Will you help me decipher these ping quality results?



  • Would you be able to tell me what is going on here? 
    RRD quality graph shows packet loss starting at 6:00 PM the last couple days.  Disabling/enabling the WAN interface does not help the problem.  Restarting my cable modem DOES alleviate the issue.

    I am using winmtr to try to gauge where packet loss is coming from. 
    This is a simple ping to twc.com, and it seems to be having issues with the first hop into the TWC network?  21% packet loss and for some reason the actual counts are way less than the other servers.

    
    |------------------------------------------------------------------------------------------|
    |                                      WinMTR statistics                                   |
    |                       Host              -   %  | Sent | Recv | Best | Avrg | Wrst | Last |
    |------------------------------------------------|------|------|------|------|------|------|
                                            pfSense.localdomain -    0 | 1134 | 1134 |    0 |    0 |    0 |    0 |
    |           cpe-69-155-124-1.carolina.res.rr.com -   21 |  106 |   84 |    4 |   10 |   17 |    7 |
    |           cpe-174-111-110-041.triad.res.rr.com -    1 | 1080 | 1079 |    7 |   27 |  143 |   25 |
    |                                                   24.93.70.64 -    1 | 1086 | 1085 |    4 |   10 |   30 |    9 |
    |        ge-5-1-0.rlghncpop-rtr1.southeast.rr.com -    1 | 1041 | 1039 |    9 |   16 |   32 |   13 |
    | bu-ether35.asbnva1611w-bcr00.tbone.rr.com -    1 | 1084 | 1083 |   17 |   25 |   40 |   27 |
    |  bu-ether12.vinnva0510w-bcr00.tbone.rr.com -    1 | 1083 | 1082 |   52 |   61 |   75 |   61 |
    |    bu-ether12.chctilwc00w-bcr00.tbone.rr.com -    1 | 1085 | 1084 |   51 |   59 |   75 |   58 |
    |   bu-ether5.enwdcocd02w-bar01.tbone.rr.com -    0 | 1130 | 1130 |   51 |   58 |   82 |   55 |
    |          0.ae9.enwdcocd01w-sar00.tbone.rr.com -    1 | 1079 | 1078 |   50 |   60 |  162 |   58 |
    |            cpe-69-134-141-185.peakview.rr.com -    0 | 1131 | 1131 |   51 |   59 |   79 |   54 |
    |                                                71.74.189.86 -   16 |  137 |  116 |   50 |   57 |   74 |   59 |
    |________________________________________________|______|______|______|______|______|______|
       WinMTR v0.92 GPL V2 by Appnor MSP - Fully Managed Hosting & Cloud Provider
    

  • Banned

    Not with this broken ASCII arts… Kindly post code output between CODE tags (the # button).



  • OK - thank you

    
    | Host | % | Sent | Recv | Best | Avrg | Wrst | Last | 
    | ------------------------------------------------ |   | ------ | ------ | ------ | ------ | ------ | ------ | 
    | pfSense.localdomain | 0 | 1134 | 1134 | 0 | 0 | 0 | 0 | 
    | cpe-69-155-124-1.carolina.res.rr.com | 21 | 106 | 84 | 4 | 10 | 17 | 7 | 
    | cpe-174-111-110-041.triad.res.rr.com | 1 | 1080 | 1079 | 7 | 27 | 143 | 25 | 
    | 24.93.70.64 | 1 | 1086 | 1085 | 4 | 10 | 30 | 9 | 
    | ge-5-1-0.rlghncpop-rtr1.southeast.rr.com | 1 | 1041 | 1039 | 9 | 16 | 32 | 13 | 
    | bu-ether35.asbnva1611w-bcr00.tbone.rr.com | 1 | 1084 | 1083 | 17 | 25 | 40 | 27 | 
    | bu-ether12.vinnva0510w-bcr00.tbone.rr.com | 1 | 1083 | 1082 | 52 | 61 | 75 | 61 | 
    | bu-ether12.chctilwc00w-bcr00.tbone.rr.com | 1 | 1085 | 1084 | 51 | 59 | 75 | 58 | 
    | bu-ether5.enwdcocd02w-bar01.tbone.rr.com | 0 | 1130 | 1130 | 51 | 58 | 82 | 55 | 
    | 0.ae9.enwdcocd01w-sar00.tbone.rr.com | 1 | 1079 | 1078 | 50 | 60 | 162 | 58 | 
    | cpe-69-134-141-185.peakview.rr.com | 0 | 1131 | 1131 | 51 | 59 | 79 | 54 | 
    | 71.74.189.86 | 16 | 137 | 116 | 50 | 57 | 74 | 59 |
    
    

  • Banned

    Wonderful…

    Look, there's a # button here on the board. USE IT! No, HTML cannot be used here. Otherwise, there's mtr-nox11 package on pfSense if you are unable to get reasonably output from the Windows stuff.



  • |------------------------------------------------------------------------------------------|
    |                                      WinMTR statistics                                   |
    |                       Host              -   %  | Sent | Recv | Best | Avrg | Wrst | Last |
    |------------------------------------------------|------|------|------|------|------|------|
    |                     pfSense.localdomain -    0 | 1134 | 1134 |    0 |    0 |    0 |    0 |
    |    cpe-69-155-124-1.carolina.res.rr.com -   21 |  106 |   84 |    4 |   10 |   17 |    7 |
    |    cpe-174-111-110-041.triad.res.rr.com -    1 | 1080 | 1079 |    7 |   27 |  143 |   25 |
    |                             24.93.70.64 -    1 | 1086 | 1085 |    4 |   10 |   30 |    9 |
    |ge-5-1-0.rlghncpop-rtr1.southeast.rr.com -    1 | 1041 | 1039 |    9 |   16 |   32 |   13 |
    |bu-ether35.asbnva1611w-bcr00.tbone.rr.com -   1 | 1084 | 1083 |   17 |   25 |   40 |   27 |
    |bu-ether12.vinnva0510w-bcr00.tbone.rr.com -   1 | 1083 | 1082 |   52 |   61 |   75 |   61 |
    |bu-ether12.chctilwc00w-bcr00.tbone.rr.com -   1 | 1085 | 1084 |   51 |   59 |   75 |   58 |
    |bu-ether5.enwdcocd02w-bar01.tbone.rr.com -    0 | 1130 | 1130 |   51 |   58 |   82 |   55 |
    |    0.ae9.enwdcocd01w-sar00.tbone.rr.com -    1 | 1079 | 1078 |   50 |   60 |  162 |   58 |
    |      cpe-69-134-141-185.peakview.rr.com -    0 | 1131 | 1131 |   51 |   59 |   79 |   54 |
    |                            71.74.189.86 -   16 |  137 |  116 |   50 |   57 |   74 |   59 |
    |________________________________________________|______|______|______|______|______|______|
    

    High packet loss on a step followed by much lower packet loss on later steps simply means the step showing high packet loss does not attach high priority to handling ICMP echo request/reply. The apparent high packet loss on the first hop after pfSense is therefore pretty much meaningless. It is also possible that your cable modem changed IP address during this trace, because of the low number of packets sent to that address relative to most of the rest of the hops.

    All is well up to the penultimate step. The final step seems to be some sort of load balancer, hence the low number of packets sent relative to most of the other steps. The apparent packet loss could be a consequence of the load balancing, also this could be a device giving low priority to handling ICMP echo request/reply.

    In other words, it is hard to conclude there is an actual problem based on this trace.

    Arguably a better way of monitoring a link is to use a service that pings your connection and plots the results. As you are a cable modem user, you need a service that supports dynamic DNS. I don't have any suggestions, as the only such service I know is based in the UK, whereas you want one based in the US.

    Rather than worrying about synthetic tests, what symptoms are you experiencing with the connection that suggest actual packet loss?



  • I've found Ping Plotter to be a handy tool for this sort of thing.

    https://www.pingplotter.com/freeware.html


  • Banned

    Well, 1/5 packets lost between your pfSense and gateway sounds seriously bad…



  • This is what I am trying to diagnose:

    Where the packet loss abruptly stops each day is when I restart my cable modem.



  • Banned

    Yeah. Sounds like you should get in touch with ISP instead of debugging pfSense. The problem is obviously not on pfSense.



  • Where the packet loss abruptly stops each day is when I restart my cable modem.

    Why do you need to do this every day??


  • Banned

    Well, to get rid of the horrible packet loss, apparently? (Power cycle the modem -> no more packet loss for ~next day). :D :D



  • If you want a US-based site that can help you diagnose packet loss and latency issues from outside your network, dslreports.com offers two different kinds of ping monitoring tools that might be able to help.

    They have Smokeping, which will send 20 pings every 5 minutes from three different locations around the country (East, West, and Midwest). They also offer longer-term persistent monitoring-  fewer pings on a longer interval from only two locations - for free if you join a monitor group (like the TWC_Triad group).

    You'll need to sign up for an account to use either of those features. You'll also need a Dynamic DNS hostname, so if your numeric IP address changes the site will still be able to find your router. Make sure to also set up Dynamic DNS in pfSense to keep it updated.

    Here are a few links…

    DSLReports SmokePing
    Line Monitor Signup
    Line Monitor Group contacts (you'll have to wait 8 hours after creating your account before you'll be able to message the contact for the RoadRunner Triad group; you'll want to do this within a week or the monitor will stop working)
    DSLReports TWC Forum - to talk to others, get help, advice, info, etc. If you just want to use the forum, you don't need to register. Anonymous posting is allowed.



  • Well, to get rid of the horrible packet loss, apparently?

    Duh, my slow brain saw that as he reboots every day just because, and it happens to fix his problem.  I'll see myself out.

    They have Smokeping

    That's something you can implement yourself without needing them.  I have a Smokeping instance running on a dinky Ubuntu box.  Highly recommended for tracking your ISP.

    https://oss.oetiker.ch/smokeping/



  • @KOM:

    They have Smokeping

    That's something you can implement yourself without needing them.  I have a Smokeping instance running on a dinky Ubuntu box.  Highly recommended for tracking your ISP.

    https://oss.oetiker.ch/smokeping/

    Yep… I have it running on a VPS I use for other stuff, tracking IPv4 and v6... but dslreports offers some geographic diversity, since they ping from multiple locations in the US.



  • what is Apinger using as the destination ip (my gateway ip doesnt reliable respond to pings) maybe it prioritises other internet traffic over the pings also i wouldnt trust that graph (apinger)find a different tool

    whats your cable modem show http://192.168.100.1


Log in to reply