearly endless when it comes to networks today. This article is merely one example of how it can be handled in a hub-n-spoke design using a 3-tier configuration.
I recently attended Cisco Live! in Las Vegas, a conference that boasted over 28,000 techies in attendance, and a week of hands-on learning hosted by a solid partner with which Concerto goes to market.  Every year, Cisco displays cutting-edge technol…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

759 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

21 Experts available now in Live!

Get 1:1 Help Now