Solved

Network slows down to a halt eventually when connecting through router with cable modem

Posted on 2003-10-21
21
3,052 Views
Last Modified: 2013-11-29
I have a NETGEAR RT314 connected to a cable modem (provider=Rogers). When my computer is behind the router with an internal IP of 192.168.0.3 (or whatever), I eventually have huge packet loss - very slow. Sometimes it works for a few hours before this happens, sometimes it takes 5 minutes.  If I connect the cable modem directly to the computer, it works fine for days, weeks, etc.
0
Comment
Question by:leekleiner
  • 6
  • 4
  • 3
  • +4
21 Comments
 
LVL 31

Expert Comment

by:qwaletee
ID: 9595270
How do you resolve the problem eac time?  Restarting the PC? Restarting the router?

Are there other devices on the internal LAN, besides the router and the PC?

Is the slowdown aparanet on accessing the internet?  Accessing local network resources?

Have you tried upgrading the router's firmware?

I've seen situatons where a bug in the firmware caused the router to start dropping packets after it had been up for a while.  The bug was fixed in a later firmware release.
0
 

Author Comment

by:leekleiner
ID: 9595470
- I resolve it by renewing DHCP lease on router, sometimes shutting it and cable modem down, and renewing DHCP lease on computer.
- Local network resources remain okay
- Tried upgrading firmware, as well as two other routers - same problem

0
 
LVL 31

Expert Comment

by:qwaletee
ID: 9595594
Huh.  No clue, actually.  If you've swapped it out for other routers, I assume of a different brand, and seen the same problem, then it sounds like a cable modem issue, but I really couldn't say.
0
 

Expert Comment

by:luckyd1101
ID: 9595666
Did you try a different type of router?

I would guess one of the two problems:

A: There is a compatability problem between the router you are using and the cable modem, I have seen this type of problem with NIC cards and cable modems. Use a different NIC and the problem is solved. In your scenerio, try a linksys or some other brand or router.

B: You have bad cable modem. Talk with your ISP, they are usually willing to swap out cable modems to try to solve the problem.

Do you have any hubs or switches in the mix??

Mike

 
0
 
LVL 4

Expert Comment

by:harryballz
ID: 9595691
Hey leekleiner,

1) Make sure the cables you use when you are connected to the Router are good.  Did you make them yourself?  Swap it out anyway.
2) Look for a "keep alive feature" inside the router (if they are giving you a dynamic IP)
3) Don't stack anything on top of the router.  If it heats up it will act funny.
4) Lower your MTU's to 1492 inside the router (default is 1500)
5) Try a different brand router just to test (not Netgear).
0
 
LVL 79

Expert Comment

by:lrmoore
ID: 9597957
Make sure your system is not infected with Welchia worm? MSBlaster? the thousands of packets these worms send out will certainly cause your systems to crawl..
0
 
LVL 35

Expert Comment

by:ShineOn
ID: 9599821
Have you tried adjusting the settings for lease term on the router?  

Are you doing file sharing?  Sometimes the lag a router adds will cause packet loss if there is too much "upstream" traffic.  That results in the acknowledgements not being replied to fast enough, which subsequently causes retransmit requests and packet loss, that can have a snowball effect.  Limit your outbound bandwidth if you are running stuff like Kazaa or WinMX, that should help.
0
 
LVL 35

Expert Comment

by:ShineOn
ID: 9599839
BTW, I'm running on a Netgear RP614v2 now, switched to it from an SMC Barricade, and have had much fewer instances where I had to reset the router than with the SMC.
0
 

Author Comment

by:leekleiner
ID: 9603539
Thanks for the suggestions. I meant to say that I tried 3 DIFFERENT routers (Netgear, Linksys, D-Link) and same problem occurred. As far as my NIC card goes, since my computer works perfectly when connected directly to the computer, shouldn't that mean it's okay?
I will double check the virus/worm issue though, and swap the cables, move the router (it is in the furnace room, but it doesn't get that hot in there).
0
 
LVL 35

Assisted Solution

by:ShineOn
ShineOn earned 50 total points
ID: 9603620
Like lrmoore suggested regarding the network traffic caused by various worms/viruses, and I said regarding file-sharing programs, outbound packet traffic can cause problems with inbound connections.  If you are like most of us using cable-modem, your inbound bandwidth is much higher than your outbound bandwidh.  In either case - virus-generated traffic or file-sharing traffic - you will come to a point of diminishing returns where the more outbound traffic there is, the less reliable inbound connections become, which can snowball to a total lockup due to dropped packets and retransmit requests.

I would check both.  Even if you are running an antivirus, there are worms and trojans that get in "under the radar" and act in the background hidden from your realtime scan.  Check your services and make sure there isn't an oddball one running that you don't remember seeing before...
0
Better Security Awareness With Threat Intelligence

See how one of the leading financial services organizations uses Recorded Future as part of a holistic threat intelligence program to promote security awareness and proactively and efficiently identify threats.

 
LVL 31

Expert Comment

by:qwaletee
ID: 9604093
Given that o direct connect to the modem, there is no problem, that tends to eliminate anything on your PC that might be causing the problem.  Viruses, bad NICs, etc., would all show the same problem with the router, or directly with the cable modem.  That's why I huh'ed.
0
 
LVL 35

Expert Comment

by:ShineOn
ID: 9604314
qwaletee -

If problem exists with different brands and models of routers, then it can't be a problem with the router - it would have to be with the cable modem or the PC.

If it works fine with a direct connection to the cable modem, then it has to be a problem with a router - any router.

That's where the upstream/downstream bandwidth and traffic loads come into play, because no matter how fast they claim to be, a router always adds a lag.  That added lag on top of overcrowding your upstream bandwidth can cause packet loss due to excessive retransmit requests.
0
 
LVL 4

Expert Comment

by:harryballz
ID: 9604645
No I mean don't stack the modem on top of the router it needs to vent (but it is pretty funny that it's actuall in a furnace room :-)
Also, if it's a "Speedstream 6360" get a new model!  I had the same issue utill I swapped out the modem - the replacement was a Speedstream 5100 and it works fine now.
0
 
LVL 17

Accepted Solution

by:
John Gates earned 250 total points
ID: 9617795
A packet analyser like www.ethereal.com running on a machine might shed some light on why the slowdowns are occurring...  A lot of (ARP) who has 192.168.0.1-2-3-4-5-6 and so on would be an indication that you have welcha etc.  It is a good idea for troubleshooting to have an eye on what you cannot see =-)


Hope this helps!
D
0
 

Author Comment

by:leekleiner
ID: 9619903
Thanks for the suggestion, I tried ethereal and found that a large number of ICMP packets are coming from my PC. I haven't figured out what process is spawning them yet, but it seems interesting.
The IP that something is pinging gets incremented by one each time, for example:

192.171.182.124
192.171.182.125
192.171.182.126

etc...

Any idea what could be doing this?

I did a Norton Antivirus and did have the Welchia, but now that it's gone, I'm still getting these pings.
0
 

Author Comment

by:leekleiner
ID: 9619919
I'm also getting outgoing TCP packets which I would like to know their origin, but it's 99.7% (ICMP) to 0.3 (TCP).
0
 
LVL 79

Assisted Solution

by:lrmoore
lrmoore earned 200 total points
ID: 9620004
You are describing the exact symptoms of the Welchia worm and/or Blaster as I mentioned in my first post.
You have at least one infected host on your network.
http://securityresponse.symantec.com/avcenter/venc/data/w32.welchia.worm.removal.tool.html
http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html
0
 
LVL 17

Expert Comment

by:John Gates
ID: 9620127
Go to www.symantec.com like lr said but also do an online virus scan =-)

D
0
 
LVL 35

Expert Comment

by:ShineOn
ID: 9620181
Welchia spreads to all unpatched win2K and winXP machines.  Make sure you update your systems asap.
0
 
LVL 35

Expert Comment

by:ShineOn
ID: 9620191
If you follow lrmoore's links you will see that just running an antivirus scan won't remove either.  You have to use the removal tool or remove it manually.
0
 
LVL 17

Expert Comment

by:John Gates
ID: 9620647
Right and you also need to go to:
windowsupdate.microsoft.com on all machines and do the security patches to avoid spread / reinfection on the machines.  But a removal and scan will insure that the virus is not in other files.

D
0

Featured Post

IT, Stop Being Called Into Every Meeting

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

Join & Write a Comment

Suggested Solutions

This is the first one of a series of articles I’ll be writing to address technical issues that are always referred to as network problems. The network boundaries have changed, therefore having an understanding of how each piece in the network  puzzl…
Data center, now-a-days, is referred as the home of all the advanced technologies. In-fact, most of the businesses are now establishing their entire organizational structure around the IT capabilities.
Viewers will learn how to connect to a wireless network using the network security key. They will also learn how to access the IP address and DNS server for connections that must be done manually. After setting up a router, find the network security…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

743 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

12 Experts available now in Live!

Get 1:1 Help Now