asked on

Microsoft Widnows 2003 VPN Server. Only some clients have slow connections, packet loss.

Having a strange problem where only some clients connecting to a 2003 VPN server are experiencing slow connections between their machine and the server.

Here is the setup.
2003 Server SP2 2.3Ghz AMD Phenmom 2.30Ghz configured with VPN under Routing and Remote Access.
ISP Verizon Fios 15 Mbs up/down. (very fast connection otherwise)
About 15 clients, most in the same state all running windows XP.
About 6 out of the 15 clients connect and have slow speeds. I have a constant ping going to all clients, and most are in the 20-50ms range. However, there are about 6 that randomly will be in the 800 - 1200 range, but not all the time. I thought it was hardware related, and put together an entirely new box, new Nics, MB, CPU, everything, same setup, same results.

The strange thing is these clients that are having the problem, can connect to another VPN server (Windows 2003 server) that I have setup on a different ISP and they work file, pings in the 20-50ms range.

I suspect it's something to do with my ISP and/or server configuration. I've tried dropping the MTU in the router. I had been just fwding the proper ports, but tried it in the DMZ as well. The router is a MI424-WR running 4.0.16.1.56.0.10.11.6 version of firmware. This is on a Verizon FIOS business account with static IP, and from what I know there should be nothing preventing me from running a VPN server. Speed tests and other network performance don't seem to be an issue; speedtest.net reports I'm getting close to 15/15.

Qlemo

Can you issue an mturoute from the client? Get it from www.elifulkerson.com/projects/mturoute.php, and use the -t option ...

brasscoe

ASKER

OK, here are the results of the mturoute [server ip] -t. There are 4 results here.

[issues from one of the the good clients]
1 mturoute [public server ip] -t
2 mturoute [private server ip] -t
[issues from one of the the slow clients]
3 mturoute [public server ip] -t
4 mturoute [private server ip] -t

{good client from public IP}
* ICMP Fragmentation is not permitted. *
* Maximum payload is 10000 bytes. *
- ICMP payload of 5046 bytes failed..
- ICMP payload of 2569 bytes failed..
+ ICMP payload of 1330 bytes succeeded.
- ICMP payload of 1949 bytes failed..
- ICMP payload of 1639 bytes failed..
- ICMP payload of 1484 bytes failed..
+ ICMP payload of 1407 bytes succeeded.
+ ICMP payload of 1445 bytes succeeded.
+ ICMP payload of 1464 bytes succeeded.
- ICMP payload of 1474 bytes failed..
- ICMP payload of 1469 bytes failed..
- ICMP payload of 1466 bytes failed..
- ICMP payload of 1465 bytes failed..
+ ICMP payload of 1464 bytes succeeded.
+ ICMP payload of 1464 bytes succeeded.
Path MTU: 1492 bytes.

{good client from private IP}
C:\>mturoute 192.168.5.3 -t
* ICMP Fragmentation is not permitted. *
* Maximum payload is 10000 bytes. *
- ICMP payload of 5046 bytes failed..
- ICMP payload of 2569 bytes failed..
+ ICMP payload of 1330 bytes succeeded.
- ICMP payload of 1949 bytes failed..
- ICMP payload of 1639 bytes failed..
- ICMP payload of 1484 bytes failed..
- ICMP payload of 1407 bytes failed..
+ ICMP payload of 1368 bytes succeeded.
- ICMP payload of 1387 bytes failed..
- ICMP payload of 1377 bytes failed..
+ ICMP payload of 1372 bytes succeeded.
- ICMP payload of 1374 bytes failed..
- ICMP payload of 1373 bytes failed..
+ ICMP payload of 1372 bytes succeeded.
+ ICMP payload of 1372 bytes succeeded.
Path MTU: 1400 bytes.

{slow client from public IP}
* ICMP Fragmentation is not permitted. *
* Maximum payload is 10000 bytes. *
- ICMP payload of 5046 bytes failed..
- ICMP payload of 2569 bytes failed..
+ ICMP payload of 1330 bytes succeeded.
- ICMP payload of 1949 bytes failed..
- ICMP payload of 1639 bytes failed..
- ICMP payload of 1484 bytes failed..
+ ICMP payload of 1407 bytes succeeded.
+ ICMP payload of 1445 bytes succeeded.
+ ICMP payload of 1464 bytes succeeded.
- ICMP payload of 1474 bytes failed..
+ ICMP payload of 1469 bytes succeeded.
+ ICMP payload of 1471 bytes succeeded.
+ ICMP payload of 1472 bytes succeeded.
- ICMP payload of 1473 bytes failed..
+ ICMP payload of 1472 bytes succeeded.
+ ICMP payload of 1472 bytes succeeded.
Path MTU: 1500 bytes.

{slow client from private IP:}
C:\>mturoute 192.168.5.3 -t
* ICMP Fragmentation is not permitted. *
* Maximum payload is 10000 bytes. *
- ICMP payload of 5046 bytes failed..
- ICMP payload of 2569 bytes failed..
+ ICMP payload of 1330 bytes succeeded.
- ICMP payload of 1949 bytes failed..
- ICMP payload of 1639 bytes failed..
- ICMP payload of 1484 bytes failed..
- ICMP payload of 1407 bytes failed..
+ ICMP payload of 1368 bytes succeeded.
- ICMP payload of 1387 bytes failed..
- ICMP payload of 1377 bytes failed..
+ ICMP payload of 1372 bytes succeeded.
- ICMP payload of 1374 bytes failed..
- ICMP payload of 1373 bytes failed..
+ ICMP payload of 1372 bytes succeeded.
+ ICMP payload of 1372 bytes succeeded.
Path MTU: 1400 bytes.

Thanks for your help!

Qlemo

Sorry, you need to put the -t before the IP address. And we can improve the speed a bit:

mturoute -t -w 100 IPaddress

The interesting part of the output above is that internal you have a smaller Path MTU then external ...

brasscoe

ASKER

Thanks, here are the updated results:

slow client public IP:
C:\>mturoute -t -w 100 71.254.155.27
mturoute to 71.254.155.27, 30 hops max, variable sized packets
* ICMP Fragmentation is not permitted. *
* Maximum payload is 10000 bytes. *
1 --+---+++-+++-++ host: 137.237.146.251 max: 1500 bytes
2 --+---+++-+++-++ host: 192.168.104.49 max: 1500 bytes
3 --+---+++-+++-++ host: 152.176.50.157 max: 1500 bytes
4 --+---+++-+++-++ host: 152.164.243.222 max: 1500 bytes
5 --+---+++-+++-++ host: 137.237.2.145 max: 1500 bytes
6 --+---+++-+++-++ host: 137.237.51.65 max: 1500 bytes
7 --+---+++-+++-++ host: 192.160.117.76 max: 1500 bytes
8 --+---+++-+++-++ host: 63.122.231.153 max: 1500 bytes
9 --+---+++-+++-++ host: 152.63.81.30 max: 1500 bytes
10 --+---+++-+++-++ host: 152.63.81.154 max: 1500 bytes
11 --+---+++-+++-++ host: 152.63.80.14 max: 1500 bytes
12 --+---.+++-+++-++ host: 130.81.19.20 max: 1500 bytes
13 --+---+++-+++-+.+ host: 130.81.17.26 max: 1500 bytes
14 --+---+++-+.++-++ host: 130.81.28.75 max: 1500 bytes
15 --+---+.++-+++-+.+ host: 130.81.27.39 max: 1500 bytes
16 17 --+---+++-+.++-++ host: 71.254.155.27 max: 1500 bytes

slow client private IP:
C:\>mturoute -t -w 100 192.168.5.3
mturoute to 192.168.5.3, 30 hops max, variable sized packets
* ICMP Fragmentation is not permitted. *
* Maximum payload is 10000 bytes. *
1 --+----.+--.+--++ host: 192.168.5.3 max: 1400 bytes

good client public IP:
C:\>mturoute -t -w 100 71.254.155.27
mturoute to 71.254.155.27, 30 hops max, variable sized packets
* ICMP Fragmentation is not permitted. *
* Maximum payload is 10000 bytes. *
1 --+---+++-+++-++ host: 99.10.243.158 max: 1500 bytes
2 --+---+++----++ host: 151.164.185.169 max: 1492 bytes
3 ... (host 64.160.199.131 is not responding)
4 --+---+++----++ host: 64.160.199.41 max: 1492 bytes
5 ... (host 12.123.30.133 is not responding)
6 --+---+++----++ host: 192.205.35.162 max: 1492 bytes
7 --+---+++----++ host: 152.63.116.162 max: 1492 bytes
8 --+---+++----++ host: 152.63.1.241 max: 1492 bytes
9 --..+---+.++----++ host: 152.63.10.158 max: 1492 bytes
10 --+---+++----++ host: 130.81.28.75 max: 1492 bytes
11 --+---+++----++ host: 130.81.27.39 max: 1492 bytes
12 13 --+---+++----++ host: 71.254.155.27 max: 1492 bytes

good client private IP:
C:\>mturoute -t -w 100 192.168.5.3
mturoute to 192.168.5.3, 30 hops max, variable sized packets
* ICMP Fragmentation is not permitted. *
* Maximum payload is 10000 bytes. *
1 --+----+--+--++ host: 192.168.5.3 max: 1400 bytes

Another interesting thing, the slow client right now (12:39 PM PDT) is getting pings from my server in the 250-350ms range, not too bad, the fast client is getting pings in the 19-22ms range, very good. Later in the late afternoon-evening 5:00-10:00 PM is when I'm noticing the pings of the slow clients going way up, >1000ms, but the good clients remain OK. Again, this is Verizon Businees FIOS, very strange problem.

Qlemo

The 1500 mtu is suspicious and unlikely. 1492 is probably correct, as there is another address header added (PPP/Slip). You could reduce the MTU of the bad client to a value below 1492. Lower MTUs are better anyway if the traffic is not continuous and high volume.
Would be really interesting whether that is the correct path we go ...

brasscoe

ASKER

Thanks, when you say "reduce the MTU of the bad client" you mean to change the setting on my router correct? My router has a section to set the MTU for both the WAN and LAN side, should I adjust both or just the WAN? Thanks again.

Qlemo

It's best to change the MTU on client side. This prevents fragmenting. Anything else will lead to fragmentation, which makes speed worse. Hence I recommend to do as described in http://www.windowsreference.com/windows-2000/how-to-manually-set-the-mtu-size-in-windows-xp-2003-2000-vista/ - change the MTU in registry of the client.

brasscoe

ASKER

OK, just to clarify, I see my VPN adapter and the pysical adapter show up in the register under HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Paramaters\Interfaces Should I be changing the MTU on the VPN, the pysical or both? I tried changing both, 1st to 1350, rebooted, no difference. Then to 500 for both, reboot, no difference. IT's very strange but I'm seeing again the problem is getting worse around late afternoon evening but only for a set of clients. My internet speeds don't appear to be changed. I can go to speedtest.net and still get close to 15/15 with a ping of 16ms.

brasscoe

ASKER

I'm thinking this may be an ISP problem, not anything to do with my vpn clients or vpn server. It starts to slow down around 5-6PM and gets worse, it's 10:30 PM now, and the ping speeds have gone back up to 800-900ms. Here is an output of 2 slow clients and 1 fast client. The ping speed is the same even if my clients are not connected to the VPN, it seems to just be a problem of slow connections between my router and "some" computers out there. Doesn't seem to have any geographically logic to it either, one of the slow clients is 10 miles away, one of the fast clients are 900 miles away, anyways here is the output:

slow client #1
C:\>ping 71.254.155.27

Pinging 71.254.155.27 with 32 bytes of data:

Reply from 71.254.155.27: bytes=32 time=1033ms TTL=50
Reply from 71.254.155.27: bytes=32 time=1043ms TTL=50
Reply from 71.254.155.27: bytes=32 time=988ms TTL=50
Reply from 71.254.155.27: bytes=32 time=969ms TTL=50

Ping statistics for 71.254.155.27:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 969ms, Maximum = 1043ms, Average = 1008ms

C:\>mturoute -t -w 100 71.254.155.27
mturoute to 71.254.155.27, 30 hops max, variable sized packets
* ICMP Fragmentation is not permitted. *
* Maximum payload is 10000 bytes. *
1 ----+--+++-++++ host: 137.237.146.251 max: 500 bytes
2 ----+--+++-++++ host: 192.168.104.49 max: 500 bytes
3 ----+--+++-++++ host: 152.176.50.157 max: 500 bytes
4 ----+--+++-++++ host: 152.164.243.222 max: 500 bytes
5 ----+--+++-++++ host: 137.237.2.145 max: 500 bytes
6 ----+--+++-++++ host: 137.237.51.65 max: 500 bytes
7 ----+--+++-++++ host: 192.160.117.76 max: 500 bytes
8 ----+--+++-++++ host: 63.122.231.153 max: 500 bytes
9 ----+--+++-++++ host: 152.63.81.30 max: 500 bytes
10 ----+--+++-++++ host: 152.63.81.154 max: 500 bytes
11 ----+--+++-++++ host: 152.63.80.14 max: 500 bytes
12 ----+--++.+-++++ host: 130.81.19.20 max: 500 bytes
13 ----+--+++-++++ host: 130.81.17.26 max: 500 bytes
14 ----+--.+++-.++++ host: 130.81.28.75 max: 500 bytes
15 16 17 18 19 20 21 22 23 24 25 26 27 28 29

slow client #2
C:\>ping 71.254.155.27

Pinging 71.254.155.27 with 32 bytes of data:

Reply from 71.254.155.27: bytes=32 time=786ms TTL=45
Reply from 71.254.155.27: bytes=32 time=802ms TTL=45
Reply from 71.254.155.27: bytes=32 time=819ms TTL=45
Reply from 71.254.155.27: bytes=32 time=839ms TTL=45

Ping statistics for 71.254.155.27:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 786ms, Maximum = 839ms, Average = 811ms

C:\>mturoute -t -w 100 71.254.155.27
mturoute to 71.254.155.27, 30 hops max, variable sized packets
* ICMP Fragmentation is not permitted. *
* Maximum payload is 10000 bytes. *
1 --+---+++-+++-++ host: 192.168.0.1 max: 1500 bytes
2 --+---+++-+++-++ host: 73.28.104.1 max: 1500 bytes
3 --+---+++-+++-++ host: 68.86.150.77 max: 1500 bytes
4 --+---+++-+++-++ host: 68.85.174.57 max: 1500 bytes
5 --+---+++-+++-++ host: 68.85.174.53 max: 1500 bytes
6 --+---+++-+++-++ host: 68.85.174.49 max: 1500 bytes
7 --+---+++-+++-++ host: 68.85.174.45 max: 1500 bytes
8 --+---+++-+++-++ host: 68.85.174.41 max: 1500 bytes
9 --+---+++-+++-++ host: 68.86.90.73 max: 1500 bytes
10 --+---+++-+++-++ host: 64.209.88.253 max: 1500 bytes
11 --+---+++-+++-+.+ host: 67.17.106.246 max: 1500 bytes
12 --+---+++-+++-++ host: 204.255.169.17 max: 1500 bytes
13 .--+---+++-+++-++ host: 152.63.65.45 max: 1500 bytes
14 --+---+++-+++-++ host: 152.63.1.62 max: 1500 bytes
15 --+---+++-+++-++ host: 130.81.17.106 max: 1500 bytes
16 --+---+++-+++-++ host: 130.81.17.26 max: 1500 bytes
17 --+---+++-+++-++ host: 130.81.28.75 max: 1500 bytes
18 19 20 21 22 23 24 25 26 27 28 29

Good Client
C:\>ping 71.254.155.27

Pinging 71.254.155.27 with 32 bytes of data:

Reply from 71.254.155.27: bytes=32 time=57ms TTL=50
Reply from 71.254.155.27: bytes=32 time=57ms TTL=50
Reply from 71.254.155.27: bytes=32 time=54ms TTL=50
Reply from 71.254.155.27: bytes=32 time=56ms TTL=50

Ping statistics for 71.254.155.27:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 54ms, Maximum = 57ms, Average = 56ms

C:\>mturoute -t -w 100 71.254.155.27
mturoute to 71.254.155.27, 30 hops max, variable sized packets
* ICMP Fragmentation is not permitted. *
* Maximum payload is 10000 bytes. *
1 --+---+++----++ host: 71.130.57.254 max: 1492 bytes
2 ... (host 67.114.50.66 is not responding)
3 ... (host 151.164.92.196 is not responding)
4 ... (host 12.123.30.133 is not responding)
5 --+---+++----++ host: 192.205.35.162 max: 1492 bytes
6 --+---+++----++ host: 152.63.116.150 max: 1492 bytes
7 --+---+++----++ host: 152.63.1.225 max: 1492 bytes
*7 (An additional device responded for 152.63.1.225)
*7 (An additional device responded for 152.63.1.225)
8 --+---+++----++ host: 152.63.112.46 max: 1492 bytes
*8 (An additional device responded for 152.63.112.46)
*8 (An additional device responded for 152.63.112.46)
9 --+---+++----++ host: 130.81.28.73 max: 1492 bytes
10 --+---+++----++ host: 130.81.27.191 max: 1492 bytes
11 12 --+---+++----++ host: 71.254.155.27 max: 1492 bytes

Qlemo

Well, the MTU of 500 is puzzling a bit ... But it is not the culprit. Both slow clients have the route in common, they are all passing 130.81.28.75, and after that the delay is to big for the -w 100 timeout switch.
The fast client is routing via 130.81.28.73, and there seem to be alternative routes (as additional devices responded).

Definitely something provider specific.

ASKER CERTIFIED SOLUTION

brasscoe

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial