# Baffled by intermittent network slowdown



## cmoore (Sep 30, 2005)

Apologies for this long-winded post, but I want to get as much detail in as possible.

My ISP is Surewest, and I have a 3 MBPS ADSL line. That connects to a Linksys wireless router, behind which I've got 8 to 10 systems.

Recently I started getting intermittent slowdowns. I did some testing using Surewest's speed test (http://personal.surewest.com/internet/speed_test.php) which I think is the same as the one at dslreports.com. When the connection is working properly I get 2700 to 3100 KBPS. When it's not working I get less than 400 KBPS. Upload always seems to be good at around 600 KBPS, it's only download speed that suffers.

To see if the problem was with my network or Surewest's I put a laptop with Ethereal on the WAN side of the router. The speed tests are consistently good there, suggesting that the router is bad.

I replaced the the router with a new WRT54G. (I was due to upgrade to 802.11g anyway). I still see the same problems.

Now here's what's really got me confused. If I run the speed test from my desktop behind the router and monitor packets on the WAN side of the router I see something like this:
Server --> Client HTTP 1460 bytes of HTTP data
Server --> Client HTTP 1460 bytes of HTTP data
Client --> Server TCP ACK
Server --> Client HTTP 1460 bytes of HTTP data
Server --> Client HTTP 1460 bytes of HTTP data
Client --> Server TCP ACK
(About a .3 second lag)
Server --> Client HTTP 1460 bytes of HTTP data
(About a .2 second lag)
Client --> Server TCP ACK
Server --> Client HTTP 1460 bytes of HTTP data
Server --> Client HTTP 1460 bytes of HTTP data

and so on. The .5 second lags seem to happen every 3 seconds or so. (I've got Ethereal traces of all this but I don't know how to paste them in here.)

This looks to me like it's the server that stopped sending data, which means that the problem is on the other end, not on my end. So why would this work fine when I'm not going through my router and have this problem when I am going through the router? 

I've tried everything I could think of on the router configuration and I can't seem to make a difference. I'd really appreciate some help if anyone has any ideas. I could also send you the Ethereal traces if that would help.

Thanks!

Chris


----------



## johnwill (Sep 26, 2002)

Could this be an MTU size issue? Check the router's configuration and try reducing the MTU size. I'd start by knocking it down to 1492 and see if that helps.


----------



## cmoore (Sep 30, 2005)

Thanks for the reply. I thought of that - I switched the MTU from "Auto" to "Manual" and tried it at 1500, 1450, 1400, and 1350. Each time it gets better for a while, then slows down again. I'm guessing the "gets better for a while" is because the router has done some kind of an internal reset, but I'm not sure.
In any case, it changing the MTU doesn't seem to fix it.

Here's something else odd that I found. Every time the problem occurs I see something similar to the trace below (I figured out how to export from Ethereal). Frame 847 is data sequence 690480 from the server, length 1310. Frame 848 correctly acks 691790. Frame 849 is sequence 694410. We seem to have lost two packets somewhere. The missing data finally shows up out of order in fram 855, 50 msecs later.

Once again this seems, to me, to point to a problem at the ISP's end. However, I never see this on the WAN side of the router, only for requests that are going through my router.

Here's the trace, this one taken from the system on my LAN (and not from the WAN side of the router):

No. Time Source Destination Protocol Info
847 42.425638 66.60.128.30 192.168.1.2 HTTP Continuation or non-HTTP traffic

Frame 847 (1364 bytes on wire, 1364 bytes captured)
Ethernet II, Src: 00:14:bf:36:c9:39, Dst: 00:11:2f:e2:46:b1
Internet Protocol, Src Addr: 66.60.128.30 (66.60.128.30), Dst Addr: 192.168.1.2 (192.168.1.2)
Transmission Control Protocol, Src Port: http (80), Dst Port: 1064 (1064), Seq: 690480, Ack: 857, Len: 1310
Hypertext Transfer Protocol

No. Time Source Destination Protocol Info
848 42.670372 192.168.1.2 66.60.128.30 TCP 1064 > http [ACK] Seq=857 Ack=691790 Win=65535 Len=0

Frame 848 (54 bytes on wire, 54 bytes captured)
Ethernet II, Src: 00:11:2f:e2:46:b1, Dst: 00:14:bf:36:c9:39
Internet Protocol, Src Addr: 192.168.1.2 (192.168.1.2), Dst Addr: 66.60.128.30 (66.60.128.30)
Transmission Control Protocol, Src Port: 1064 (1064), Dst Port: http (80), Seq: 857, Ack: 691790, Len: 0

No. Time Source Destination Protocol Info
849 42.715583 66.60.128.30 192.168.1.2 HTTP Continuation or non-HTTP traffic

Frame 849 (1364 bytes on wire, 1364 bytes captured)
Ethernet II, Src: 00:14:bf:36:c9:39, Dst: 00:11:2f:e2:46:b1
Internet Protocol, Src Addr: 66.60.128.30 (66.60.128.30), Dst Addr: 192.168.1.2 (192.168.1.2)
Transmission Control Protocol, Src Port: http (80), Dst Port: 1064 (1064), Seq: 694410, Ack: 857, Len: 1310
Hypertext Transfer Protocol

No. Time Source Destination Protocol Info
850 42.715615 192.168.1.2 66.60.128.30 TCP [TCP Dup ACK 848#1] 1064 > http [ACK] Seq=857 Ack=691790 Win=65535 Len=0 SLE=694410 SRE=695720

Frame 850 (66 bytes on wire, 66 bytes captured)
Ethernet II, Src: 00:11:2f:e2:46:b1, Dst: 00:14:bf:36:c9:39
Internet Protocol, Src Addr: 192.168.1.2 (192.168.1.2), Dst Addr: 66.60.128.30 (66.60.128.30)
Transmission Control Protocol, Src Port: 1064 (1064), Dst Port: http (80), Seq: 857, Ack: 691790, Len: 0

No. Time Source Destination Protocol Info
851 42.719554 66.60.128.30 192.168.1.2 HTTP Continuation or non-HTTP traffic

Frame 851 (1364 bytes on wire, 1364 bytes captured)
Ethernet II, Src: 00:14:bf:36:c9:39, Dst: 00:11:2f:e2:46:b1
Internet Protocol, Src Addr: 66.60.128.30 (66.60.128.30), Dst Addr: 192.168.1.2 (192.168.1.2)
Transmission Control Protocol, Src Port: http (80), Dst Port: 1064 (1064), Seq: 695720, Ack: 857, Len: 1310
Hypertext Transfer Protocol


No. Time Source Destination Protocol Info
852 42.719566 192.168.1.2 66.60.128.30 TCP [TCP Dup ACK 848#2] 1064 > http [ACK] Seq=857 Ack=691790 Win=65535 Len=0 SLE=694410 SRE=697030

Frame 852 (66 bytes on wire, 66 bytes captured)
Ethernet II, Src: 00:11:2f:e2:46:b1, Dst: 00:14:bf:36:c9:39
Internet Protocol, Src Addr: 192.168.1.2 (192.168.1.2), Dst Addr: 66.60.128.30 (66.60.128.30)
Transmission Control Protocol, Src Port: 1064 (1064), Dst Port: http (80), Seq: 857, Ack: 691790, Len: 0

No. Time Source Destination Protocol Info
853 42.761548 66.60.128.30 192.168.1.2 HTTP Continuation or non-HTTP traffic

Frame 853 (1364 bytes on wire, 1364 bytes captured)
Ethernet II, Src: 00:14:bf:36:c9:39, Dst: 00:11:2f:e2:46:b1
Internet Protocol, Src Addr: 66.60.128.30 (66.60.128.30), Dst Addr: 192.168.1.2 (192.168.1.2)
Transmission Control Protocol, Src Port: http (80), Dst Port: 1064 (1064), Seq: 697030, Ack: 857, Len: 1310
Hypertext Transfer Protocol

No. Time Source Destination Protocol Info
854 42.761561 192.168.1.2 66.60.128.30 TCP [TCP Dup ACK 848#3] 1064 > http [ACK] Seq=857 Ack=691790 Win=65535 Len=0 SLE=694410 SRE=698340

Frame 854 (66 bytes on wire, 66 bytes captured)
Ethernet II, Src: 00:11:2f:e2:46:b1, Dst: 00:14:bf:36:c9:39
Internet Protocol, Src Addr: 192.168.1.2 (192.168.1.2), Dst Addr: 66.60.128.30 (66.60.128.30)
Transmission Control Protocol, Src Port: 1064 (1064), Dst Port: http (80), Seq: 857, Ack: 691790, Len: 0

No. Time Source Destination Protocol Info
855 42.765569 66.60.128.30 192.168.1.2 HTTP Continuation or non-HTTP traffic

Frame 855 (1364 bytes on wire, 1364 bytes captured)
Ethernet II, Src: 00:14:bf:36:c9:39, Dst: 00:11:2f:e2:46:b1
Internet Protocol, Src Addr: 66.60.128.30 (66.60.128.30), Dst Addr: 192.168.1.2 (192.168.1.2)
Transmission Control Protocol, Src Port: http (80), Dst Port: 1064 (1064), Seq: 691790, Ack: 857, Len: 1310
Hypertext Transfer Protocol


----------

