Hi all, pardon the engels, I am seeing the weirdest latency spikes to my new Zyxel T-56 modem, from devices directly attached to it.Â
64 bytes from 192.168.1.1: icmp_seq=12 ttl=64 time=0.555 ms 64 bytes from 192.168.1.1: icmp_seq=13 ttl=64 time=0.533 ms 64 bytes from 192.168.1.1: icmp_seq=14 ttl=64 time=516 ms 64 bytes from 192.168.1.1: icmp_seq=15 ttl=64 time=0.578 ms 64 bytes from 192.168.1.1: icmp_seq=16 ttl=64 time=210 ms 64 bytes from 192.168.1.1: icmp_seq=17 ttl=64 time=0.568 ms
Â
If I run a tcpping to google.com , so that is now LAN to WAN, and not just LAN to router.Â
Â
255 Â ams16s37-in-f14.1e100.net (172.217.23.206) Â 6.677 ms 255 Â ams16s37-in-f14.1e100.net (172.217.23.206) Â 7.382 ms 255 Â ams16s37-in-f14.1e100.net (172.217.23.206) Â 554.650 ms 255 Â ams16s37-in-f14.1e100.net (172.217.23.206) Â 7.165 ms 255 Â ams16s37-in-f14.1e100.net (172.217.23.206) Â 6.706 ms 255 Â ams16s37-in-f14.1e100.net (172.217.23.206) Â 6.652 ms 255 Â ams16s37-in-f14.1e100.net (172.217.23.206) Â 6.536 ms 255 Â ams16s37-in-f14.1e100.net (172.217.23.206) Â 7.220 ms
Â
I see the same thing?
This is weird how it gets these spikes, on LAN being directly attached I would expect to see max maybe 2ms. Not 516ms. Is this router getting overloaded, or is the hardware just kinda cheap?Â
Bladzijde 2 / 2
Hey @ChaosMonkey, I've messaged @Sven-Odido to take a look at your connection but he can't see anything at the moment because the MikroTik is connected. Could you connect the Zyxel and take out the MikroTik in between? Then we can check the connection!
Hey @ChaosMonkey, I've messaged @Sven-Odido to take a look at your connection but he can't see anything at the moment because the MikroTik is connected. Could you connect the Zyxel and take out the MikroTik in between? Then we can check the connection!
Hi @Tommie van Odido , well yes I unplugged the Zyxel because I want a stable connection. I have reconnected the Zyxel now. It was barely 30 seconds since it got a new IP address, and I moved from .118 to a .120 subnet and immediately I see thisÂ
@Sven-Odido you can have a look now, maybe we need a faster way to communicate, because these attacks come the moment this router turns on
Hi @Tommie van Odido ,Â
Â
Odido connects with smardc to the AMS-IX right? If I do a traceroute to 9.9.9.9 I see the same IP address twice. And it’s always when it goes from your 10.10.10.x range to the 80.249.x.x range where the latency spikes happen. (When the router isn’t being attacked and failing) . When I do a traceroute to 8.8.8.8 (google) it doesn’t seem to run through the AMS-IX , and the ping is a lot more stable. Maybe there is an issue with your connection and routing at AMS-IX?Â
Â
@Sven-Odido you can have a look now, maybe we need a faster way to communicate, because these attacks come the moment this router turns on
I havent had time yet to dive into this. When a lot of port scans etc are happening at the same time its normal to see a slight increase in latency for a few pings. But not the amount you are seeing. I will have to look more into that when I have more time on my hands, Sorry for the inconvenience.
Also keep in mind that when a lot of ICMP pings are sent by one host, the DOS protection on the T56 will kick in as well.Â
@Sven-Odido you can have a look now, maybe we need a faster way to communicate, because these attacks come the moment this router turns on
I havent had time yet to dive into this. When a lot of port scans etc are happening at the same time its normal to see a slight increase in latency for a few pings. But not the amount you are seeing. I will have to look more into that when I have more time on my hands, Sorry for the inconvenience.
Also keep in mind that when a lot of ICMP pings are sent by one host, the DOS protection on the T56 will kick in as well.Â
Not a problem, would it then be okay if I swap back to the mikrotik and only switch to the T56 when you have some time?Â
Â
I am curious ipv6 needs ICMP in order to work, is the T56 DoS protection setup in a way that it would allow that without raising any flags? It seems to only trigger on the ICMP request count number, so if you ping and stop and ping and stop it seems to not flag it.Â
Not a problem, would it then be okay if I swap back to the mikrotik and only switch to the T56 when you have some time? ​​​
Yess Of course, I will let you know when the T56 need to be connected again.Â
Â
@Sven-Odido Well I think I found the cause of my latency variation. Interesting that the route doing hit this exchange or IP when going to google. It seems your interconnect (well I am guessing it’s the interconnect) is overloaded, perhaps old or buggy firmware?Â
Have a look at these ping results, I took it on my router as well. So then there is nothing in the path that can cause any issues.Â
Â
Â
To my knowledge, with fibre, this should never be the case. It’s normal to see a hop in between have packet loss but if the latency goes up from that hop and travels onwards, then that hop is the issue.Â
An avg of 18ms, that puts me somewhere close to Mora in Mydrid. Already I am sitting at 6ms for 30km, when the avg for fibre is 1ms per 100km. Which is already a bit high.Â
I dont have any insights in that part of the network. Im still looking into the spike happening when the port scans are happening.Â
Â
Â
@ChaosMonkey Did you ever end up resolving this issue? Me and some others are experienceing ur same issue.
@ChaosMonkey Did you ever end up resolving this issue? Me and some others are experienceing ur same issue.
@pockeyhock yes, I managed to get a very stable ping by ditching the Odido provided router.
Do you also have the new T56, did you try disabling/enable the DoS protection? Does your latency also bounce around and on occasion the connection drops? Â
Â
What appeared to be the cause of my latency spikes, was patched out from causing issues in the linux kernel long ago. Also to note the logs weren’t so great when it came to seeing what the cause was, gaining full console access, via UART/SSH, could probably give a better idea of what is going on.
Â
@Sven-Odido , seems this could be a common problem then?
@ChaosMonkey Did you ever end up resolving this issue? Me and some others are experienceing ur same issue.
@pockeyhockyes, I managed to get a very stable ping by ditching the Odido provided router.
Do you also have the new T56, did you try disabling/enable the DoS protection? Does your latency also bounce around and on occasion the connection drops? Â
Â
What appeared to be the cause of my latency spikes, was patched out from causing issues in the linux kernel long ago. Also to note the logs weren’t so great when it came to seeing what the cause was, gaining full console access, via UART/SSH, could probably give a better idea of what is going on.
Â
@Sven-Odido, seems this could be a common problem then?
Personally the connection doesnt drop at all for me. Its very stable and the uptime is great but then every couple minutes i will get 400-600ms latency spikes, yes i tried to disable DoS protection it seemed to work for a bit but ended up falling back to what was happening before. What’s interessting though is that if I disable DoS protection my ping in a certain game would load instantly where as it would take ages before with having DoS protection on. I am not on linux, windows machine here.
Do you not have any latency spikes at all anymore after replacing the t-56? That sounds great. I think truly a firmware patch is needed and a look into what the cause might be to these spikes @Sven-Odido @Tommie van OdidoÂ
Do you not have any latency spikes at all anymore after replacing the t-56? That sounds great. I think truly a firmware patch is needed and a look into what the cause might be to these spikes @Sven-Odido @Tommie van OdidoÂ
Except for some oddness within the AMS-IX data center doing some odd route flip flop at a much higher rate than it should, my latency has been really stable. I used to feel that 200-400ms (600ms at times) latency spikes a lot in games as well. Since disconnecting the T56 I have had none of that. It’s been a month that it has been smooth. Except for that route change that will cause a spike, I don’t see the other constant or high 200-600ms spikes, within a 100 packets sent with a long running ping.
Â
Curious enough, I can disconnect my Mikrotik and connect the T56, and within half an hour I will see the latency spikes. Disconnect the T56 and reconnect my Mikrotik, and boom immediate smooth ping. Same public IP address, or I can force a new one (in both swaps). So it’s not even that it’s an issue with my IP address. It seems to purely be the router. My guess is something is looking for these devices and then trying to do something towards them.
Ive picked up some weird routerlogs aswell toward gameservers, my computer is apparently sending ping of deaths to different servers, if I had to guess there might be something with the firewall configurations on these things, personally scared to disable it and test if i still have the spikes with it off haha. Mostly have these suspicions because of how my ping would load instantly with dos protection off on some games where it took ages to load before, i can only assume it has to do something with security.
Ive picked up some weird routerlogs aswell toward gameservers, my computer is apparently sending ping of deaths to different servers, if I had to guess there might be something with the firewall configurations on these things, personally scared to disable it and test if i still have the spikes with it off haha. Mostly have these suspicions because of how my ping would load instantly with dos protection off on some games where it took ages to load before, i can only assume it has to do something with security.
Is the ping of death originating from your PC from running long pings to check your latency? It’s kind of funny how the router logs pings of death as a security thing, because this was patched in the linux kernel and doesn’t cause issues, so it shouldn’t even feature as some security warning as it can’t harm the device.
I tried to disable the firewall, it didn’t really make an impact at all. I saw port scans and connection attempts to ports that were not open, even with UPnP disabled. While this should be a simple iptables firewall, the CPU seems to get overloaded and then the whole device slows down.
Â
Have a look if your latency also spikes to 400ms if you just run a long ping from your PC to the router.
My setup will allow me to actually help and even Man-In-The-Middle packet capture to inspect what is causing the slowness, but I would also need access to the admin console of the router to get a linux shell to make changes to the core tcp stack and firewall to see how we can address this. If Odido’s policies can allow for this, I am willing to help fix this.
Nothing from my pc to the router, except a 5ms spike that I only saw once, rest of them were all sub 1ms. The issues seem to be strictly when connecting to the actual internet, not LAN. And no idea about the first part to be honest, I just picked up that it flags my computer sending ping of death attacks to multiple gameservers, doesnt seem to be anything else though like google servers or twitch etc...
@ChaosMonkeyÂ
Â
Could you provide some screenshots (can use the ones here with the tests u did strictly with the zyxel). Maybe if we get more people to post it becomes a priority issue and we get a fix soon.
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.
Bestand scannen voor virussen
Sorry, we zijn de inhoud van dit bestand nog aan het controleren om er zeker van te zijn dat het veilig is om te downloaden. Probeer het nog een keer over een paar minuten.
00:0e:00:00:00:04:08:00 SRC=216.131.89.252 DST=5.132.120.x LEN=1500 TOS=0x00 PREC=0x00 TTL=5 ID=0 DF PROTO=UDP SPT=52415 DPT=37207 LEN=1480Â 
