[SOLVED] Internet goes down every 5 or so minutes, recoverable only on reboot.

supermega

What about your hardware ?

In your other thread (http://forum.pfsense.org/index.php/topic,63636.0.html) I saw that you have a Broadcom NIC.

Have a look at this doc: http://doc.pfsense.org/index.php/Tuning_and_Troubleshooting_Network_Cards

zenny

I have already tuned the necessary parameters for bge and em drivers in loader.conf.local as stated in the link (http://doc.pfsense.org/index.php/Tuning_and_Troubleshooting_Network_Cards) immediately after post-install, and yet the problem persists.

About the hw I installed is a dual-core P4 3.2Ghz machine with 1.5GB of RAM with 3 interfaces 1 bge (broadcom) and two em's (intel)

wallabybob

It would be helpful to me to see an extract of the pfsense log from a bit before the WAN link goes "down" to a couple of minutes afterwards.

zenny

@wallabybob:

It would be helpful to me to see an extract of the pfsense log from a bit before the WAN link goes "down" to a couple of minutes afterwards.

Find attached the curtailed filter.log (renamed to filterDOTlog.txt)

FYI, upgraded to 20130622 build of pfSense 2.1-RC0. My network looks like this:

WAN (wan) -> bge0 -> v4: 192.168.1.50/24
LAN (lan) -> em0 -> v4: 192.168.27.1/24
DMZ (opt1) -> em1 -> v4: 10.10.27.1/24

Appreciate for any inputs to overcome this problem. Thanks!

filterDOTlog.txt

wallabybob

Did I miss something? Why the filter log rather than the pfSense system log? (The system log can be displayed by pfSense shell command```
clog /var/log/system.log


Can you give more details of what you mean by _WAN interface remains active all the time, but drops the connection_. Is this your description of some sequence of system log entries? Some behaviour observed on a system connected to the pfSense LAN interface? …

zenny

@wallabybob:

Did I miss something? Why the filter log rather than the pfSense system log? (The system log can be displayed by pfSense shell command```
clog /var/log/system.log

You didn't miss anything, but that was my misunderstanding.

Find attached the system.log (systemDOTlog.txt, just of today else too large) for your perusal.

Can you give more details of what you mean by WAN interface remains active all the time, but drops the connection. Is this your description of some sequence of system log entries? Some behaviour observed on a system connected to the pfSense LAN interface? …

What I meant was both LAN and WAN interfaces remain 'green' (or say 'ifconfig bge0 up'), but internet connection drops. The WAN gets IP from the modem. The leased IP remains active, but internet fails every couple of minutes.

systemDotlog.txt

raclure

I saw this in your logs :

Jun 23 15:00:39 pfSense0 kernel: arp: 00:0e:08:cb:33:c0 is using my IP address 192.168.1.50 on bge0!

To mee, it's seems like same ip is use twice on the same network, leading to your problem.

zenny

@raclure:

I saw this in your logs :

Jun 23 15:00:39 pfSense0 kernel: arp: 00:0e:08:cb:33:c0 is using my IP address 192.168.1.50 on bge0!

To mee, it's seems like same ip is use twice on the same network, leading to your problem.

Thanks for the pointer. The ARP table

IP address MAC address Hostname Interface
192.168.27.1 00:07:e9:0e:c0:4f pfSense0 LAN
192.168.27.150 00:26:6c:77:88:40 toshiba0 LAN
10.10.27.1 00:07:e9:0e:c0:3f DMZ
192.168.1.1 00:22:07:14:90:7f WAN
192.168.1.50 00:11:85:0e:84:2e WAN

How on earth the phantom MAC (00:0e:08:cb:33:c0) occupied the same IP? AFAIK there is not other device that occupied that address. How can it be solved?
UPDATE0: Maybe this could be the reason WAN connection frequently drops. Just a while ago I noticed in the dashboard that there is a crash report (several times within half an hour) reportedly due to a bug in pfSense. It first shows the first screenshot and then the details are found in the second screenshot as follows:

Diagnostics: Crash reporter help

Unfortunately we have detected a programming bug.

Would you like to submit the programming debug logs to the pfSense developers for inspection?

Please double check the contents to ensure you are comfortable sending this information before clicking Yes.

Contents of crash reports:

Crash report begins. Anonymous machine information:

i386
8.3-RELEASE-p8
FreeBSD 8.3-RELEASE-p8 #1: Sat Jun 22 15:22:26 EDT 2013 root@snapshots-8_3-i386.builders.pfsense.org:/usr/obj.pfSense/usr/pfSensesrc/src/sys/pfSense_SMP.8

Crash report details:

PHP Errors:
[23-Jun-2013 19:58:43 Europe/Stockholm] PHP Fatal error: Cannot redeclare byte_convert() (previously declared in /usr/local/pkg/backup.inc:35) in
/usr/local/pkg/v_config.inc on line 32

UPDATE1: As per jimp's assumption here (http://forum.pfsense.org/index.php/topic,35827.msg185150.html#msg185150), I removed the Backup package which reportedly conflicted with FreeSwitch. Yet, The internet gets dropped every few minutes. :-(

Status_Dashboard.png_thumb
![Crash reporter.png](/public/imported_attachments/1/Crash reporter.png)
![Crash reporter.png_thumb](/public/imported_attachments/1/Crash reporter.png_thumb)

arad85

@zenny:

How on earth the phantom MAC (00:0e:08:cb:33:c0) occupied the same IP? AFAIK there is not other device that occupied that address. How can it be solved?

Looks to be a Cisco/Linksys box from the first 3 mac numbers.

stephenw10

Indeed, Cicso-Linksys.
Do you have a router/wifi access point that's still trying to route?

Edit: In fact looking at the MAC and using Google I would say there's a high likelihood it's one of these:
http://www.cisco.com/en/US/products/ps10027/index.html

Steve

zenny

@stephenw10:

Indeed, Cicso-Linksys.
Do you have a router/wifi access point that's still trying to route?

Edit: In fact looking at the MAC and using Google I would say there's a high likelihood it's one of these:
http://www.cisco.com/en/US/products/ps10027/index.html

Steve

Yes, I have SPA3201 ATA, but not behind the pfsense box, ahead of it. The network is:

One of the ports of the ADSL router is connected to the pfSense box and another port to the Linksys SPA3210 which connects to a voip server located in another locatioon. And everything behind the pfSense has a different subnet addresses. So why does SPA 3201 try to register to pfSense box which has nothing to do with Linksys/Cisco/Sipura ATA?

After checking out the adsl router, I figured out that the IP I assigned to pfSense is within the DHCP range of the ADSL modem. I changed it and hopefully, it works! Thanks for the pointer.

wallabybob

@zenny:

So why does SPA 3201 try to register to pfSense box which has nothing to do with Linksys/Cisco/Sipura ATA?

That is probably not the issue. At some stage the modem will notice MAC address 00:0e:08:cb:33:c0 has IP address 192.168.1.50. Then data from the Internet that should go to to 192.168.1.50 goes to the SPA rather than the pfSense WAN interface and then systems downstream of pfSense appear to have lost contact with the Internet because they don't get responses to their requests.

zenny

Thanks to all for the pointer. pfSense community is awesome! :D