Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    CP per use bandwidth breaks downloads

    Scheduled Pinned Locked Moved Captive Portal
    16 Posts 4 Posters 5.8k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • A
      anotherUser
      last edited by

      2011 07 27 same was occuring 2011 07 26

      1 Reply Last reply Reply Quote 0
      • E
        eri--
        last edited by

        Can you provide the output of
        ipfw show
        ipfw table all list
        ipfw pipe show <- This should be aviable even at Diagnostic->Limiter Info

        1 Reply Last reply Reply Quote 0
        • A
          anotherUser
          last edited by

          
          $ ipfw show
          65291    0       0 allow pfsync from any to any
          65292    0       0 allow carp from any to any
          65301  568   24374 allow ip from any to any layer2 mac-type 0x0806
          65302    0       0 allow ip from any to any layer2 mac-type 0x888e
          65303    0       0 allow ip from any to any layer2 mac-type 0x88c7
          65304    0       0 allow ip from any to any layer2 mac-type 0x8863
          65305    0       0 allow ip from any to any layer2 mac-type 0x8864
          65306    0       0 allow ip from any to any layer2 mac-type 0x888e
          65307    0       0 deny ip from any to any layer2 not mac-type 0x0800
          65310  872  117583 allow ip from any to { 255.255.255.255 or 192.168.0.1 } in
          65311 1107  303893 allow ip from { 255.255.255.255 or 192.168.0.1 } to any out
          65312    0       0 allow icmp from { 255.255.255.255 or 192.168.0.1 } to any out icmptypes 0
          65313    0       0 allow icmp from any to { 255.255.255.255 or 192.168.0.1 } in icmptypes 8
          65314    0       0 allow ip from table(3) to any in
          65315    0       0 allow ip from any to table(4) out
          65316    0       0 pipe tablearg ip from table(5) to any in
          65317    0       0 pipe tablearg ip from any to table(6) out
          65318    0       0 allow ip from any to table(7) in
          65319    0       0 allow ip from table(8) to any out
          65320    0       0 pipe tablearg ip from any to table(9) in
          65321    0       0 pipe tablearg ip from table(10) to any out
          65322 1969  256149 pipe tablearg ip from table(1) to any in
          65323 1414 1117851 pipe tablearg ip from any to table(2) out
          65531  180   20706 fwd 127.0.0.1,8000 tcp from any to any in
          65532  164   30372 allow tcp from any to any out
          65533 5493  285966 deny ip from any to any
          65534    0       0 allow ip from any to any layer2
          65535    0       0 allow ip from any to any
          
          
          
          $ ipfw table all list
          ---table(1)---
          192.168.1.4/32 mac f0:de:f1:04:50:77 20002
          ---table(2)---
          192.168.1.4/32 mac f0:de:f1:04:50:77 20003
          
          
          
          $ ipfw pipe show
          20002:  64.000 Kbit/s    0 ms burst 0 
          q151074 100 sl. 0 flows (1 buckets) sched 85538 weight 0 lmax 0 pri 0 droptail
           sched 85538 type FIFO flags 0x0 0 buckets 0 active
          20003: 128.000 Kbit/s    0 ms burst 0 
          q151075 100 sl. 0 flows (1 buckets) sched 85539 weight 0 lmax 0 pri 0 droptail
           sched 85539 type FIFO flags 0x0 0 buckets 0 active
          
          
          1 Reply Last reply Reply Quote 0
          • A
            anotherUser
            last edited by

            I have also tried the same install and manually created be traffic shaper using Limiter instead of the captive portal version but the same thing occurs.

            1 Reply Last reply Reply Quote 0
            • E
              eri--
              last edited by

              At the speeds you show there surely it will give your issues :)

              1 Reply Last reply Reply Quote 0
              • A
                anotherUser
                last edited by

                I wouldn't think that speed limiting alone would cause it. These speeds are actually a little faster than an MS Threat Management Gateway install I have at another site and these issues are not happening there.

                It's a real shame as this is for site wide public WiFi so I obviously can't allow unlimited internet speed. I would expect it to be used mostly for general browsing but if someone wanted to wait five minutes to watch a 20 second movie that would be fine.

                I went to the google speed test page (http://www.youtube.com/my_speed#) and it showed that it was downloading as I would expect at 100 kbps, then after around one minute of download time it simply stopped downloading. The same behaviour is exhibited in IE and Firefox using the latest flash player. Vimeo also does the same thing.

                Downloading a large file in IE also fails. It will run at 15 kB/s as expected then falls over at around the 2 minute mark with less than 2MB downloaded. The download manager in Firefox seems to keep the download going.

                Edit: Firefox also fails

                1 Reply Last reply Reply Quote 0
                • E
                  eri--
                  last edited by

                  Can you get a packet dump on this interface to see what is the issue?

                  1 Reply Last reply Reply Quote 0
                  • A
                    anotherUser
                    last edited by

                    Ok, here are the captures from the end of the conversation when a youtube video died. (both .pcap files renamed to .txt)

                    I am trying to remember network protocols and services 101! Do I need another capture client-LAN in order to get enough info? Does this give anyone any clues?

                    WAN.txt
                    Client.txt

                    1 Reply Last reply Reply Quote 0
                    • M
                      Metu69salemi
                      last edited by

                      Firewall is between networks so it has allready enough information in usual cases

                      1 Reply Last reply Reply Quote 0
                      • A
                        anotherUser
                        last edited by

                        If I do a capture on the WAN interface when NOT using the speed limiter, there are no TCP Zero Window packets, just the occasional ACK error and TCP window update packet. When using the speed limiter there are quite a few Zero Window packets and when the videos fail the connection is in this state, often seemingly waiting on a keep alive packet.

                        Once again, my knowledge is not very good with this level of protocol examination, so much of that is just speculation…

                        Updated to the latest snaps today.

                        1 Reply Last reply Reply Quote 0
                        • E
                          eri--
                          last edited by

                          It seems that pcaps are not good.
                          Can you do again.

                          Btw do you have any kind of proxy installed? Squid?

                          Also i need the capture on the LAN side as well.

                          1 Reply Last reply Reply Quote 0
                          • A
                            anotherUser
                            last edited by

                            Thank you for looking. I am not sure what happened with the pcaps failing. This time the pcaps are in a .zip file, renamed to txt.

                            Yes - I am using squid with squid guard in transparent mode.

                            EDIT - That upload seems to have failed as well. I have added to megaupload - http://www.megaupload.com/?d=JIMAZBM0

                            captures.txt

                            1 Reply Last reply Reply Quote 0
                            • A
                              anotherUser
                              last edited by

                              Update:

                              This error is not related to captive portal speed limiting. Today,thinking the rl0 driver may be causing problems, I created a new install on new hardware, this time using AMD64. I tested at every step and found that the limiter works fine until squid is installed, and then the errors occur. If the client IP bypasses squid it will still work, so it is the squid package that is causing the issue.

                              Packet captures reveal that when a client is using squid the WAN link starts to get TCP Zero Window problems. I will start a new thread in the Packages forum with these findings.

                              New thread: http://forum.pfsense.org/index.php/topic,39554.0.html

                              1 Reply Last reply Reply Quote 0
                              • M
                                Mogli
                                last edited by

                                Having the same problems on pfSense 2.0 RC3 (using the pfSense-2.0-RC3-1g-i386-20110621-1821-nanobsd.img.gz Image).

                                Per-user-bandwith restriction set to 200kbit/s.
                                Captive portal is loading, I login using username and password, it authenticates me (listed on status page), redirect times out. No site is loading.

                                restriction is turned off:
                                Redirect works like a charm.

                                I'm not using squid, so I don't think it's the problem here.

                                1 Reply Last reply Reply Quote 0
                                • First post
                                  Last post
                                Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.