Kitz ADSL Broadband Information
adsl spacer  
Support this site
Home Broadband ISPs Tech Routers Wiki Forum
 
     
   Compare ISP   Rate your ISP
   Glossary   Glossary
 
Please login or register.

Login with username, password and session length
Advanced search  

News:

Pages: [1] 2 3

Author Topic: 22over7's packet loss on Plusnet  (Read 6973 times)

jelv

  • Helpful
  • Kitizen
  • *
  • Posts: 2054
22over7's packet loss on Plusnet
« on: January 21, 2019, 12:23:03 PM »

22over7 recently posted a link to his TBB BQM

Plusnet
FTTC 80/20 (static)
Zyxel VMG1312-B10A


The packet loss looks wrong to me.

From a PM he sent me his possible reasons are distance from TBB servers, he has a modem in bridge mode to the router which responds to the pings, he's on a Plusnet static IP, he has a Raspberry Pi monitoring the stats.

I don't buy any of those. I would have thought that if it were the packet loss would be constant. I have a similar setup and see no packet loss to AAISP.
Logged
Broadband and Line rental: Zen Unlimited Fibre 2, Mobile: Vodaphone
Router: Fritz!Box 7530

j0hn

  • Kitizen
  • ****
  • Posts: 4093
Re: 22over7's packet loss on Plusnet
« Reply #1 on: January 21, 2019, 12:34:14 PM »

It may only be packet loss affecting the line between the TBB servers, and has no effect on anything else.

I've seen this on a few BQM's where the user didn't notice any packet loss.

My BQM when I was with BT was often similar but the packet loss shown was not quite as bad.
I definitely didn't have any packet loss though, the line was perfect.
Logged
Talktalk FTTP 550/75 - Speedtest - BQM

22over7

  • Reg Member
  • ***
  • Posts: 101
Re: 22over7's packet loss on Plusnet
« Reply #2 on: January 21, 2019, 12:51:23 PM »

Many thanks for your attention jelv (& J0hn).  I myself don't buy my clutched-straws.

The only thing I might add is that I doubt it's anything to do with line, which has comparatively
few error'd seconds.   My FEC graphs do take a big lurch upwards [c. 250->12000 pm] when some nasty electrical device starts up
in my vicinity (shows up as a smear of yellow above the green bit), but it doesn't seem to correlate in any way
with the red stalactites of packet loss.

j0hn is quite right. I don't really notice any packet loss in real-life, except when mtr'ing some site on the other side of the world.
Throughput is respectably north of 70Mbps.
Logged

jelv

  • Helpful
  • Kitizen
  • *
  • Posts: 2054
Re: 22over7's packet loss on Plusnet
« Reply #3 on: January 21, 2019, 01:04:39 PM »

I've seen this on a few BQM's where the user didn't notice any packet loss.

None of the other BQM's that people have posted on here are showing any loss. I did have a "heartbeat" on IPv6 but that was a much smaller loss and at absolutely regular (roughly hourly) intervals. That disappeared with a router/firmware change.

It would be interesting to see a TBB speed test run at a time when the BQM was showing packet loss. I'd suspect the x1 download would be impacted.
Logged
Broadband and Line rental: Zen Unlimited Fibre 2, Mobile: Vodaphone
Router: Fritz!Box 7530

22over7

  • Reg Member
  • ***
  • Posts: 101
Re: 22over7's packet loss on Plusnet
« Reply #4 on: January 21, 2019, 01:21:04 PM »


It would be interesting to see a TBB speed test run at a time when the BQM was showing packet loss. I'd suspect the x1 download would be impacted.

FYI, an attached (I hope) screen shot. [Edit: Damn! Showed my postcode. Withdrawn for some cropping. In any case, x1 looks ok to me.]

The red stalactites are indeed sometimes rather heartbeat-ish.  I've running Merlin fork 374.43_2-11E1j9527 (rather ancient, but good wifi) on an ASUS RT-n66u.

   

« Last Edit: January 21, 2019, 01:27:32 PM by 22over7 »
Logged

Chrysalis

  • Content Team
  • Addicted Kitizen
  • *
  • Posts: 7382
  • VM Gig1 - AAISP L2TP
Re: 22over7's packet loss on Plusnet
« Reply #5 on: January 21, 2019, 02:33:52 PM »

the graph definitely got my attention and I agree with jelv its not normal, not even close to normal.

The problem with speedtests is you only doing a snapshot, a speedtest lasts about 30 seconds or so and the packetloss is not 24/7.

What is the ES. SES and FEC stats average for past 7 days?  Although FEC can probably be excluded as those are fixed errors which should not cause any packet loss.  So just ES and SES stats.

Also do you have any anti ddos, or packet inspection type features enabled on your firewall which could be blocking some tbb pings.  e.g. the fritzbox devices are known to do this.  Asuswrt merlin has 2 firewall settings, one is the basic firewall which should be on, but there is a second option for anti ddos which when I used to use asuswrt as my router device I had that option disabled.

Also aside from the packet loss the latency variance increases at 10pm and then stays increased for the rest of the graph including overnight, I suspect there is possible malware on the network if the other stuff is ruled out, and we assume not seeding torrents or something.
« Last Edit: January 21, 2019, 02:38:36 PM by Chrysalis »
Logged

22over7

  • Reg Member
  • ***
  • Posts: 101
Re: 22over7's packet loss on Plusnet
« Reply #6 on: January 21, 2019, 03:53:08 PM »

What is the ES. SES and FEC stats average for past 7 days?  Although FEC can probably be excluded as those are fixed errors which should not cause any packet loss.  So just ES and SES stats.

Over the last 7 days, averages, ES(D) = 5, ES(U) = 15. (Computed from a weeks worth of dslstats errors>averages. It has to be said, now and then there can be twice as many, the upstream almost always more ES-prone.)
I have not seen ANY SES for a very long time.  (Yes, I mean that. )  In the last year, I had one resync for a power brown-out, AFAICR.

Quote
Also do you have any anti ddos, or packet inspection type features enabled on your firewall which could be blocking some tbb pings.  e.g. the fritzbox devices are known to do this.  Asuswrt merlin has 2 firewall settings, one is the basic firewall which should be on, but there is a second option for anti ddos which when I used to use asuswrt as my router device I had that option disabled.
Basic firewall on, ddos off.  I need to do some head-scratching re other kinds of packet inspection. I don't do Qos, or parental stuff, which might I suppose do that.

Quote
Also aside from the packet loss the latency variance increases at 10pm and then stays increased for the rest of the graph including overnight, I suspect there is possible malware on the network if the other stuff is ruled out, and we assume not seeding torrents or something.
Worrying.  I don't do torrenting, or things like that.  Some iPlayer/Netflix watching a couple of times a week. 

Devices include: amazon firestick and tablet (off when not in use), 2 Raspbian pi's (always on: dslstats, and printer server), two linux systems (usually off), 2 mac systems (one always on, one hardly ever), wife's equipment eg. phone (evenings only). So, usually, on = mac, router, 2 pi's. The mac (and all other desktops, not too sure about the pi's) have basic firewalling,  but no anti-virus stuff (at one time used free Sophos on the mac).
I close all unnecessary ports on anything, if I can, and am quite conscientious, I think, about good passwords and changing them.

So. I guess you'd advise (??)
1. Update router firmware.
2. Reinstall Sophos on the mac, at least to scan it.
3. Check out the firewalling on the pi's.
4. Anything else?

I appreciate your thoughts, and definitely have things to do.  However, I am not entirely persuaded this is a malware problem. 
I suppose I could ask a local friend to ping me at my static IP for a few days, and keep track of what packet-loss is detected from a non-TBB source.

Plusnet seem to change my gateway several times a week. I have some suspicions that their provision for customers in Scotlandshire is
not as good as AAISP's might be. I can't get a straight answer from them about they route static ips, or what disadvantages that might bring.

Many thanks.
Logged

Chrysalis

  • Content Team
  • Addicted Kitizen
  • *
  • Posts: 7382
  • VM Gig1 - AAISP L2TP
Re: 22over7's packet loss on Plusnet
« Reply #7 on: January 21, 2019, 05:32:49 PM »

The problem is I am only speculating.  I am confident in saying something isnt right but thats about it.  I agree with you that the ES is way too low to be causing what we seeing so it isnt a line problem, its not an isp problem, as other plusnet graphs are not like that.

If you can add a monitor on another service as well that would be good, so there is a second service pinging the line thats not tbb.

If it is malware related updating the router firmware is unlikely to do anything, it would most likely be on a device thats always on, if none of your devices are always on (except the router) then I am probably wrong about the malware.
Logged

jelv

  • Helpful
  • Kitizen
  • *
  • Posts: 2054
Re: 22over7's packet loss on Plusnet
« Reply #8 on: January 21, 2019, 05:50:26 PM »

The fact that there is no significant (if any) increase in the maximum latency (yellow) indicates to me that it is nothing to do with anything running at your end.

Like you, I'd be more suspicious of

Quote
their provision for customers in Scotlandshire

their capacity to your exchange, or the capacity to your cabinet.
Logged
Broadband and Line rental: Zen Unlimited Fibre 2, Mobile: Vodaphone
Router: Fritz!Box 7530

22over7

  • Reg Member
  • ***
  • Posts: 101
Re: 22over7's packet loss on Plusnet
« Reply #9 on: January 21, 2019, 06:18:49 PM »

The problem is I am only speculating.  I am confident in saying something isnt right but thats about it.  I agree with you that the ES is way too low to be causing what we seeing so it isnt a line problem, its not an isp problem, as other plusnet graphs are not like that.

No, I'm sincerely grateful for what you've brought to my attention.  My pi's (that are always on) have completely ACCEPT iptables. One (the printer server, and ad-blocker) has ports 22, 53, 80, 139, 445, 5900 open (to the lan). Aaargh! 

Interestingly (to me) the packet loss spikes currently seem to occur (more or less) every 2 hours. 

Having kept an eye on the traffic on my lan, I was appalled at the number of things that "phone home". Like realVNC, dropbox, amazon gadgetry, apple, google etc. , generally to somewhere in america. I stamped out a few, but it seems to be a lifetime's work.

@jelv, there's a lot in what you say too.  I've had red stalactites on TBB BBQM with Plusnet forever (though not as luridly as now).   The yellow is I suspect down to something hostile in my neighbourhood. (There used to be a cannabis farm near the DSLAM. Maybe it's back.) I'd love a lower, more reliable ping, but to be honest, that's just the obsessive in me.  I'm not a gamer, and the throughput is enough. I'm reconciled (grumpily) to internet treacle (and to it's getting progressively worse...).

Still, maybe this interchange might after all be quite relevant to the ISPs forum.
Logged

Chrysalis

  • Content Team
  • Addicted Kitizen
  • *
  • Posts: 7382
  • VM Gig1 - AAISP L2TP
Re: 22over7's packet loss on Plusnet
« Reply #10 on: January 21, 2019, 06:50:49 PM »

The latency has gone back to normal just before 6pm.

Maybe your fiddling fixed that side of things at least :)

The amount of things exploitable is alarming, someone hacked printers not long ago to promote a youtube channel.
Logged

j0hn

  • Kitizen
  • ****
  • Posts: 4093
Re: 22over7's packet loss on Plusnet
« Reply #11 on: January 21, 2019, 06:57:47 PM »

Worry not about open ports on the LAN.
Worry about the WAN.

https://www.grc.com/shieldsup

Just remember this is ONLY monitoring packet loss between you and the TBB servers.
It does not necessarily indicate a problem.

Run some traceroutes during periods of packet loss showing.
Ping various different IP's and see if any packet loss is shown.

Some routers with DOS protection enabled will randomly drop ICMP packets.

I had a very similar BQM to you for about 3 months.
I can say with absolute certainty my connection was fine.

Replacing my old Asus router with a slightly better model (still an Asus) made the reported packet loss disappear.
Logged
Talktalk FTTP 550/75 - Speedtest - BQM

22over7

  • Reg Member
  • ***
  • Posts: 101
Re: 22over7's packet loss on Plusnet
« Reply #12 on: January 21, 2019, 07:47:18 PM »

Thanks pals.

We're (hopefully) done, I think.

Attached is what (just vefore) 6 o'clock (pm) looked like on my FEC page.
Maybe a graph of (certain kinds of) error correction in action.
Logged

kitz

  • Administrator
  • Senior Kitizen
  • *
  • Posts: 33879
  • Trinity: Most guys do.
    • http://www.kitz.co.uk
Re: 22over7's packet loss on Plusnet
« Reply #13 on: January 21, 2019, 07:56:39 PM »

Quote
Plusnet seem to change my gateway several times a week. I have some suspicions that their provision for customers in Scotlandshire is not as good as AAISP's might be.

I note you said you are on a static IP, therefore there are supposedly several gateways in London you can connect to.  Dynamic IP's have a more static routing as the IP's are dished out by a local pool near to the bRAS before the MSILs

Interestingly, I've just done a tracert and the details for these have changed fairly recently as there used to be a description of the gateway name when you did a tracert. (eg pcn-bng04.plus.net)
Now it just gives me the IP address which if I look up just simply says it belongs to BT, but further digging shows that it was formerly the IP for pcn-ir01.plusnet. (Colindale PoP).

https://whatismyipaddress.com/ip/84.93.253.64
Logged
Please do not PM me with queries for broadband help as I may not be able to respond.
-----
How to get your router line stats :: ADSL Exchange Checker

Chrysalis

  • Content Team
  • Addicted Kitizen
  • *
  • Posts: 7382
  • VM Gig1 - AAISP L2TP
Re: 22over7's packet loss on Plusnet
« Reply #14 on: January 22, 2019, 07:10:07 AM »

Thanks pals.

We're (hopefully) done, I think.

Attached is what (just vefore) 6 o'clock (pm) looked like on my FEC page.
Maybe a graph of (certain kinds of) error correction in action.


ahh yeah I forgot, FEC on g.inp does cause jitter, so that probably is the explanation for the latency thing I picked up on, and probably explains why jelv said its normal as well.
Logged
Pages: [1] 2 3