Strange Internet Issue

[ch33s3r]

PM'd, Mapes. Also, my cable modem is a Motorola SB4200 Surfboard.

Homosapien, have fun with Calc 2 lol

[Caddys83]

Okay so let me try to explain things as clearly as I can. Please don't read part of my explanation and think "Oh I know what it is already!" and reply without reading the entirety of my explanation.

For the last 2 weeks or maybe even a month, my cable modem's "activity" light has been pretty much solid, which usually indicates heavy downloading or uploading. It has never remained solid like this without me actually downloading/uploading or playing a game.

Let me give a little background of my network setup. I live alone in my apartment. I'm the only one that uses my internet connection. I connect my desktop to a Linksys router (not wirelessly...the router is wireless but i connect via a cable) which then connects to the cable modem.

I have tried unplugging/replugging my router AND cable modem. I've also tried doing a hard reset (holding down the button for 20-30 secs) on the router. Now you may be thinking, "Who cares about a light on the cable modem?" Well, I would be thinking that too...except it is causing lag spikes in my gaming and it's getting on my nerves.

Another thing you may be thinking is "Well maybe you just need to run anti-virus or anti-spyware" Are you ready for this? The activity light remains solid even AFTER I turn off my computer! That's right. It isn't until I unplug my router that the activity light on the cable modem goes off. I've tried disabling wireless in my router in case someone was cracking my 128-bit WEP key, but the activity light on the cable modem still remains solid.

So I called my ISP (Comcast) to try and get some help. I gave them a summarized version of the explanation I just gave above. Do you know what the tech's solution was? "Open IE and delete temporary internet files and cookies." Yeah, so apparently now temporary internet files have the ability to use bandwidth even AFTER your computer is shut down! GENIUS! She asked "Is it faster now?" I just wanted to get off the phone at that point so I said "yeah thanks" and hung up. I hate tech support sometimes...

Anyway, someone at my school suggested that maybe I am under some type of DoS attack, but my ping is good sometimes and then frequently spikes so I don't know if that is likely or not. Browsing the net and downloading files doesn't feel like it's being bogged down by used bandwidth, but it is VERY noticeable when gaming. I don't understand how my modem can be experiencing activity when nothing is connected to it other than the router.

PLEASE HELP!!!

ch33s3r, there lies your problem. You should had stayed on the phone with the tech. She/he is only starting the troubleshoot and work their way down from what her computer screen is telling her the probable cause could be. You'll be lucky if you can find a nerd to figure it out quick.

If the problem can't be fix over the phone or while she's is looking at ur desktop (with your permission), she will either setup a service call or you can request a service person to come out and look. But make sure the person is very familiar with internet and not the cable TV itself.

A real simple troubleshoot. Disconnect everying from the modem leaving only the power and cable line plugged in. If the "activity" light stays solid, then the probable cause is from the outside of the apartment to the modem. have the service man (or he may) replace the modem, if its the same thing, then its the line.

If its cause you are under a DOS attack (most likely your not) request a new IP address.

The most logical cause is the apartment that you are in. Most good apartments that have contract with the local cable will have several repeater/booster boxes in the area for the apartments. The cause of reason could be that in the apartment you are in; people who are using heavy internet which could be as to why your "activity" is solid cause the modem is seening heavy traffic going by.

Good luck

[mapes]

Dude I look a little bit at the trace (I just got back from Baltimore so I'm gonna game now) . It initally looks like something is constantly arping out looking for an address on you local lan. I'll delve more into it tomorrow.

[mapes]

Ok heres the deal. So when I had you hook up your cable modem directly to you PC what you did was to bridge the cable network and your Ethernet network. Thats what cable modems and DSL modems do. They are a layer two device (called a bridge) that link two different types of physical networks together. Bridges just have a basic knowledge that says when I see a cable packet I rewrite it as a Ethernet packet and send out the Ethernet interface. For traffic going the other way it does the same in reverse. So what normally happens is you have your router before the bridge. You PC sends a packet to the internet. You router routes the packet from your internal IP network to your external network and then that packet goes over the bridge to the cable company's router as if those two routers were on the same Ethernet network.

Ok with that aside this setup I had you do allows your pc to see traffic on the link between you and the cable co. Your PC can't talk out this but, it can see it. Why you have activity light blinking is because the cable company's router on the other side of the link is constantly arping out.

In the trace the packets look like this


No. Time Source Destination Protocol Info
576 59.732860 Cadant_22:5f:82 Broadcast ARP Who has 76.26.179.156? Tell 76.26.176.1

Frame 576 (60 bytes on wire, 60 bytes captured)
Arrival Time: Sep 17, 2009 21:38:38.237375000
[Time delta from previous captured frame: 0.076858000 seconds]
[Time delta from previous displayed frame: 0.076858000 seconds]
[Time since reference or first frame: 59.732860000 seconds]
Frame Number: 576
Frame Length: 60 bytes
Capture Length: 60 bytes
[Frame is marked: False]
[Protocols in frame: eth:arp]
Ethernet II, Src: Cadant_22:5f:82 (00:01:5c:22:5f:82), Dst: Broadcast (ff:ff:ff:ff:ff:ff)
Destination: Broadcast (ff:ff:ff:ff:ff:ff)
Address: Broadcast (ff:ff:ff:ff:ff:ff)
.... ...1 .... .... .... .... = IG bit: Group address (multicast/broadcast)
.... ..1. .... .... .... .... = LG bit: Locally administered address (this is NOT the factory default)
Source: Cadant_22:5f:82 (00:01:5c:22:5f:82)
Address: Cadant_22:5f:82 (00:01:5c:22:5f:82)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: ARP (0x0806)
Trailer: 000000000000000000000000000000000000
Address Resolution Protocol (request)
Hardware type: Ethernet (0x0001)
Protocol type: IP (0x0800)
Hardware size: 6
Protocol size: 4
Opcode: request (0x0001)
Sender MAC address: Cadant_22:5f:82 (00:01:5c:22:5f:82)
Sender IP address: 76.26.176.1 (76.26.176.1)
Target MAC address: 00:00:00_00:00:00 (00:00:00:00:00:00)
Target IP address: 76.26.179.156 (76.26.179.156)

ARP is the protocol for mapping a physical address (the 00:01:5c:22:5f:82) to a logical address (i.e. IP address). The Physical address is set by the manufacturer of the network card. The IP address is set by you or DHCP or whatever. When you talk to a machine not on the local net you talk to it's IP addy. In reality you talk to a router (by the physical address) that sends it to a router that will eventually have that machine on it's local net. That router then does a ARP and finds the machines mapping of IP to Physical Address (most times called a MAC BTW) When you talk to a machine on the local net you talk to it's Physical address.

So anyways enough lectures. What is happening here is for some reason the ISP is constantly ARPing all the time on the link between you and it. Thats why you see activity. Because well it's traffic. However it's traffic thats restricted to that link between you and the ISP. Thats why your machine sees nothing. (arp never gets routed between IP networks). So in short. There is activity between the outside of the cable modem and the cable company. However this should not affect latency. These protocols are heavily optimized since they are used so much and in reality amount for a very very little traffic.

Make sense?

Also Caddy no way would a service rep who reads from a script be able to figure this out. Maybe someone in the cable co's network center would but, not a front line script monkey

[ch33s3r]

Wow, thanks a lot for taking the time to give such an in-depth analysis and explanation! And yes, your explanation does make sense. The thing I'm still unclear on is why this wasn't happening until somewhat recently. If I called them about it, would they know what I was talking about? Would they care? From what you are saying, it sounds like it doesn't really matter since it's not really affecting latency, so maybe it's not even worth messing with it. I'm still curious as to what has caused my recent ping spikes though...maybe that is just coincidence that it started happening around the same time as the activity light thing. I can get Windows 7 for free through my college, so maybe now is a good time to reformat anyway.

Again, thanks A LOT for your time and insight, Mapes! As you said, there is NO WAY I would have been able to get help at a level anywhere near what you gave from some over-the-phone tech support rep at my ISP, even after spending countless hours on the phone with them. Personally, I absolutely can't stand talking to a script, which is essentially what you are doing when you call those people. They may as well have a computer answer the calls...

Once again, THANK YOU THANK YOU THANK YOU

[mapes]

Hey man no problem this is what I do for a living. I really don't see why they are arping out so much but, again I don't think it should cause lag. I'm kinda curious myself as to why they do it. What provider are you with?

Edit doh it's in your first post

[ch33s3r]

Comcast...And I don't have a choice in the matter