sglee
asked on
Temporary Freeze on Internet Connection
Hi,From work, I use Remote Desktop to connect to my Terminal Server (running on VMWare host) to run Word, Excel, Access database.
The problem is that Remote Desktop connection "freezes" once every so many hours during the day. The "freeze" seems to last anywhere from 30 to 60 seconds. Even though I can't do anything during the freeze period, when it comes back, the cursor blinks where I left off. In other words, the signal does not drop completely. If it did, it would kill my remote desktop connection that would cause "data lost" in Word/Excel/ACCESS database. Everything comes back normal after 30-60 seconds.
In order to troubleshoot, I have done the following:
(1) I purchased/tried two NEW internet routers (Linksys, Netgear/currently used in production)
(2) I purchased two NEW Internet modems (TPLink and Motorola/currently used in production)
(3) ISP sent a technician out twice to my house. First time, they replaced some old parts outside of my house. Second time, they ran a brand new wire in my backyard.
All these effort have not addressed this intermittent "freeze" issue.
What else can I try?
Can I use PING command somehow to find out which device is causing this issue?
ASKER
Do you share this RD Server with anyone else? --> No
Is the connection via wireless --> Wired
Is the connection via wireless --> Wired
You "reconnect" exactly where you left off? Exactly the same screen and the cursor is exactly where you left it? Does the screen blank out or anything during the "freeze"?
It sounds more like the computer freezes. Does anyone else remoting in have the same problem?
It sounds more like the computer freezes. Does anyone else remoting in have the same problem?
ASKER
You "reconnect" exactly where you left off? --> Yes
Exactly the same screen and the cursor is exactly where you left it? --> Yes
Does the screen blank out or anything during the "freeze"? --> No, I can see exactly where I left off when it "freezes" except there is no response when I type or mouse the mouse. When it comes back in 30-60 seconds, I can see what I typing at the time of freeze, for example, in MS Word document.
I am the only one connecting to the Terminal Server from outside.
Exactly the same screen and the cursor is exactly where you left it? --> Yes
Does the screen blank out or anything during the "freeze"? --> No, I can see exactly where I left off when it "freezes" except there is no response when I type or mouse the mouse. When it comes back in 30-60 seconds, I can see what I typing at the time of freeze, for example, in MS Word document.
I am the only one connecting to the Terminal Server from outside.
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
@LockDown
I had already started pining external IP my TS indefinitely for about 30 min ago.
I was doing something else for about 30 minutes and came back to my work computer and checked my remote desktop connection. It was frozen and 15 seconds later, it came back live.
When I looked at Command Window where PING was running, I noticed 3 missing replies from my PING command below.
:BEGIN
PING -n 10 -w 1000 www.yahoo.com
IF %ERRORLEVEL%==0 ECHO %DATE% %TIME% Success>>C:\log.txt
IF %ERRORLEVEL%==1 ECHO %DATE% %TIME% Fail>>C:\log.txt
GOTO BEGIN
Then I began to see consistent Replies.
I am going to run PING command from another PC on the same network where TS is on.
I will report the results.
I had already started pining external IP my TS indefinitely for about 30 min ago.
I was doing something else for about 30 minutes and came back to my work computer and checked my remote desktop connection. It was frozen and 15 seconds later, it came back live.
When I looked at Command Window where PING was running, I noticed 3 missing replies from my PING command below.
:BEGIN
PING -n 10 -w 1000 www.yahoo.com
IF %ERRORLEVEL%==0 ECHO %DATE% %TIME% Success>>C:\log.txt
IF %ERRORLEVEL%==1 ECHO %DATE% %TIME% Fail>>C:\log.txt
GOTO BEGIN
Then I began to see consistent Replies.
I am going to run PING command from another PC on the same network where TS is on.
I will report the results.
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
@Uptime
Where do you want me to run pingplotter program? TS or another PC on the same network?
@LockDown
On one PC on the same network, I started running PING command against TS1 continuously. When my connection gets frozen, I will contact that user to see if we see "missing replies".
Where do you want me to run pingplotter program? TS or another PC on the same network?
@LockDown
On one PC on the same network, I started running PING command against TS1 continuously. When my connection gets frozen, I will contact that user to see if we see "missing replies".
This "Ping" test (GUI or BAT) probably won't do any good on the internal LAN. Its primary purpose would be for testing internet connectivity. On the internal LAN the Terminal Server would probably have to be completely locked up for a ping not to work. Have you also checked the log on the router for signs or problems?
ASKER
@LockDown
I found the log file in Netgear Router. After clearing the log, I connected to my Terminal Server (192.168.2.6).
64.xxx.xxx.xxx is my computer at work.
[LAN access from remote] from 64.xxx.xxx.xxx:62991 to 192.168.2.6:3389
[LAN access from remote] from 64.xxx.xxx.xxx:62990 to 192.168.2.6:3389
[LAN access from remote] from 64.xxx.xxx.xxx:62974 to 192.168.2.6:3389
[Log Cleared]
I will check the log file when I experience the freeze.
I found the log file in Netgear Router. After clearing the log, I connected to my Terminal Server (192.168.2.6).
64.xxx.xxx.xxx is my computer at work.
[LAN access from remote] from 64.xxx.xxx.xxx:62991 to 192.168.2.6:3389
[LAN access from remote] from 64.xxx.xxx.xxx:62990 to 192.168.2.6:3389
[LAN access from remote] from 64.xxx.xxx.xxx:62974 to 192.168.2.6:3389
[Log Cleared]
I will check the log file when I experience the freeze.
@sglee You can run it from both the local and remote computers (the internet routes may be different to and from).
ASKER
I established the connection to my laptop (on the same network as TS) remotely using Splashtop (remote access software) to check the log file in NETGEAR router.
A few minutes ago, my RDP connection to TS was frozen again for about 30 seconds and I discovered two things:
(1) When I realized that my RDP connection was frozen, I immediately checked the connection to my laptop and it was GOOD. Then I refreshed log file and saw the following:
[admin login] from source 192.168.2.121
[DoS Attack: RST Scan] from source: 54.230.200.185, port 80
A few minutes ago, my RDP connection to TS was frozen again for about 30 seconds and I discovered two things:
(1) When I realized that my RDP connection was frozen, I immediately checked the connection to my laptop and it was GOOD. Then I refreshed log file and saw the following:
[admin login] from source 192.168.2.121
[DoS Attack: RST Scan] from source: 54.230.200.185, port 80
ASKER
When I traced that IP, the below is what I saw.
Results for IP address 54.230.200.185
IP Address 54.230.200.185
Hostname server-54-230-200-185.fra5
ISP Amazon Technologies Inc.
Country United States United States
Email aes-noc@amazon.com
Why would amazon.com would be interested in checking my IP address?
Results for IP address 54.230.200.185
IP Address 54.230.200.185
Hostname server-54-230-200-185.fra5
ISP Amazon Technologies Inc.
Country United States United States
Email aes-noc@amazon.com
Why would amazon.com would be interested in checking my IP address?
Netgear is a little too quick to flag DOS attacks. It could have simply been a dropped packet from someone using Amazon. Not a lot of help on this pass. Remote Access to your Laptop was fine yet RDP locked up?
Both the connection to your laptop and RDP were both from your house to the LAN at work? That would mean your internet and the work internet are fine and that the problem would be in the Terminal Server.
Have you tried logging in as a different users on the Terminal Server just to make sure it isn't something in your profile?
Both the connection to your laptop and RDP were both from your house to the LAN at work? That would mean your internet and the work internet are fine and that the problem would be in the Terminal Server.
Have you tried logging in as a different users on the Terminal Server just to make sure it isn't something in your profile?
ASKER
Have you tried logging in as a different users on the Terminal Server just to make sure it isn't something in your profile?
---> Actually yes. This terminal server, although I am a primary user, there are other users that connect to this Terminal Server from two separate network in two different locations. For those users, I had to create a user account on the Terminal Server and when one of those users logged in, the same "freeze" happened.
I simply told them to wait for 30-60 seconds.
So far, considering the fact that I had two connections going (1) RDP to TS (2) Splashtop to a laptop computer.
When RDP connection was frozen, I checked Splashtop session and it was good.
So the problem is NOT on internet side.
It is either on (1) Terminal Server itself or (2) Terminal Service on TS or (3) something on the computer that is running Terminal Server.
---> Actually yes. This terminal server, although I am a primary user, there are other users that connect to this Terminal Server from two separate network in two different locations. For those users, I had to create a user account on the Terminal Server and when one of those users logged in, the same "freeze" happened.
I simply told them to wait for 30-60 seconds.
So far, considering the fact that I had two connections going (1) RDP to TS (2) Splashtop to a laptop computer.
When RDP connection was frozen, I checked Splashtop session and it was good.
So the problem is NOT on internet side.
It is either on (1) Terminal Server itself or (2) Terminal Service on TS or (3) something on the computer that is running Terminal Server.
I believe you said that this was not a shared server, but that could change the problem drastically?
Can you duplicate this issue any time someone logs on or off the server? (Please try that)
Also, do any of the users use HP printers and are there HP printer drivers installed on the terminal server?
Can you duplicate this issue any time someone logs on or off the server? (Please try that)
Also, do any of the users use HP printers and are there HP printer drivers installed on the terminal server?
I am getting a little confused. You said you were the only one that accessed this server over the internet correct?
Yet you said that users that accessed it locally has the same problem. That would definitely rule out the internet. What do you mean that users from "two different networks" access the TS? What are the two different networks and how are they connected? The initial diagram didn't really show two different networks. Can you re-work the diagram and display what is actually connected to what?
Yet you said that users that accessed it locally has the same problem. That would definitely rule out the internet. What do you mean that users from "two different networks" access the TS? What are the two different networks and how are they connected? The initial diagram didn't really show two different networks. Can you re-work the diagram and display what is actually connected to what?
ASKER
"I believe you said that this was not a shared server" --> sorry if I misled you. Most time, I am the only person and it still freezes. There are times a few users do connect and run MS ACCESS database system. It also froze when there was one user and my self were connected to Terminal Server."do any of the users use HP printers and are there HP printer drivers installed on the terminal server?" --> Yes. In order for TS users to be able to print reports to their local printers from ACCESS database on TS, I had to add a couple of IP-based HP laserjet printers (HP CP4520, HP 4014, Xerox 5755) into my Terminal Server.
Fyi "redirected N" are the printers that are on my work network.
ASKER
More accurate diagram 
ASKER
Something about Remote Desktop Connection and its demand on resources ...
Over the weekend, I was travelling and staying in cheap hotel with "bad" WiFi. When I was trying to connect to my Terminal server using RDP on my laptop, it failed to make the connection 99% of the time. But a few times that I was able to connect, the connection was too slow to do anything. So I thought there was something wrong with my Internet or TS.
But after checking out from the hotel, I was in StarBucks coffee shop and I had NO problem connecting to my TS using RDP on my laptop. Go figure.
Strange thing is that in the hotel, I had NO problem surfing the internet - CNN.com, ESPN.com ... etc.
So maybe Remote Desktop Connection carries a lot of load to make the connection and to stay connected unlike other connections like Logmein, Splashtop?
Over the weekend, I was travelling and staying in cheap hotel with "bad" WiFi. When I was trying to connect to my Terminal server using RDP on my laptop, it failed to make the connection 99% of the time. But a few times that I was able to connect, the connection was too slow to do anything. So I thought there was something wrong with my Internet or TS.
But after checking out from the hotel, I was in StarBucks coffee shop and I had NO problem connecting to my TS using RDP on my laptop. Go figure.
Strange thing is that in the hotel, I had NO problem surfing the internet - CNN.com, ESPN.com ... etc.
So maybe Remote Desktop Connection carries a lot of load to make the connection and to stay connected unlike other connections like Logmein, Splashtop?
There's a really good chance the HP drivers are causing part of your problem. Could you try disabling the printer spooler for a day on the server and see if it freezes without the spooler running?
The hotel is probably unrelated ot this, most hotels have terrible mbps on connections (I was just in a hyatt and was getting 0.5 x 0.25 until I paid for upgraded internet). Web pages load faster because they aren't persistent connections like a RDP stream.
The hotel is probably unrelated ot this, most hotels have terrible mbps on connections (I was just in a hyatt and was getting 0.5 x 0.25 until I paid for upgraded internet). Web pages load faster because they aren't persistent connections like a RDP stream.
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
I will disable printer spooler tomorrow. Also I will stop attaching local printers from my RDP session.
Let me go from there tomorrow.
I will report back.
Let me go from there tomorrow.
I will report back.
ASKER
I stopped Print Spooler in Terminal Server.Also in my remote desktop connection, I unchecked Printers and Drives under Local Resources.
I am setting up another Terminal Server on the same network to compare. Just in case this particular terminal server (a virtual machine on VMWare box, 8GB RAM, 100GB HD W2008R2 OS) is a problem for some unknown reason. The new Terminal Server will be also a virtual machine (8GB RAM, 100GB HD running on W2012R2 OS ) on a W2012 HyperV box. I am set up port number 3390 for this one, install same stuff (Word/Excel/Access) and keep my RDP connections to both TS1 and TS2.
What version of Office are you running on each TS? I believe the HP driver issues are resolved in 2012R2 (at least that I've seen) but there are some ways to work around it on a 08 R2 box.
Do let me know if it freezes with the spool disabled.
Do let me know if it freezes with the spool disabled.
ASKER
I am using Office 2003 Professional on TS / W2008R2.
I work only 2 more hours today, so I may have to wait until tomorrow to see the next freeze.
I will keep you posted.
I work only 2 more hours today, so I may have to wait until tomorrow to see the next freeze.
I will keep you posted.
Did you notice a difference with printer spooler and redirection disabled?
ASKER
@Uptime,
After stopping printer spooler and disabling printer redirection two days ago, I stayed connected to my Terminal Server only for a couple of hours yesterday. But it froze ONCE.
Today I am going to finishing setting up another Terminal Server with port number 3390 and install the same MS office package and use ACCESS Database and open WORD documents.
I will keep both connections to TS1 and TS2 open and when I detect a freeze on TS1, I will check TS2.
After stopping printer spooler and disabling printer redirection two days ago, I stayed connected to my Terminal Server only for a couple of hours yesterday. But it froze ONCE.
Today I am going to finishing setting up another Terminal Server with port number 3390 and install the same MS office package and use ACCESS Database and open WORD documents.
I will keep both connections to TS1 and TS2 open and when I detect a freeze on TS1, I will check TS2.
Did it "freeze" or did it "jet lag"? Freeze, as a rule, means life is over. Rebooting is the only recourse. To me it sounds like it is jet lagging. Have you checked the processes?
ASKER
"Freeze, as a rule, means life is over" ---> Then I misused the term. I should have called it "jet lag" because the screen is there with no response and come back live after 15-60 seconds later once I click any part of the screen. It is like waking up somebody. I never lost any data. All the application programs come alive as if nothing ever happened.
No, I have not checked the processes. What do you want me to look for?
No, I have not checked the processes. What do you want me to look for?
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
Update:
I just realized that I was running too many VMs (including Terminal Server) in my VMWare box.
I was running 11VMs and total RAM assigned to them was 31.5GB on a HP Proliant Server with 16GB of physical RAM.
When I added all the memory used by active/running VMs, it was 22GB which is 6GB over total physical RAM of 16GB.
I just deleted a whole bunch of old/test VMs and reduced it down to a few VMs.
(1) Terminal Server VM: 8GB
(2) Windows 7 VM: 4GB
(3) IIS VM: 1GB (turned off)
So the total RAM actively assigned/used is 12GB plus Host OS.
I just realized that I was running too many VMs (including Terminal Server) in my VMWare box.
I was running 11VMs and total RAM assigned to them was 31.5GB on a HP Proliant Server with 16GB of physical RAM.
When I added all the memory used by active/running VMs, it was 22GB which is 6GB over total physical RAM of 16GB.
I just deleted a whole bunch of old/test VMs and reduced it down to a few VMs.
(1) Terminal Server VM: 8GB
(2) Windows 7 VM: 4GB
(3) IIS VM: 1GB (turned off)
So the total RAM actively assigned/used is 12GB plus Host OS.
ASKER
Update:
I was connected to both TS1 and TS2 while keeping the same ACCESS database open.
TS1 CPU utilization % was 0-1% for about an hour. Then all of a sudden, it spike to 60%. When I clicked the desktop screen of TS1 RDP session, it was frozen again. After about 20 seconds, it came back and CPU% was down to 1% and 0%.
During that time, my RDP connection to TS2 was still live.
So what I can eliminate is:
(1) Router
(2) Internet Service
(3) Network wiring
(4) Network Switch
The sudden spike of CPU% caused "freeze" in this Windows 2008 R2 Terminal Server Virtual Machine.
I was connected to both TS1 and TS2 while keeping the same ACCESS database open.
TS1 CPU utilization % was 0-1% for about an hour. Then all of a sudden, it spike to 60%. When I clicked the desktop screen of TS1 RDP session, it was frozen again. After about 20 seconds, it came back and CPU% was down to 1% and 0%.
During that time, my RDP connection to TS2 was still live.
So what I can eliminate is:
(1) Router
(2) Internet Service
(3) Network wiring
(4) Network Switch
The sudden spike of CPU% caused "freeze" in this Windows 2008 R2 Terminal Server Virtual Machine.
ASKER
I found this error around the time when the last "freeze" occurred and I see a lot of these in Event Viewer.
Could this be the source of the problem?
Log Name: Application
Source: Windows Error Reporting
Date: 4/21/2016 3:43:27 PM
Event ID: 1001
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: TS1.domain.local
Description:
Fault bucket , type 0
Event Name: WindowsUpdateFailure3
Response: Not available
Cab Id: 0
Problem signature:
P1: 7.6.7601.19077
P2: 80072ee2
P3: 00000000-0000-0000-0000-00
P4: Scan
P5: 0
P6: 1
P7: 0
P8: AutomaticUpdates
P9: {3DA21691-E39D-4DA6-8A4B-B
P10: 0
Attached files:
These files may be available here:
C:\ProgramData\Microsoft\W
Analysis symbol:
Rechecking for solution: 0
Report Id: 50c44776-07f9-11e6-88c0-00
Report Status: 4
Could this be the source of the problem?
Log Name: Application
Source: Windows Error Reporting
Date: 4/21/2016 3:43:27 PM
Event ID: 1001
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: TS1.domain.local
Description:
Fault bucket , type 0
Event Name: WindowsUpdateFailure3
Response: Not available
Cab Id: 0
Problem signature:
P1: 7.6.7601.19077
P2: 80072ee2
P3: 00000000-0000-0000-0000-00
P4: Scan
P5: 0
P6: 1
P7: 0
P8: AutomaticUpdates
P9: {3DA21691-E39D-4DA6-8A4B-B
P10: 0
Attached files:
These files may be available here:
C:\ProgramData\Microsoft\W
Analysis symbol:
Rechecking for solution: 0
Report Id: 50c44776-07f9-11e6-88c0-00
Report Status: 4
Yep. 60% CPU Utilization will cause it to "freeze". Now you just need to pin down the exact service/process that caused the 60% and figure out why.
ASKER
@LockDown32,I downloaded ProcessHistory program and ran it on my W2008R2. After that, I ran backgroundexe, but I don't see anything under the Drop-down menu.
After creating a new user and executing Background.exe, I am supposed to see something in the drop down menu according to
http://processhistory.sourceforge.net/ example screenshot.
I tried to run both 64bit and 32bit version of these programs.
ASKER
problem solved.
Sorry sglee. I'll take a closer look at that program. What was the offending process?
ASKER
@LockDown32,
Actually I could not get Process History working.
Actually I could not get Process History working.
Wow. I couldn't get that program to work either and not much was available via Google but I did eventually come across an article on how to get Sysinternals Process Monitor to do it:
http://superuser.com/questions/453909/log-cpu-by-process-over-time
http://superuser.com/questions/453909/log-cpu-by-process-over-time
ASKER
I will try Sysinternals and report back.
ASKER
@Lockdown
I started running Process Monitor since yesterday. I logged off from TS1 between 5PM yesterday and about 9AM this morning. The information on the screen is simply overwhelming to me.
What am I supposed to be looking for when the RDP connection becomes frozen and come back later?
I started running Process Monitor since yesterday. I logged off from TS1 between 5PM yesterday and about 9AM this morning. The information on the screen is simply overwhelming to me.
What am I supposed to be looking for when the RDP connection becomes frozen and come back later?
ASKER
I forgot to upload the screenshot of Process Monitor in my previous posting.
That screen is overwhelming. It is the wrong screen. Follow that article to a T. You want to look at the screen below the caption "You'll now get a list of all active processes you recorded, with their activity over time."
Is the connection via wireless or via wired connections (both the server and your computer)?