Wierd Modem(only) traffic in Comcast HSI http://www.dslreports.com/forum/r20226594 en Sun, 06 Dec 2009 08:33:07 EDT Sun, 06 Dec 2009 08:33:07 EDT Re: Wierd Modem(only) traffic http://www.dslreports.com/forum/remark,20261184 PittsPgh :
said by lart See Profile :

Look at the packet data it's upnp from 192.168.1.1 . If you tried to turn upnp off/on and off then the next step I would try is flashing your firmware. Also try capture the packets with wireshark so we can get a time frame on the frequency of packets. The packets should not be to the point that they have any effect on your network. I don't know how your modem works but I know a few that have the light say on for a second of so for 1 packet.
Ok sorry for the delay in getting this.
Here is the WireShark capture. Done on Sat afternoon. Everything else was shutdown. No yahoo messenger, no wireless cam running. UPnP is disabled, in XP services also.
But even when I unplugthe router and even did a 30sec reset on the modem the send light still stays on continuously. Not sure if Comcast changed something in the config file or not. Just never did it before.
Paul
Cap29Mar08-2···pcap.zip 1,117 bytes
]]> http://www.dslreports.com/forum/remark,20261184 Mon, 31 Mar 2008 23:10:15 EDT Re: Wierd Modem(only) traffic http://www.dslreports.com/forum/remark,20232566 PittsPgh :
said by lart See Profile :

Look at the packet data it's upnp from 192.168.1.1 . If you tried to turn upnp off/on and off then the next step I would try is flashing your firmware. Also try capture the packets with wireshark so we can get a time frame on the frequency of packets. The packets should not be to the point that they have any effect on your network. I don't know how your modem works but I know a few that have the light say on for a second of so for 1 packet.
Ok I have WireShark, it's installed. No problem, do it over the weekend when I have more time.
The real mystery is why all of a sudden the Send light decide to be steady on. Even with everything else disconnected. Router & Cam. Whatever it is it's not degrading my speeds. BTW: modem is 4 years old WebStar DPC2100 Rented. Never a bit of problem.]]> http://www.dslreports.com/forum/remark,20232566 Thu, 27 Mar 2008 01:42:55 EDT Re: Wierd Modem(only) traffic http://www.dslreports.com/forum/remark,20228696 lart : Look at the packet data it's upnp from 192.168.1.1 . If you tried to turn upnp off/on and off then the next step I would try is flashing your firmware. Also try capture the packets with wireshark so we can get a time frame on the frequency of packets. The packets should not be to the point that they have any effect on your network. I don't know how your modem works but I know a few that have the light say on for a second of so for 1 packet.]]> http://www.dslreports.com/forum/remark,20228696 Wed, 26 Mar 2008 13:29:31 EDT Re: Wierd Modem(only) traffic http://www.dslreports.com/forum/remark,20228075 Epikos : Aaah, yeah. I have an RCA modem and it only has a "Traffic" light, no send an receive. Sorry for the misinformation! :D
--
I refuse to have a battle of wits with an unarmed person!]]> http://www.dslreports.com/forum/remark,20228075 Wed, 26 Mar 2008 11:41:25 EDT Re: Wierd Modem(only) traffic http://www.dslreports.com/forum/remark,20228009 PittsPgh :
said by Epikos See Profile :

This may not be related to your issue, but my traffic light is on almost constantly. Once I looked into it and determined the cause to be ARP traffic to and from all the modems connected to a given CMTS card. It is normal and safely be ignored.
The Recieve light would normally be related to ARP traffic noise. The Send light use to be normaly out for the most part. Now it is on constant, except for when I browse or whatever in interupts it.
Up until Tue morning that was how I could tell someone logged onto the cam, because the send light would be almost steady. Which is what I thought what was happening till I looked at the logged and disconnected everything else.]]> http://www.dslreports.com/forum/remark,20228009 Wed, 26 Mar 2008 11:27:40 EDT Re: Wierd Modem(only) traffic http://www.dslreports.com/forum/remark,20227945 Epikos : This may not be related to your issue, but my traffic light is on almost constantly. Once I looked into it and determined the cause to be ARP traffic to and from all the modems connected to a given CMTS card. It is normal and safely be ignored.
--
I refuse to have a battle of wits with an unarmed person!]]> http://www.dslreports.com/forum/remark,20227945 Wed, 26 Mar 2008 11:14:17 EDT Re: Wierd Modem(only) traffic http://www.dslreports.com/forum/remark,20227572 PittsPgh : Left it all unplugged overnight. Still have the steady Send light. Even before plugging in and powering up the router.

Paul]]> http://www.dslreports.com/forum/remark,20227572 Wed, 26 Mar 2008 09:54:07 EDT Re: Wierd Modem(only) traffic http://www.dslreports.com/forum/remark,20226738 PittsPgh :
said by deblin See Profile :

Ok :) Then disable UPnP in it, and I think you'll find the messages go away.
Ok done.
Also disabled the port foward for the cam.
and Checked 'Filter Multicast' in the router.
Reboted router within router gui.
Well, still have the steady send light. I'll unplug everything overnight see if that clears the steady send light. wierd that this just shows up like it did after all this time.
Paul]]> http://www.dslreports.com/forum/remark,20226738 Wed, 26 Mar 2008 02:40:49 EDT Re: Wierd Modem(only) traffic http://www.dslreports.com/forum/remark,20226715 deblin : Ok :) Then disable UPnP in it, and I think you'll find the messages go away.
--
Hello...is there anybody in there?]]> http://www.dslreports.com/forum/remark,20226715 Wed, 26 Mar 2008 02:27:18 EDT Re: Wierd Modem(only) traffic http://www.dslreports.com/forum/remark,20226699 PittsPgh :
said by PittsPgh See Profile :

said by deblin See Profile :

Which device is 192.168.1.1? Your router? Turn off UPnP on the router and see if the messages go away.
That is the modem itself. DPC2100

Even with the power to router off the Send light is still steady.
CORRECTION CORRECTION

That is My Router!! OPPS!!
late night after work :huh:
Paul]]> http://www.dslreports.com/forum/remark,20226699 Wed, 26 Mar 2008 02:14:39 EDT Re: Wierd Modem(only) traffic http://www.dslreports.com/forum/remark,20226681 PittsPgh : had all power uplugged Router,modem & cam(still uplugged) all day/evening while I was at work. Plugged Modem in waited for almost 10 minutes before powering up router,and just watched the steady send light on it still.
Normal browsing and everything else will interupt the steaday send light.]]> http://www.dslreports.com/forum/remark,20226681 Wed, 26 Mar 2008 02:04:25 EDT Re: Wierd Modem(only) traffic http://www.dslreports.com/forum/remark,20226672 deblin :
said by PittsPgh See Profile :

Think maybe they're checking on mewhy I was transmitting so much. Due to the Cam sending out?
I doubt it, probably just a coincidence. They don't need to UPnP to figure that out, they can simple watch the traffic to/from your modem on the port the cam is running from.

I would try disabling UPnP on any router(s)/PCs/devices on your network and see if the messages go away.

Did you by chance power cycle or reboot the cable modem recently? What I'm thinking might have happened is:

- enabled UPnP on cam
- cable modem joined the multicast group
- disabled UPnP on cam
- rebooted cable modem

And now it's trying to look for UPnP devices since it's not seeing anything from the cam anymore.

Try turning UPnP off on everything, then deep power cycle the modem (unplug for 30-60 seconds).
--
Hello...is there anybody in there?]]> http://www.dslreports.com/forum/remark,20226672 Wed, 26 Mar 2008 02:00:17 EDT Re: Wierd Modem(only) traffic http://www.dslreports.com/forum/remark,20226667 PittsPgh :
said by deblin See Profile :

Ahh ok. Is this a device you own or are renting? Perhaps comcast pushed some new software/firmware to it somehow which enabled SSDP?
Could be my guess also. Can't get to any logs on this model.
Think maybe they're checking on me why I was transmitting so much. Due to the Cam sending out? only when someone logs into it. I organally thought someone was logged into it. cam log show noone.
Paul]]> http://www.dslreports.com/forum/remark,20226667 Wed, 26 Mar 2008 01:56:23 EDT Re: Wierd Modem(only) traffic http://www.dslreports.com/forum/remark,20226663 deblin : Ahh ok. Is this a device you own or are renting? Perhaps comcast pushed some new software/firmware to it somehow which enabled SSDP?
--
Hello...is there anybody in there?]]> http://www.dslreports.com/forum/remark,20226663 Wed, 26 Mar 2008 01:53:36 EDT Re: Wierd Modem(only) traffic http://www.dslreports.com/forum/remark,20226659 PittsPgh :
said by deblin See Profile :

Which device is 192.168.1.1? Your router? Turn off UPnP on the router and see if the messages go away.
That is the modem itself. DPC2100

Even with the power to router off the Send light is still steady.]]> http://www.dslreports.com/forum/remark,20226659 Wed, 26 Mar 2008 01:50:27 EDT Re: Wierd Modem(only) traffic http://www.dslreports.com/forum/remark,20226655 deblin : Which device is 192.168.1.1? Your router? Turn off UPnP on the router and see if the messages go away.
--
Hello...is there anybody in there?]]> http://www.dslreports.com/forum/remark,20226655 Wed, 26 Mar 2008 01:49:05 EDT Re: Wierd Modem(only) traffic http://www.dslreports.com/forum/remark,20226652 PittsPgh :
said by deblin See Profile :

Looks to me like you have a SOHO router of some sort with UPnP enabled. Those are multicast packets, specifically SSDP.
I did enabled UPnP for the linksys wireless IP cam. But that was a while ago. This wierd thing started Just yesterday morning.]]> http://www.dslreports.com/forum/remark,20226652 Wed, 26 Mar 2008 01:48:13 EDT Re: Wierd Modem(only) traffic http://www.dslreports.com/forum/remark,20226647 deblin : Come to think of it, I don't think SSDP is necessarily UPnP, but it is similar.

Don't some of the newer Linksys routers use SSDP? I think you can just hit a button on them and it'll automatically set things up to some extent.
--
Hello...is there anybody in there?]]> http://www.dslreports.com/forum/remark,20226647 Wed, 26 Mar 2008 01:46:30 EDT Re: Wierd Modem(only) traffic http://www.dslreports.com/forum/remark,20226641 deblin : Looks to me like you have a SOHO router of some sort with UPnP enabled. Those are multicast packets, specifically SSDP.
--
Hello...is there anybody in there?]]> http://www.dslreports.com/forum/remark,20226641 Wed, 26 Mar 2008 01:44:10 EDT Wierd Modem(only) traffic http://www.dslreports.com/forum/remark,20226594 PittsPgh : Since this morning (tue) I noticed the SEND light being on Steady. Modem is WebSTAR DPC2100. An occasional blink off is all. First thing I checked was the Wireless IP Cam. Noone logged in watching. Then disconnected it. Same. Pulled the power from the router. No change. Power cycled the modem. Booted fine, but still steady Send light. Should also mention that the recieve light is almost steday as well.

Getting the best of me now. Ran a packet program and I see the Modem ip »192.168.100.1/ is getting all kind of traffic. Well I ran out of time so I just shut down and pulled the power cords for both router & modem. Wireless was still unplugged as well.
After work some 12 hours later, powered up the modem only booted up, then same steady power light.

Here are the modem stats.
Name
WebSTAR DPC2100
Modem Serial Number
*********
Cable Modem MAC Address
00:0A:73:**:**:**
Hardware Version
v1.1
Software Version
v2.0.1r1142-050302(dpc2100-v201r1142-050302a.p7b.csg)
Receive Power Level
4.2 dBmV
Transmit Power Level
47.5 dBmV
Cable Modem Status
Operational
Pretty much were they have been.

After powering the router and computer. I ran packetyzer and took a screen shot (attached)
I've ran packet programs before. I know it's mostly garbage to me, I can pick out some things in it. I've never seen all this traffic for just the modem.
My speeds don't seem affected. Speed test and browsing are fine.
Did a line quality test for the heck of it.
»/linequality/nil/2366931
Looks good
Now a few weeks ago Comcast syatem was messed up here in Pittsburgh. I even called a tech, never again.
Well they finally cleared things up. Not sure if that would be related.
I'm just comfused as to what's going on.
Thanks
Paul

I should add. I installed or changed NOTHING in over a couple weeks.
Click for full size
Almost all the traffic is to/from the Modem
Click for full size
Anyone figure this out?
]]> http://www.dslreports.com/forum/remark,20226594 Wed, 26 Mar 2008 01:25:57 EDT