Kitz Forum
Broadband Related => Broadband Hardware => Topic started by: banger on February 14, 2020, 10:32:43 PM
-
I am using the above router purely as a wifi repeater connected to a switch and an Asus router to connect to my modem.
Every now and again my Netmeter on my machine spikes an upload every say 2 minutes but if I unplug the repeater the upload spike stops. See pic for upload spike.
Any ideas what data my machine is sending or how to find out and why it stops when I unplug the zyxel?
-
I've downloaded wireshark but a bit out of my depth as I have no idea on how to identify the packets that are uploading somewhere. Any ideas?
-
Any ideas what data my machine is sending or how to find out and why it stops when I unplug the zyxel?
This might be dump, but by machine you are talking about a PC, right?
-
This might be dump, but by machine you are talking about a PC, right?
Yes PC, unplug the repeater and upload stops.
-
Currently, it is not that clear as to how you have devices configured and how they are connected.
I wonder if you are just seeing artefacts of, say, ARP with one device asking "who has IP address X?" and then the response "I've got IP address X and my MAC is blah", etc.
-
I have seen that in wireshark.
Currently I have a VMG-1312-B10A connected by ethernet to Asus DSL-N55U in router mode which is connected to a 5 port Netgear 1 gigabit switch. Connected to the switch is the VMG8924-B10A on LAN 1 at 192.168.1.254 with the Asus at 192.168.1.1 with the Asus doing DHCP from 192.168.1.2 to 192.168.1.250. DHCP on the VMG8924-B10A is disabled.
As I say in my OP if I disconnect the VMG8924 from the switch the upload ceases. Connected to the VMG8924 wirelessly are another PC and a Laptop. My main PC is connected to the 5 port switch.
I hope that is enough detail.
-
Ah, so the VMG8924-B10A has been deployed as a WAP and not a repeater. I think I now understand your hardware configuration.
The VMG1312-B10A is just a bridging modem. What address is defined for its administrative interface? (By default it would be 192.168.1.1 but that is in use by the Asus device.) You just have 192.168.1.251 - 192.168.1.253 spare. (And I hope the Netgear switch is an unmanaged device.)
I am seeing --
VMG1312-B10A. Used as a bridging modem. Administrative interface is ?
Asus DSL-N55U. Used as a firewall/router/DHCP server/etc. Administrative interface is 192.168.1.1 (DHCP server hands out addresses 192.168.1.2 to 192.168.1.250)
VMG8924-B10A. Used as a WAP. Administrative interface is 192.168.1.254
I still suspect that you are seeing some form of interaction between the VMG8924-B10A and one of the other devices . . . but I'm unsure which one. :-\
-
Ah, so the VMG8924-B10A has been deployed as a WAP and not a repeater. I think I now understand your hardware configuration.
The VMG1312-B10A is just a bridging modem. What address is defined for its administrative interface? (By default it would be 192.168.1.1 but that is in use by the Asus device.) You just have 192.168.1.251 - 192.168.1.253 spare. (And I hope the Netgear switch is an unmanaged device.)
I am seeing --
VMG1312-B10A. Used as a bridging modem. Administrative interface is ?
Asus DSL-N55U. Used as a firewall/router/DHCP server/etc. Administrative interface is 192.168.1.1 (DHCP server hands out addresses 192.168.1.2 to 192.168.1.250)
VMG8924-B10A. Used as a WAP. Administrative interface is 192.168.1.254
I still suspect that you are seeing some form of interaction between the VMG8924-B10A and one of the other devices . . . but I'm unsure which one. :-\
VMG1312-B10A is 192.168.2.10. Yes the 8924 is a WAP not repeater. As I say when the 8924 is unplugged the traffic stops which is approximately every 5 minutes.
-
Hi
Sorry if I’m wrong but your not running any form of keep alive or perhaps dslstats monitor from your pc
Many thanks
John
-
Hi
Sorry if I’m wrong but your not running any form of keep alive or perhaps dslstats monitor from your pc
Many thanks
John
Running DSLStats over Wifi to the VMG1312-B10A. Could it be that DSLStats is trying to connect to the 8924? My Wifi adapter is set at 192.168.2.100 so it can talk to the 1312. This happens every 5 mins, DSLStats is set to sample every 1 min.
-
Please tell me more about the "Netmeter" and exactly what it is monitoring. You mention "uploading"; on which interface are you seeing that data flow?
-
Please tell me more about the "Netmeter" and exactly what it is monitoring. You mention "uploading"; on which interface are you seeing that data flow?
Netmeter is monitoring "all hadware interfaces" on the PC. As far as I am aware I am seeing it on the Realtek Gigabit family interface LAN port but cant be sure. I need some help to try and track it down.
-
So you suspect that your main PC is sending data through its Ethernet port? Is the "Netmeter" configurable as to what it monitors?
You say you have been running Wireshark but are having difficulty interpreting the results. Configure Wireshark to only monitor traffic on the PC's Ethernet port. Is it possible to view the "Netmeter" and the Wireshark display together? Surely that would give you a good idea as to which part of the Wireshark display corresponds to the upload as seen by the "Netmeter"?
-
I have I think isolated the interface to the realtek gaming GBe lan and I have tried your suggestion of watching wireshark and netmeter at the same time but it scrolls too fast to be discernable. I will try again.
-
Seeing a lot of the below in wireshark around the time of the spike on netmeter and a lot of IPV6 communication of a UpNP dll.
No. Time Source Destination Protocol Length Info
5440 215.445111 fe80::b81a:642b:15cb:905b ff02::c SSDP 183 M-SEARCH * HTTP/1.1
Also googling found this https://serverfault.com/questions/64884/network-flooded-with-m-search-packets-what-does-it-mean
-
Hmm . . . IPv6 addressing gives me a head-ache.
Can you identify the device which has the fe80::b81a:642b:15cb:905b address (the source) and what has the ff02::c address (the destination)? They are involved in the Simple Service Discovery Protocol (https://en.wikipedia.org/wiki/Simple_Service_Discovery_Protocol) (SSDP).
Perhaps try turning off UPnP on the VMG8924-B10A and see if the "upload" process disappears?
-
Hmm . . . IPv6 addressing gives me a head-ache.
Can you identify the device which has the fe80::b81a:642b:15cb:905b address (the source) and what has the ff02::c address (the destination)? They are involved in the Simple Service Discovery Protocol (https://en.wikipedia.org/wiki/Simple_Service_Discovery_Protocol) (SSDP).
Perhaps try turning off UPnP on the VMG8924-B10A and see if the "upload" process disappears?
fe80::b81a:642b:15cb:905b is the Realtek Gaming Gbe LAN controller on my main PC which IPV4 is 192.168.1.119. I cannot fathom the destination unless it is the VMG8924.
I have disabled Upnp on the 8924 and rebooted the device but traffic remains.
It's not a problem just does my OCD in seeing it every 5 mins on the meter.
-
I have disabled Upnp on the 8924 and rebooted the device but traffic remains.
It's not a problem just does my OCD in seeing it every 5 mins on the meter.
It would also irritate me, considerably.
Reading the Wikipedia SSDP (https://en.wikipedia.org/wiki/Simple_Service_Discovery_Protocol) page, I see that ff02::c is the IPv6 link-local address.
-
According to Windows resource monitor "svchost (localserviceandNoImpersonation)" is sending data around the same time as the spike in netmeter window. Must google this service.
According to google this is invoked by Windows App Locker, which according to the Wiki should not be present on my Windows 10 Pro only enterprise. Even more puzzled.
-
Applocker is a bit of a red herring I think. If I disable SSDP service on windows services which also disables Upnp host service the spike of upload data goes away. But this means Upnp devices will no longer function, which I am not sure what Upnp devices or software I have.
Even tried disabling Upnp on the Asus router in WAN section but no difference. Also tried an In-place upgrade of windows 10 pro but that had no effect.
Have left feedback for MS and some nice pictures in the feedback hub.
As far as I can tell My PC is uploading SSDP data to my Laptop and other PC over wifi at the same time they are downloading.
-
Which is understandable, SSDP is used to auto detect devices on the LAN. Routers, Printers, TVs, etc.
-
With it being an ebay router I am just a bit paranoid about security and it seemed a lot of traffic (relatively) but appears to be just on the LAN and not external.
-
Yes as Burakkucat says, ff02::c is the standard multicast address for SSDP. And fe80::whatever is your own machine’s link local IPv6 address
In the past, there has been no difference between "Pro" and "Enterprise" versions of Windows NT family o/S; it’s just been the method of sale and distribution - you could only get the latter with a (volume) license agreement, even thought the volume could in fact be pretty small iiirc but memory fades concerning all things Microsoft. Perhaps someone could look that up though.
Thinks like app locker are so useful that you would think you would want it on Pro too, as it is the uncrippled, uncastrated, secure version of Windows ie version != Home ;) >:D
-
With it being an ebay router I am just a bit paranoid about security and it seemed a lot of traffic (relatively) but appears to be just on the LAN and not external.
Your final test should be to revert the configuration of the VMG8924-B10A back to as it was when you made the original post on this topic and then turn off the wirelesses of the other PC and the laptop.
Why? Because I remembered --
Connected to the VMG8924 wirelessly are another PC and a Laptop.
I suspect the "upload spikes", as seen by the "Netmeter" of your main PC, would then stop.
-
Your final test should be to revert the configuration of the VMG8924-B10A back to as it was when you made the original post on this topic and then turn off the wirelesses of the other PC and the laptop.
Why? Because I remembered --
I suspect the "upload spikes", as seen by the "Netmeter" of your main PC, would then stop.
This is indeed correct when I turn off 5ghz on the VMG8924-B10A the upload stops.
-
We got there, eventually. :thumbs:
-
Just to update this thread, I sent the VMG-8924-B10A back to the seller and hopefully get a refund. Performance just wasn't there.
-
If I hadn't got the nanoHD I'd honestly be looking at https://www.broadbandbuyer.com/products/27543-zyxel-nwa1123-acv2-eu0101f/ or https://www.broadbandbuyer.com/products/35018-zyxel-nwa1123acpro-gb0101f/.
I'm a little disappointed they don't support 160Mhz channel widths though, but it seems almost impossible to get much performance gain out of that compared to 80Mhz. Unless you're trying to push Gigabit, its probably overkill.
-
How's the nanoHD perform. I have heard good things about Ubiqitui.
-
It performs well at 80Mhz channel width (my phone can reach up to 700Mbit) but disappointing at 160Mhz. I'm not sure if its a client issue though, as its odd that my laptops need 160Mhz channel width to reach the same speed as my phone, despite all three supporting 2x2 MU-MIMO and the laptops have the very latest Intel AX200 WiFi cards.
One particular improvement though, connecting to the network is almost instant, it always took a about 10-20 seconds before. But since updating the firmware I have noticed a few times my phone required WiFi turning on and off as traffic had stopped flowing, hard to know if its the phone or the nanoHD at fault there.
I have seen reports that Ubiquiti are overrated, their build quality is very cheap and it takes them years to stabalise their firmware, I can kinda corroborate the latter as I've seen their forums and they were the same with my Litebeam units I use to join another network across the road, although they HAVE been very stable considering only one side is mounted outdoors so I'm using them out-of-spec.
Looking at the forums though, if I had bough the nanoHD when it first came out, DFS didn't work and it didn't support 160Mhz channel widths at all. Even now, I couldn't enable 160Mhz from the standalone options, it only appeared when I connected it to a Unifi Controller, which is a huge oversight IMO. But right now? So far all looks good.
Also from what I have read, MU-MIMO is almost completely useless in the real world. I've only seen the top-end Zyxel claiming to do proper beamforming where it actually is able to redirect the signal to the client, everything else has fixed antenna patterns. On the nanoHD with a laptop each side of it, I saw no performance difference on concurrent transfers compared to having them both on the same side. The speed of both clients was exactly the same combined as a single client on its own maxing out.
I'm really looking forward to WiFi 6E, a nice clean 6Ghz frequency band with less range, is actually exactly what I will need once FTTP is available.
The thing is, I sometimes copy games between my desktop and laptop to save download time, so not having to plug it in via a cable for maximum speed would be extremely useful.