Strange network drop for 1 minute every hour

johnpoz

I agree managed switches most likely have a log, and can log up down on interfaces, etc. But these like $40 smart switches that can do vlans most likely not - at least not that are of much worth. Like up down logging of interfaces..

Looking at my tplink - I can not find any logs anywhere in it.. But my cisco

12-Jul-2023 23:16:59 :%LINK-I-Up:  gi10
 
12-Jul-2023 23:16:58 :%LINK-W-Down:  gi10

As example of up down logging.. plus lots of other good info, etc.

cforker

Hi fireodo,

I did that and pretty soon I could exclude that because the schedule is moving up every hour with 1 or 2 seconds. So if it is 12:10 today when this is happening, in a view days it could already be 12:12. The schedule is moving so this is not CRON.

Many thanks anyway for your quick reply :-)

cforker

Hi Gertjan,

Nope, not using Wifi. I have my Cisco Switches linked on fibre optic. Pinging them will be fine so no issue here. It is either fibre optic or Cat 6 cabling. Testing the cables also shows that everything is fine. No issue there either. When pinging I have several terminals open logging the pings into a textile. One is pinging 192.168.1.1. the other 8.8.4.4 and the rest all the swichtes (including the one where my PfSense is on. Pfsense and 8.8.4.4 are not pingable at the moment of issue. Also forgot to mention the schedule of the "distortion" is moving up with one or two seconds every hour. Meaning that when an error happens at 12:10 today, in two days it will be 12:11 or even 12:12.

T-Mobile is saying that everything is in order, and yes, that would not explain why my LAN is going down every hour for a couple of seconds (45-90 seconds). They wanted to do more investigations but stoped as someone mentioned that I have more than 100 devices in my network. They multiply every device with 10mbit and suggested upgrading. But 100/100 is the max I can get here and my out or input is really higher then 60 mbit with could not explain this behaviour. Anyway explaining some ***** no tech guy how things are working was a wast of time and I stoped communicating with them as they wouldn't help me any further.

Yes, a better switch has logs. You can find a lot in there especially if T-Mobile is doing settings on their fibre-optic end. But no, nothing in here which could give me any indication of what is going on. From this log I found out that traffic is incoming on the fibre-optic side into the lan side via Pfsense. So in is working at the down-time, but out is not working. I only yous V-Lans for the incoming side to separate 300 (internet) and 640 (TV) from the fibre-optic. Internally I do not use any V-lans. I have replaced the switches but then again they should also indicate sorting in their logs or go down as well, which they are not. Cisco is quite reliable with this.

Not sure what you mean "can not ping the hostname", but when everything is up I can ping the hostname and the ip adres of Pfsense. I also can ping any external adres (if not dropped). During the outage I'm not able to ping IP nor Hostname, and of course any outside adres as well.

Cheers,

Chris

Gertjan

@cforker

I still want to see the pfSense logs I mentioned above.
Interfaces going down is a hefty event. That will get logged, even if it was the device on the other side to the NIC that brought down the connection.
And if the source of the issue was on the pfSense side (example : like snort or suricata restarting on a LAN interface) then the system log would show that right away.

So, as always : where are the logs ? ?

stephenw10

~1h with a few seconds incrementing sounds a lot like it could be DHCP lease renewal. That shouldn't drop the link unless the server is somehow passing an invalid lease time or similar.
Check the dhcp and system logs.

Steve

johnpoz

@stephenw10 I was going to say the same thing.. Does sound like maybe a dhcp problem lease expires, has to do a discover this would had a few seconds to the process, etc.

cforker

Hi Gertjan,

as you mentioned, doing a tail on the system.log, has revealed itself!

There was a little entry saying:

09:18:28 proxy kernel: arp: ec:0b:ae:9f:1b:8f is using my IP address 192.168.1.1 on em0!

After a little track and trace of this arp address, I found out that the evil of all that is my Airco! In there is a Wifi Module with that exact address. I disabled it from accessing the wifi access points and voila, no disruption in my network anymore!

Question now remains why a remote wifi module is trying to take over my Pfsense address. But that is not for this forum anymore.

Thank you for putting me into the right direction. I'm very thankful for that as it drove me crazy. Sometimes you just need someones perspective to find the right solution.

Again many thanks all for helping me out here.

Cheers,

Chris

Gertjan

@cforker said in Strange network drop for 1 minute every hour:

Question now remains why a remote wifi module is trying to take over my Pfsense address

Easy to solve.
It's pretty obvious the airco isn't using DHCP, as the DHCP server in the network (pfSense) would not give its own 192.168.1.1.

So, set up a PC using 192.168.1.2 mask 255.255.255.0 DNS : don't care and gateway don't care.

remove the link bewten the AP and pfSense.
Now, have the airco connecto using wifi to the AP.
Connect the PC to the AP.
Now, on your PC, you can access the airco's GUI.
Active the airco's DHCP mode.

Restore DHCP on your PC.
Re connect the AP to pfSense.
Check pfsense DHCP server LAN that the airco - you know its ec:0b:ae:9f:1b:8f - gets an IP from the DHCP server.

Your good for the next issue.

Btw : if the airco can't use other IP settings, and it can only use "192.168.1.1" : throw it out of the windows. Please mention type and brand : this one can't be called 'connected' as it is a network destroyer.

09:18:28 proxy kernel: arp: ec:0b:ae:9f:1b:8f is using my IP address 192.168.1.1 on em0!

You agree that that line says a lot .... and is easy to read, and understand.
Logs are very useful.

cforker

Hi Gertjan

And this is the problem, because it has 192.168.1.62 assigned. So it is getting a IP from DHCP but somehow it tries to get 192.10.1.1 every 60 minutes and 2 seconds. In my lease table it is assigned and active (not for the moment obviously). Het gaat hier om de Mitsubishi WF-RAC Wifi module . Ik kan hem ook niet via een interface benaderen alleen via een app.

By the way, I assigned a static IP from Pfsense and now it seems to work just fine.

Gr,

Chris

Gertjan

@cforker said in Strange network drop for 1 minute every hour:

Mitsubishi WF-RAC Wifi module

Oh ... great.
I love the Mitsubishi stuff, using two City Line "big towers".
We have this - 18 years old ( yep, the system just won't die ...) and it uses a 10 Mbit /sec half duplex.
But it uses a DHCP client that behaves well.
No IPv6 of course.

Btw : critical stuff like coffee machine, airco, credit card machines etc should never use wifi - but I say that because I'm old(er) and think I saw a lot ^^

@cforker said in Strange network drop for 1 minute every hour:

192.10.1.1 every 60 minutes and 2 seconds

192.10.1.1 who /what is that ? It's a valid IP somewhere in the states.

Is it the airco that wants to call 'home' ?
It can't be DHCP ....

johnpoz

@Gertjan said in Strange network drop for 1 minute every hour:

192.10.1.1 who /what is that ?

NetRange:       192.10.0.0 - 192.10.255.255
CIDR:           192.10.0.0/16
NetName:        AMAZO-4
Organization:   Amazon.com, Inc. (AMAZO-4)

stephenw10

I'm assuming that was a typo.