[SOLVED] Internet goes down every 5 or so minutes, recoverable only on reboot.

zenny · Jun 23, 2013, 12:34 PM

It would be helpful to me to see an extract of the pfsense log from a bit before the WAN link goes "down" to a couple of minutes afterwards.

Find attached the curtailed filter.log (renamed to filterDOTlog.txt)

FYI, upgraded to 20130622 build of pfSense 2.1-RC0. My network looks like this:

WAN (wan) -> bge0 -> v4: 192.168.1.50/24
LAN (lan) -> em0 -> v4: 192.168.27.1/24
DMZ (opt1) -> em1 -> v4: 10.10.27.1/24

Appreciate for any inputs to overcome this problem. Thanks!

filterDOTlog.txt

wallabybob · Jun 23, 2013, 1:45 PM

Did I miss something? Why the filter log rather than the pfSense system log? (The system log can be displayed by pfSense shell command```
clog /var/log/system.log


Can you give more details of what you mean by _WAN interface remains active all the time, but drops the connection_. Is this your description of some sequence of system log entries? Some behaviour observed on a system connected to the pfSense LAN interface? …

zenny · Jun 23, 2013, 2:05 PM

@wallabybob:

Did I miss something? Why the filter log rather than the pfSense system log? (The system log can be displayed by pfSense shell command```
clog /var/log/system.log

You didn't miss anything, but that was my misunderstanding.

Find attached the system.log (systemDOTlog.txt, just of today else too large) for your perusal.

Can you give more details of what you mean by WAN interface remains active all the time, but drops the connection. Is this your description of some sequence of system log entries? Some behaviour observed on a system connected to the pfSense LAN interface? …

What I meant was both LAN and WAN interfaces remain 'green' (or say 'ifconfig bge0 up'), but internet connection drops. The WAN gets IP from the modem. The leased IP remains active, but internet fails every couple of minutes.

systemDotlog.txt

raclure · Jun 23, 2013, 4:19 PM

I saw this in your logs :

Jun 23 15:00:39 pfSense0 kernel: arp: 00:0e:08:cb:33:c0 is using my IP address 192.168.1.50 on bge0!

To mee, it's seems like same ip is use twice on the same network, leading to your problem.

zenny · Jun 23, 2013, 6:48 PM

@raclure:

I saw this in your logs :

Jun 23 15:00:39 pfSense0 kernel: arp: 00:0e:08:cb:33:c0 is using my IP address 192.168.1.50 on bge0!

To mee, it's seems like same ip is use twice on the same network, leading to your problem.

Thanks for the pointer. The ARP table

IP address MAC address Hostname Interface
192.168.27.1 00:07:e9:0e:c0:4f pfSense0 LAN
192.168.27.150 00:26:6c:77:88:40 toshiba0 LAN
10.10.27.1 00:07:e9:0e:c0:3f DMZ
192.168.1.1 00:22:07:14:90:7f WAN
192.168.1.50 00:11:85:0e:84:2e WAN

How on earth the phantom MAC (00:0e:08:cb:33:c0) occupied the same IP? AFAIK there is not other device that occupied that address. How can it be solved?
UPDATE0: Maybe this could be the reason WAN connection frequently drops. Just a while ago I noticed in the dashboard that there is a crash report (several times within half an hour) reportedly due to a bug in pfSense. It first shows the first screenshot and then the details are found in the second screenshot as follows:

Diagnostics: Crash reporter help

Unfortunately we have detected a programming bug.

Would you like to submit the programming debug logs to the pfSense developers for inspection?

Please double check the contents to ensure you are comfortable sending this information before clicking Yes.

Contents of crash reports:

Crash report begins. Anonymous machine information:

i386
8.3-RELEASE-p8
FreeBSD 8.3-RELEASE-p8 #1: Sat Jun 22 15:22:26 EDT 2013 root@snapshots-8_3-i386.builders.pfsense.org:/usr/obj.pfSense/usr/pfSensesrc/src/sys/pfSense_SMP.8

Crash report details:

PHP Errors:
[23-Jun-2013 19:58:43 Europe/Stockholm] PHP Fatal error: Cannot redeclare byte_convert() (previously declared in /usr/local/pkg/backup.inc:35) in
/usr/local/pkg/v_config.inc on line 32

UPDATE1: As per jimp's assumption here (http://forum.pfsense.org/index.php/topic,35827.msg185150.html#msg185150), I removed the Backup package which reportedly conflicted with FreeSwitch. Yet, The internet gets dropped every few minutes. :-(

![Crash reporter.png](/public/imported_attachments/1/Crash reporter.png)
![Crash reporter.png_thumb](/public/imported_attachments/1/Crash reporter.png_thumb)

arad85 · Jun 23, 2013, 7:22 PM

@zenny:

How on earth the phantom MAC (00:0e:08:cb:33:c0) occupied the same IP? AFAIK there is not other device that occupied that address. How can it be solved?

Looks to be a Cisco/Linksys box from the first 3 mac numbers.

stephenw10 · Jun 23, 2013, 7:44 PM

Indeed, Cicso-Linksys.
Do you have a router/wifi access point that's still trying to route?

Edit: In fact looking at the MAC and using Google I would say there's a high likelihood it's one of these:
http://www.cisco.com/en/US/products/ps10027/index.html

Steve

zenny · Jun 23, 2013, 8:41 PM

@stephenw10:

Indeed, Cicso-Linksys.
Do you have a router/wifi access point that's still trying to route?

Edit: In fact looking at the MAC and using Google I would say there's a high likelihood it's one of these:
http://www.cisco.com/en/US/products/ps10027/index.html

Steve

Yes, I have SPA3201 ATA, but not behind the pfsense box, ahead of it. The network is:

One of the ports of the ADSL router is connected to the pfSense box and another port to the Linksys SPA3210 which connects to a voip server located in another locatioon. And everything behind the pfSense has a different subnet addresses. So why does SPA 3201 try to register to pfSense box which has nothing to do with Linksys/Cisco/Sipura ATA?

After checking out the adsl router, I figured out that the IP I assigned to pfSense is within the DHCP range of the ADSL modem. I changed it and hopefully, it works! Thanks for the pointer.

wallabybob · Jun 23, 2013, 9:39 PM

@zenny:

So why does SPA 3201 try to register to pfSense box which has nothing to do with Linksys/Cisco/Sipura ATA?

That is probably not the issue. At some stage the modem will notice MAC address 00:0e:08:cb:33:c0 has IP address 192.168.1.50. Then data from the Internet that should go to to 192.168.1.50 goes to the SPA rather than the pfSense WAN interface and then systems downstream of pfSense appear to have lost contact with the Internet because they don't get responses to their requests.

zenny · Jun 24, 2013, 8:59 AM

Thanks to all for the pointer. pfSense community is awesome! :D