Kitz ADSL Broadband Information
adsl spacer  
Support this site
Home Broadband ISPs Tech Routers Wiki Forum
 
     
   Compare ISP   Rate your ISP
   Glossary   Glossary
 
Please login or register.

Login with username, password and session length
Advanced search  

News:

Author Topic: Investigating PPI (no, not that PPI)  (Read 1653 times)

LordFox

  • Member
  • **
  • Posts: 24
Investigating PPI (no, not that PPI)
« on: August 01, 2016, 07:42:56 AM »

Periodic Ping Increase... Has anyone seen something like this before and can offer advice to track it down?

I'm no idea what the cause is so I've posted in general internet.

I've noticed this since I signed up to ThinkBroadband's pinging service, after going onto FTTC. See the graph:



About every 1.5 hours (but not exactly - actually 17 times in 24 hours) I get the latency increase as can be seen. It seems consistently timed at just after midnight every night. Note also the little pre-spike before the big ones. Obviously there's a little variation when I'm using something.

Last night I turned off my server and most kit around here, or at least disabled their gateways if they had one set. So, nothing should have been going out. I monitoring the switch port connected to my router's LAN port with Wireshark using a dedicated monitor NIC on the PC, with the LAN NIC disabled (so it was quiet). Nothing showed that could account for the increased latency; hardly any traffic, just the usual network chatter (STP, CDP, etc). Nothing tried to use the internet.

That leaves just the router and modem themselves (see my sig). There's nothing I know of on the router's config that should be running periodically like that. The router terminates an HE IPv6 tunnel but I've not noticed anything odd with that before.

My next step is to start disabling services on the router and monitoring the WAN port directly, but that needs a trip into the loft later today to swap some cables around.
Logged
PN 80/20 FTTC /29 subnet. VMG8324 modem. Mikrotik RB3011 Router. SG300 Switches. /48 IPv6 prefix. PiHoles. Stratum-1 NTP. Fibre around the house.

d2d4j

  • Kitizen
  • ****
  • Posts: 1056
Re: Investigating PPI (no, not that PPI)
« Reply #1 on: August 01, 2016, 08:10:11 AM »

Hi

I myself would not disable/stop any services you have running

The Ping is external to your services/systems and you have no control over the nodes used by tbb to your external IP address

If you look at everyone's ping graphs, you will similar

It could be tbb systems or edge gateways causing the increase, which edge systems are designed to drop, but the ping would wait a set time for response

Many thanks

John
Logged

LordFox

  • Member
  • **
  • Posts: 24
Re: Investigating PPI (no, not that PPI)
« Reply #2 on: August 01, 2016, 08:34:43 AM »

Yes, I expect you're right. With it being so regular I wondered if something local was doing a quick burst of 'something', like an update, enough to saturate the line and cause some delay answering the ping. It doesn't seem to be the case though.

I suppose the sure way to know it's nothing here causing it would be to plug in the modem/router from Plusnet, and nothing else. That's currently configured just as a switch and WAP though, and blu-tacked and duct taped to the back of the TV cabinet.

Then again, I guess I get a little paranoid when I start watching graphs  ::)
Logged
PN 80/20 FTTC /29 subnet. VMG8324 modem. Mikrotik RB3011 Router. SG300 Switches. /48 IPv6 prefix. PiHoles. Stratum-1 NTP. Fibre around the house.

roswellgrey

  • Member
  • **
  • Posts: 73
Re: Investigating PPI (no, not that PPI)
« Reply #3 on: August 01, 2016, 08:43:03 AM »

It certainly superficially looks like a "a quick burst of 'something'" is causing that, although as John said the cause could well be before your router.
On my totally "off" home network from 10am till 7pm, I get "micro spikes" but they much smaller in amplitude  - there is a pattern there, but not quite as distinct as yours ...

My Broadband Ping

Might be a never ending quest to find the cause, but I would try to see others PN graphs to make sure it is not a PN oddity.
Also, presume your firewall log is clean ?  Could be someone automating a timed port scan (very unlikely, but you never know) ...
Logged
Billion 8800NL

kitz

  • Administrator
  • Senior Kitizen
  • *
  • Posts: 33032
  • Trinity: Most guys do.
    • http://www.kitz.co.uk
Re: Investigating PPI (no, not that PPI)
« Reply #4 on: August 10, 2016, 03:20:09 AM »

Ive been seeing 2hrly spikes for several years now since I got FTTC.   I've mentioned it on here quite a few times, but never got to the bottom of it.   

Its not specific to any particular modem unless its BCM related as its been seen on Zyxels and Billions etc.  For example heres someone using a Billion 8800NL.

One thing I have noticed is that it is was obvious when on some PN gateways than others.  Sometimes its a nice clean spike, others its more blurry.  Sometimes it will go away for a while until I next resync.
Logged
Please do not PM me with queries for broadband help as I may not be able to respond.
-----
How to get your router line stats :: ADSL Exchange Checker

LordFox

  • Member
  • **
  • Posts: 24
Re: Investigating PPI (no, not that PPI)
« Reply #5 on: August 10, 2016, 08:23:58 AM »

At least I'm not alone then :)

I noticed that the spikes have diminished in height (lower latency) recently. I did check out my firewall logs as suggested by roswellgrey, but there was nothing there that correlated.

It's just one of life's smaller mysteries.
Logged
PN 80/20 FTTC /29 subnet. VMG8324 modem. Mikrotik RB3011 Router. SG300 Switches. /48 IPv6 prefix. PiHoles. Stratum-1 NTP. Fibre around the house.