PfSense MTU, Bufferbloat and Netalyzr results

tagit446 · Feb 24, 2018, 4:27 AM

I have noticed alot of lag when trying to play online games such as Call of Duty Black Ops 3 multiplayer. While trying to figure out what could be causing the lag I ran a DSLreports.com speed test and found I am getting massive amounts of bufferbloat on uploads in the range of 500-1700ms. Interestingly download bufferbloat is only 1-10ms which is acceptable. My internet speeds are 24/2mbits

I also did a Netalyzr test from here: http://netalyzr.icsi.berkeley.edu/

In the results something stood out that may be an issue, see below.

"The path between your network and our system supports an MTU of at least 2037 bytes, and the path between our system and your network has an MTU of 552 bytes. The bottleneck is at IP address 172.30.1.206. "

I have a PPPoE connection set on my WAN and have it's MTU set at 1492 and MSS set at 1452. Due to my settings I am confused by the Netalyzr test results. Specifically I am confused by "the path between our system and your network has an MTU of 552 bytes" and "The bottleneck is at IP address 172.30.1.206".

I have no idea where the IP 172.30.1.206 comes from or how to find out as it is a private address. I also have no idea where the 552 MTU is set or how to change it.

Could somebody with a bit of knowledge help me understand how to narrow down the cause of my bufferbloat and also help me find out where the IP 172.30.1.206 is coming from?

If it helps I use pfSense as my firewall, router and DNS resolver.

JKnott · Feb 24, 2018, 12:14 PM

It's means somewhere there's a router with an MTU of 552 bytes, which is very small. The address 172.30.1.206 is within the 172.16.0.0 /12 private address range, but it could be anywhere. You can get an idea where with traceroute.

tagit446 · Feb 24, 2018, 8:13 PM

@JKnott:

It's means somewhere there's a router with an MTU of 552 bytes, which is very small.

Agreed but where? The only router in my home network is my pfSense box.

@JKnott:

The address 172.30.1.206 is within the 172.16.0.0 /12 private address range, but it could be anywhere. You can get an idea where with traceroute.

Ran traceroot with pfSense and got,

 1  10.87.0.1 (10.87.0.1)  18.093 ms  17.771 ms  18.594 ms
 2  64.64.117.1 (64.64.117.1)  18.339 ms  18.170 ms  18.203 ms
 3  ethernet6-1-br2.pnj1.choopa.net (108.61.66.137)  19.032 ms
    ethernet6-1-br1.pnj1.choopa.net (108.61.66.133)  17.802 ms
    ethernet6-1-br2.pnj1.choopa.net (108.61.66.137)  19.281 ms
 4  vl50-er1.pnj1.choopa.net (66.55.144.145)  17.988 ms
    vl24-er2.pnj1.choopa.net (108.61.248.13)  19.497 ms
    vl39-er2.pnj1.choopa.net (66.55.144.150)  22.685 ms
 5  * * *
 6  * * *
 7  * * *
 8  * * *
 9  * * *
10  * * *
11  * * *
12  * * *
13  * * *
14  * * *
15  * * *
16  * * *
17  * * *
18  * * *
19  * * *
20  * * *
21  * * *
22  * * *
23  * * *
24  * * *
25  * * *
26  * * *
27  * * *
28  * * *
29  * * *
30  * * *

Also ran traceroot on my PC and got,

C:\WINDOWS\system32>tracert 172.30.1.206

Tracing route to 172.30.1.206 over a maximum of 30 hops

  1     6 ms     7 ms     6 ms  10.10.10.10
  2     6 ms     6 ms     7 ms  burl-lnk-70-109-168-169.ngn.east.myfairpoint.net [70.109.168.169]
  3    13 ms    13 ms    13 ms  pool-64-222-213-130.port.east.myfairpoint.net [64.222.213.130]
  4     *        *        *     Request timed out.
  5     *        *        *     Request timed out.
  6     *        *        *     Request timed out.
  7     *        *        *     Request timed out.
  8     *        *        *     Request timed out.
  9     *        *        *     Request timed out.
 10     *        *        *     Request timed out.
 11     *        *        *     Request timed out.
 12     *        *        *     Request timed out.
 13     *        *        *     Request timed out.
 14     *        *        *     Request timed out.
 15     *        *        *     Request timed out.
 16     *        *        *     Request timed out.
 17     *        *        *     Request timed out.
 18     *        *        *     Request timed out.
 19     *        *        *     Request timed out.
 20     *        *        *     Request timed out.
 21     *        *        *     Request timed out.
 22     *        *        *     Request timed out.
 23     *        *        *     Request timed out.
 24     *        *        *     Request timed out.
 25     *        *        *     Request timed out.
 26     *        *        *     Request timed out.
 27     *        *        *     Request timed out.
 28     *        *        *     Request timed out.
 29     *        *        *     Request timed out.
 30     *        *        *     Request timed out.

Trace complete.

Doesn't appear that the traceroots are at all revealing. I am even more confused now seeing how different the 2 traceroots are.

curtisgrice · Feb 25, 2018, 6:12 PM

@tagit446:

@JKnott:

It's means somewhere there's a router with an MTU of 552 bytes, which is very small.

Agreed but where? The only router in my home network is my pfSense box.

@JKnott:

The address 172.30.1.206 is within the 172.16.0.0 /12 private address range, but it could be anywhere. You can get an idea where with traceroute.

Ran traceroot with pfSense and got,

 1  10.87.0.1 (10.87.0.1)  18.093 ms  17.771 ms  18.594 ms
 2  64.64.117.1 (64.64.117.1)  18.339 ms  18.170 ms  18.203 ms
 3  ethernet6-1-br2.pnj1.choopa.net (108.61.66.137)  19.032 ms
    ethernet6-1-br1.pnj1.choopa.net (108.61.66.133)  17.802 ms
    ethernet6-1-br2.pnj1.choopa.net (108.61.66.137)  19.281 ms
 4  vl50-er1.pnj1.choopa.net (66.55.144.145)  17.988 ms
    vl24-er2.pnj1.choopa.net (108.61.248.13)  19.497 ms
    vl39-er2.pnj1.choopa.net (66.55.144.150)  22.685 ms
 5  * * *
 6  * * *
 7  * * *
 8  * * *
 9  * * *
10  * * *
11  * * *
12  * * *
13  * * *
14  * * *
15  * * *
16  * * *
17  * * *
18  * * *
19  * * *
20  * * *
21  * * *
22  * * *
23  * * *
24  * * *
25  * * *
26  * * *
27  * * *
28  * * *
29  * * *
30  * * *

Also ran traceroot on my PC and got,

C:\WINDOWS\system32>tracert 172.30.1.206

Tracing route to 172.30.1.206 over a maximum of 30 hops

  1     6 ms     7 ms     6 ms  10.10.10.10
  2     6 ms     6 ms     7 ms  burl-lnk-70-109-168-169.ngn.east.myfairpoint.net [70.109.168.169]
  3    13 ms    13 ms    13 ms  pool-64-222-213-130.port.east.myfairpoint.net [64.222.213.130]
  4     *        *        *     Request timed out.
  5     *        *        *     Request timed out.
  6     *        *        *     Request timed out.
  7     *        *        *     Request timed out.
  8     *        *        *     Request timed out.
  9     *        *        *     Request timed out.
 10     *        *        *     Request timed out.
 11     *        *        *     Request timed out.
 12     *        *        *     Request timed out.
 13     *        *        *     Request timed out.
 14     *        *        *     Request timed out.
 15     *        *        *     Request timed out.
 16     *        *        *     Request timed out.
 17     *        *        *     Request timed out.
 18     *        *        *     Request timed out.
 19     *        *        *     Request timed out.
 20     *        *        *     Request timed out.
 21     *        *        *     Request timed out.
 22     *        *        *     Request timed out.
 23     *        *        *     Request timed out.
 24     *        *        *     Request timed out.
 25     *        *        *     Request timed out.
 26     *        *        *     Request timed out.
 27     *        *        *     Request timed out.
 28     *        *        *     Request timed out.
 29     *        *        *     Request timed out.
 30     *        *        *     Request timed out.

Trace complete.

Doesn't appear that the traceroots are at all revealing. I am even more confused now seeing how different the 2 traceroots are.

Running a traceroute on 172.30.1.206 will just keep hitting net next hops default gateway until it get lucky and hits a router with that network in its routing table or until it hits the L3 TTL.

You would need to run a traceroute to the netalyzr.icsi.berkeley.edu testing host (not necessarily that address). from that you can look at the DNS ptr records (host names found by IP) to get a sense of where that is.

The address it reported could be an address in your ISPs network or just an IP on an interface on a router along the way.

Also try both ICMP and TCP traceroute as many transit routers cant be bothered to reply to a ICMP/UDP ping.

tagit446 · Feb 26, 2018, 11:52 PM

@curtisgrice:

You would need to run a traceroute to the netalyzr.icsi.berkeley.edu testing host (not necessarily that address). from that you can look at the DNS ptr records (host names found by IP) to get a sense of where that is.

The address it reported could be an address in your ISPs network or just an IP on an interface on a router along the way.

Also try both ICMP and TCP traceroute as many transit routers cant be bothered to reply to a ICMP/UDP ping.

I have not tried the ICMP traceroot yet but have tried the TCP traceroot and unfortunately it was unrevealing as well. I do know now though that it is not coming from pfSense or my home network as I have removed pfsense from the network temporarily for testing. My configuration is now ISP > Modem/router > Testing PC.