dslreports logo
site
 
    All Forums Hot Topics Gallery
spc

spacer




how-to block ads


Search Topic:
uniqs
5381
share rss forum feed

kiknwing

join:2010-12-13
Ogden, UT

More packets sent then received

Here is my new problem, I'm sending more packets then I'm receiving. I'm not running any torrent or ftp programs. I have ran numerous virus scans with different virus software: avg, MSE, avast. I even completely wiped my hard drive with a DoD 5220.22-M wipe. Reinstalled widows, same problem. Tried a different computer with ubuntu, same problem. Wireless network is secure, no other computers are on the network.

The reason why I ask is my internet seems to "pause" (30-60 sec) when trying to load pages. A qwest technician came out and checked the line and no errors. He hooked up his laptop to my network and he had the same problem. He said he would contact a engineer to look at this problem. The engineer emails me that this issue is caused by malware and I should check my computers. Is there anything that I should do before I call him and explain to him that its not malware? I have done a continues ping test and it yields nothing. Changes DNS serves, nothing. Currently using wired network.

Packets Sent: 69832
Packets Received: 41307


Vin DSL

join:2002-08-10
Gilbert, AZ
You need to run a packet sniffer against the problem...

My recommendation: »www.wireshark.org/


No_Strings
Premium,MVM,Ex-Mod 2008-13
join:2001-11-22
The OC
kudos:6
reply to kiknwing
An "out of left field" suggestion:

Download and burn a Linux CD or DVD. Knoppix would be a good choice as it's a live CD. Ubuntu will run in that mode as well. Doing this completely eliminates any possibility of malware or configuration issues with the Windows install.

It does not eliminate the possibility of a hardware problem.


toby
Troy Mcclure

join:2001-11-13
Portland, OR
Depending on your router, you can use its built in tools like ping/tracert while having no other PCs using the internet connection.

kiknwing

join:2010-12-13
Ogden, UT
reply to No_Strings
Let me go ahead and add some more details.
• Tried running a ubuntu live cd, same problem
• Downloaded a trial game on the PS3 & 360, same problem
• The Q1000 has been replaced
• Using a wired connection for all devices

Later today I will run a packet sniffer, it starts to get bad during the prime hours of the evening. I'm also going to try and find a neighbor that has qwest and see if they are having this problem.


Vin DSL

join:2002-08-10
Gilbert, AZ

4 edits
said by kiknwing See ProfileLater today I will run a packet sniffer[... :

That's great! Glad you're listening.

Word to the wise: Don't let the Wireshark/Ethereal website fool you!

Packet sniffers are considered hacker's tools.

Google it: »www.google.com/search?&q=wireshark+hack

Don't let anybody know you're using one, or you'll get pegged as a black hat...

Sadly, the only way you're going to know what's happening is to hack yourself, e.g. network analysis (wink, wink, nudge, nudge).

Just don't be stupid and hack into your neighbor's (wireless) networks, you know?!?!?

I know it's tempting...


AthlGrond
Premium,MVM
join:2002-04-25
Aurora, CO
reply to kiknwing
That the problem happened with the qwest technician's laptop points to the problem not being malware on your computer (because how would that affect his computer).

Having sent more packets than received could mean that your packets are going unanswered. How long did it take to get that 69832 packets sent? (That number of packets doesn't sound that all that high really.)
--
If you’re greener than Gore, you’re green enough.

kiknwing

join:2010-12-13
Ogden, UT
said by AthlGrond:

Having sent more packets than received could mean that your packets are going unanswered. How long did it take to get that 69832 packets sent? (That number of packets doesn't sound that all that high really.)

That was done in about a half hour. Here are some new numbers.
Session Time: 0 Days, 13H:40M:24S
Packets Sent: 202826
Packets Received: 110018

Here are the modem stats:

VPI: 0
VCI: 32
Broadband Mode Setting: MULTIMODE
Broadband Negotiated Mode: ADSL2+
Connection Status: Showtime
Downstream Speed: 12127 Kbps
Upstream Speed: 892 Kbps
Retrains: 0
Retrain Timer: 0 Days, 13H:40M:35S
ATM QoS class: UBR
Near End CRC Errors Interleave: 0
Near End CRC Errors Fastpath : N/A
Far End CRC Errors Interleave : 0
Far End CRC Errors Fastpath : N/A
30 Minute Near End CRC Interleave : 0
30 Minute Near End CRC Fastpath : N/A
30 Minute Far End CRC Interleave : 0
30 Minute Far End CRC Fastpath : N/A
Near End RS FEC Interleave : 0
Near End RS FEC Fastpath : N/A
Far End RS FEC Interleave : 0
Far End RS FEC Fastpath : N/A
30 Minute Near End FEC Interleave : 0
30 Minute Near End FEC Fastpath : N/A
30 Minute Far End FEC Interleave : 4294966931
30 Minute Far End FEC Fastpath : N/A
30 Minute Discarded Packets Downstream : 0
30 Minute Discarded Packets Upstream : 0
SNR Downstream : 25 dB
SNR Upstream : 21 dB
Attenuation Downstream : 2 dB
Attenuation Upstream : 5 dB
Power Downstream 0 dBm
Power Upstream 10.8 dBm


AthlGrond
Premium,MVM
join:2002-04-25
Aurora, CO

1 edit
said by kiknwing:

30 Minute Far End FEC Interleave : 4294966931

There may be a problem there.

[Edit]
Sorry that was a bit unclear.

That could account for the problem if it isn't an erroneous report from the modem. The number means you are having a huge number of of outbound packet errors corrected.

The qwest technician you talk to should be interested in finding the source of that reported number.

--
If you’re greener than Gore, you’re green enough.

kiknwing

join:2010-12-13
Ogden, UT
I still have the technicians phone number so I will call him before I call the "engineer" because I already talked to the engineer about this and he said this is "normal" and that the dslam is doing its job. Also I talk to a network engineer at my work and he was going to give me a router that should tell me where the packets are going a little better then wireshark.

kiknwing

join:2010-12-13
Ogden, UT
reply to kiknwing
Now that I hooked up a router behind the modem to confirm the packet situation, I now see that more packets are being received then sent. The qwest modem basically has the numbers switched. My next question is, does anyone know what the maximum packets per second I should be able to send? I have qwests 12mbps/892kbps service.

kiknwing

join:2010-12-13
Ogden, UT
reply to kiknwing
I placed the Q1000 into bridge mode and hooked up a netgear router. I did not hookup any thing to the ethernet ports and the wireless was turned off. The only thing that had access to the internet was the modem & router. I check the traffic report on my modem and there was 151MB uploaded and 398MB downloaded with the firewall up. When I called qwest earlier they saw the unknown traffic but thought that it was just a computer error on their end. That was only with the Q1000 & no router or attachments with wireless off. Has anyone else had this problem or know something about it?

kiknwing

join:2010-12-13
Ogden, UT

1 edit
reply to kiknwing
Could someone tell me if this is normal or not?



AthlGrond
Premium,MVM
join:2002-04-25
Aurora, CO
You can expect ATM traffic to happen without regard to you actively using the connection.

This may help you understand a bit better:
»DSL FAQ » Compare bridged vs Routed DSL


When not bridged your modem would block this traffic, now while bridged your router has to.

[Edit]
I have no idea if the quantity of traffic is normal, my comment is only that some traffic is.

--
If you’re greener than Gore, you’re green enough.