Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    [SOLVED] Internet goes down every 5 or so minutes, recoverable only on reboot.

    Scheduled Pinned Locked Moved 2.1 Snapshot Feedback and Problems - RETIRED
    14 Posts 6 Posters 7.8k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • W
      wallabybob
      last edited by

      It would be helpful to me to see an extract of the pfsense log from a bit before the WAN link goes "down" to a couple of minutes afterwards.

      1 Reply Last reply Reply Quote 0
      • Z
        zenny
        last edited by

        @wallabybob:

        It would be helpful to me to see an extract of the pfsense log from a bit before the WAN link goes "down" to a couple of minutes afterwards.

        Find attached the curtailed filter.log (renamed to filterDOTlog.txt)

        FYI, upgraded to 20130622 build of pfSense 2.1-RC0. My network looks like this:

        WAN (wan)      -> bge0      -> v4: 192.168.1.50/24
        LAN (lan)      -> em0        -> v4: 192.168.27.1/24
        DMZ (opt1)      -> em1        -> v4: 10.10.27.1/24

        Appreciate for any inputs to overcome this problem. Thanks!

        filterDOTlog.txt

        1 Reply Last reply Reply Quote 0
        • W
          wallabybob
          last edited by

          Did I miss something? Why the filter log rather than the pfSense system log? (The system log can be displayed by pfSense shell command```
          clog /var/log/system.log

          
Can you give more details of what you mean by _WAN interface remains active all the time, but drops the connection_. Is this your description of some sequence of system log entries? Some behaviour observed on a system connected to the pfSense LAN interface? …
          1 Reply Last reply Reply Quote 0
          • Z
            zenny
            last edited by

            @wallabybob:

            Did I miss something? Why the filter log rather than the pfSense system log? (The system log can be displayed by pfSense shell command```
            clog /var/log/system.log

            You didn't miss anything, but that was my misunderstanding.

            Find attached the system.log (systemDOTlog.txt, just of today else too large) for your perusal.

            Can you give more details of what you mean by WAN interface remains active all the time, but drops the connection. Is this your description of some sequence of system log entries? Some behaviour observed on a system connected to the pfSense LAN interface? …

            What I meant was both LAN and WAN interfaces remain 'green' (or say 'ifconfig bge0 up'), but internet connection drops. The WAN gets IP from the modem. The leased IP remains active, but internet fails every couple of minutes.

            systemDotlog.txt

            1 Reply Last reply Reply Quote 0
            • R
              raclure
              last edited by

              I saw this in your logs :

              Jun 23 15:00:39 pfSense0 kernel: arp: 00:0e:08:cb:33:c0 is using my IP address 192.168.1.50 on bge0!

              To mee, it's seems like same ip is use twice on the same network, leading to your problem.

              1 Reply Last reply Reply Quote 0
              • Z
                zenny
                last edited by

                @raclure:

                I saw this in your logs :

                Jun 23 15:00:39 pfSense0 kernel: arp: 00:0e:08:cb:33:c0 is using my IP address 192.168.1.50 on bge0!

                To mee, it's seems like same ip is use twice on the same network, leading to your problem.

                Thanks for the pointer. The ARP table

                IP address       MAC address       Hostname Interface
                192.168.27.1 00:07:e9:0e:c0:4f pfSense0 LAN
                192.168.27.150 00:26:6c:77:88:40 toshiba0 LAN
                10.10.27.1   00:07:e9:0e:c0:3f        DMZ
                192.168.1.1 00:22:07:14:90:7f        WAN
                192.168.1.50 00:11:85:0e:84:2e        WAN

                How on earth the phantom MAC (00:0e:08:cb:33:c0) occupied the same IP? AFAIK there is not other device that occupied that address. How can it be solved?
                UPDATE0: Maybe this could be the reason WAN connection frequently drops. Just a while ago I noticed in the dashboard that there is a crash report (several times within half an hour) reportedly due to a bug in pfSense. It first shows the first screenshot and then the details are found in the second screenshot as follows:

                Diagnostics: Crash reporter help

                Unfortunately we have detected a programming bug.

                Would you like to submit the programming debug logs to the pfSense developers for inspection?

                Please double check the contents to ensure you are comfortable sending this information before clicking Yes.
                                                                                       
                Contents of crash reports:

                Crash report begins.  Anonymous machine information:

                i386
                8.3-RELEASE-p8
                FreeBSD 8.3-RELEASE-p8 #1: Sat Jun 22 15:22:26 EDT 2013     root@snapshots-8_3-i386.builders.pfsense.org:/usr/obj.pfSense/usr/pfSensesrc/src/sys/pfSense_SMP.8

                Crash report details:

                PHP Errors:
                [23-Jun-2013 19:58:43 Europe/Stockholm] PHP Fatal error:  Cannot redeclare byte_convert() (previously declared in /usr/local/pkg/backup.inc:35) in
                /usr/local/pkg/v_config.inc on line 32

                UPDATE1: As per jimp's assumption here (http://forum.pfsense.org/index.php/topic,35827.msg185150.html#msg185150), I removed the Backup package which reportedly conflicted with FreeSwitch. Yet, The internet gets dropped every few minutes. :-(

                Status_Dashboard.png
                Status_Dashboard.png_thumb
                ![Crash reporter.png](/public/imported_attachments/1/Crash reporter.png)
                ![Crash reporter.png_thumb](/public/imported_attachments/1/Crash reporter.png_thumb)

                1 Reply Last reply Reply Quote 0
                • A
                  arad85
                  last edited by

                  @zenny:

                  How on earth the phantom MAC (00:0e:08:cb:33:c0) occupied the same IP? AFAIK there is not other device that occupied that address. How can it be solved?

                  Looks to be a Cisco/Linksys box from the first 3 mac numbers.

                  1 Reply Last reply Reply Quote 0
                  • stephenw10S
                    stephenw10 Netgate Administrator
                    last edited by

                    Indeed, Cicso-Linksys.
                    Do you have a router/wifi access point that's still trying to route?

                    Edit: In fact looking at the MAC and using Google I would say there's a high likelihood it's one of these:
                    http://www.cisco.com/en/US/products/ps10027/index.html

                    Steve

                    1 Reply Last reply Reply Quote 0
                    • Z
                      zenny
                      last edited by

                      @stephenw10:

                      Indeed, Cicso-Linksys.
                      Do you have a router/wifi access point that's still trying to route?

                      Edit: In fact looking at the MAC and using Google I would say there's a high likelihood it's one of these:
                      http://www.cisco.com/en/US/products/ps10027/index.html

                      Steve

                      Yes, I have SPA3201 ATA, but not behind the pfsense box, ahead of it. The network is:

                      One of the ports of the ADSL router is connected to the pfSense box and another port to the Linksys SPA3210 which connects to a voip server located in another locatioon. And everything behind the pfSense has a different subnet addresses. So why does SPA 3201 try to register to pfSense box which has nothing to do with Linksys/Cisco/Sipura ATA?

                      After checking out the adsl router, I figured out that the IP I assigned to pfSense is within the DHCP range of the ADSL modem. I changed it and hopefully, it works! Thanks for the pointer.

                      1 Reply Last reply Reply Quote 0
                      • W
                        wallabybob
                        last edited by

                        @zenny:

                        So why does SPA 3201 try to register to pfSense box which has nothing to do with Linksys/Cisco/Sipura ATA?

                        That is probably not the issue. At some stage the modem will notice MAC address 00:0e:08:cb:33:c0 has IP address 192.168.1.50. Then data from the Internet that should go to to 192.168.1.50 goes to the SPA rather than the pfSense WAN interface and then systems downstream of pfSense appear to have lost contact with the Internet because they don't get responses to their requests.

                        1 Reply Last reply Reply Quote 0
                        • Z
                          zenny
                          last edited by

                          Thanks to all for the pointer. pfSense community is awesome! :D

                          1 Reply Last reply Reply Quote 0
                          • First post
                            Last post
                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.