Network slows down to a halt eventually when connecting through router with cable modem

I have a NETGEAR RT314 connected to a cable modem (provider=Rogers). When my computer is behind the router with an internal IP of 192.168.0.3 (or whatever), I eventually have huge packet loss - very slow. Sometimes it works for a few hours before this happens, sometimes it takes 5 minutes.  If I connect the cable modem directly to the computer, it works fine for days, weeks, etc.
leekleinerAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

qwaleteeCommented:
How do you resolve the problem eac time?  Restarting the PC? Restarting the router?

Are there other devices on the internal LAN, besides the router and the PC?

Is the slowdown aparanet on accessing the internet?  Accessing local network resources?

Have you tried upgrading the router's firmware?

I've seen situatons where a bug in the firmware caused the router to start dropping packets after it had been up for a while.  The bug was fixed in a later firmware release.
leekleinerAuthor Commented:
- I resolve it by renewing DHCP lease on router, sometimes shutting it and cable modem down, and renewing DHCP lease on computer.
- Local network resources remain okay
- Tried upgrading firmware, as well as two other routers - same problem

qwaleteeCommented:
Huh.  No clue, actually.  If you've swapped it out for other routers, I assume of a different brand, and seen the same problem, then it sounds like a cable modem issue, but I really couldn't say.
Need More Insight Into What’s Killing Your Network

Flow data analysis from SolarWinds NetFlow Traffic Analyzer (NTA), along with Network Performance Monitor (NPM), can give you deeper visibility into your network’s traffic.

luckyd1101Commented:
Did you try a different type of router?

I would guess one of the two problems:

A: There is a compatability problem between the router you are using and the cable modem, I have seen this type of problem with NIC cards and cable modems. Use a different NIC and the problem is solved. In your scenerio, try a linksys or some other brand or router.

B: You have bad cable modem. Talk with your ISP, they are usually willing to swap out cable modems to try to solve the problem.

Do you have any hubs or switches in the mix??

Mike

 
harryballzCommented:
Hey leekleiner,

1) Make sure the cables you use when you are connected to the Router are good.  Did you make them yourself?  Swap it out anyway.
2) Look for a "keep alive feature" inside the router (if they are giving you a dynamic IP)
3) Don't stack anything on top of the router.  If it heats up it will act funny.
4) Lower your MTU's to 1492 inside the router (default is 1500)
5) Try a different brand router just to test (not Netgear).
lrmooreCommented:
Make sure your system is not infected with Welchia worm? MSBlaster? the thousands of packets these worms send out will certainly cause your systems to crawl..
ShineOnCommented:
Have you tried adjusting the settings for lease term on the router?  

Are you doing file sharing?  Sometimes the lag a router adds will cause packet loss if there is too much "upstream" traffic.  That results in the acknowledgements not being replied to fast enough, which subsequently causes retransmit requests and packet loss, that can have a snowball effect.  Limit your outbound bandwidth if you are running stuff like Kazaa or WinMX, that should help.
ShineOnCommented:
BTW, I'm running on a Netgear RP614v2 now, switched to it from an SMC Barricade, and have had much fewer instances where I had to reset the router than with the SMC.
leekleinerAuthor Commented:
Thanks for the suggestions. I meant to say that I tried 3 DIFFERENT routers (Netgear, Linksys, D-Link) and same problem occurred. As far as my NIC card goes, since my computer works perfectly when connected directly to the computer, shouldn't that mean it's okay?
I will double check the virus/worm issue though, and swap the cables, move the router (it is in the furnace room, but it doesn't get that hot in there).
ShineOnCommented:
Like lrmoore suggested regarding the network traffic caused by various worms/viruses, and I said regarding file-sharing programs, outbound packet traffic can cause problems with inbound connections.  If you are like most of us using cable-modem, your inbound bandwidth is much higher than your outbound bandwidh.  In either case - virus-generated traffic or file-sharing traffic - you will come to a point of diminishing returns where the more outbound traffic there is, the less reliable inbound connections become, which can snowball to a total lockup due to dropped packets and retransmit requests.

I would check both.  Even if you are running an antivirus, there are worms and trojans that get in "under the radar" and act in the background hidden from your realtime scan.  Check your services and make sure there isn't an oddball one running that you don't remember seeing before...
qwaleteeCommented:
Given that o direct connect to the modem, there is no problem, that tends to eliminate anything on your PC that might be causing the problem.  Viruses, bad NICs, etc., would all show the same problem with the router, or directly with the cable modem.  That's why I huh'ed.
ShineOnCommented:
qwaletee -

If problem exists with different brands and models of routers, then it can't be a problem with the router - it would have to be with the cable modem or the PC.

If it works fine with a direct connection to the cable modem, then it has to be a problem with a router - any router.

That's where the upstream/downstream bandwidth and traffic loads come into play, because no matter how fast they claim to be, a router always adds a lag.  That added lag on top of overcrowding your upstream bandwidth can cause packet loss due to excessive retransmit requests.
harryballzCommented:
No I mean don't stack the modem on top of the router it needs to vent (but it is pretty funny that it's actuall in a furnace room :-)
Also, if it's a "Speedstream 6360" get a new model!  I had the same issue utill I swapped out the modem - the replacement was a Speedstream 5100 and it works fine now.
John Gates, CISSPSecurity ProfessionalCommented:
A packet analyser like www.ethereal.com running on a machine might shed some light on why the slowdowns are occurring...  A lot of (ARP) who has 192.168.0.1-2-3-4-5-6 and so on would be an indication that you have welcha etc.  It is a good idea for troubleshooting to have an eye on what you cannot see =-)


Hope this helps!
D

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
leekleinerAuthor Commented:
Thanks for the suggestion, I tried ethereal and found that a large number of ICMP packets are coming from my PC. I haven't figured out what process is spawning them yet, but it seems interesting.
The IP that something is pinging gets incremented by one each time, for example:

192.171.182.124
192.171.182.125
192.171.182.126

etc...

Any idea what could be doing this?

I did a Norton Antivirus and did have the Welchia, but now that it's gone, I'm still getting these pings.
leekleinerAuthor Commented:
I'm also getting outgoing TCP packets which I would like to know their origin, but it's 99.7% (ICMP) to 0.3 (TCP).
lrmooreCommented:
You are describing the exact symptoms of the Welchia worm and/or Blaster as I mentioned in my first post.
You have at least one infected host on your network.
http://securityresponse.symantec.com/avcenter/venc/data/w32.welchia.worm.removal.tool.html
http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html
John Gates, CISSPSecurity ProfessionalCommented:
Go to www.symantec.com like lr said but also do an online virus scan =-)

D
ShineOnCommented:
Welchia spreads to all unpatched win2K and winXP machines.  Make sure you update your systems asap.
ShineOnCommented:
If you follow lrmoore's links you will see that just running an antivirus scan won't remove either.  You have to use the removal tool or remove it manually.
John Gates, CISSPSecurity ProfessionalCommented:
Right and you also need to go to:
windowsupdate.microsoft.com on all machines and do the security patches to avoid spread / reinfection on the machines.  But a removal and scan will insure that the virus is not in other files.

D
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Networking Protocols

From novice to tech pro — start learning today.