dslreports logo
site
 
    All Forums Hot Topics Gallery
spc

spacer




how-to block ads


Search Topic:
uniqs
2410
share rss forum feed


AlanSixSons

@videotron.ca

[Help Me] DIR-655 / non-stop IGMP queries

1. DIR-655, B1, 2.07NA
2. Multicast is on (IPv4 only)

a- The router is outputting about 20 IGMP queries per second.
b- computers on LAN reply to it (report/join), but the queries don't stop.
c- behaviour stops after almost exactly 20 minutes since re-boot.

d- Factory reset (and then restore settings) did not help.

I'm not sure, but the symptoms seem to be since the F/W upgrade (which I did a couple weeks ago).

I just find it disconcerting to see a constant ~1.5 kB stream coming into the computer as if something outside was trying to break in - I know it's not that, but it's still not normal.

Thanks,
Alan6S.



BimmerE38FN

join:2002-09-15
Boise, ID
kudos:1
Reviews:
·CableOne

When was the FW updated?

Does this happen if you just sit with ONE wired connected PC, the router disconnected from the ISP modem an the wireless turned off? Test in Safe Mode With Networking...Same thing?

Make sure any 3rd party security SW like firewalls, on the PC is temporarily turned OFF as well while testing. Make sure no malware is present.

Ensure NIC drivers are up to date. If this is a Desktop PC, try a different NIC to test.



AlanSixSons

@videotron.ca

As I said, the router FW was updated about 2 weeks ago.

Tried it with:
- all PC's
- just one PC
- with the WAN disconnected

Haven't tried with WiFi off - will try next time.

The PC NIC drivers are up to date - but again, these requests are coming from the router, not any PC.

Continues.

No Firewall on the PC

It's clear the source is the DIR-655 (IP address or "dlinkrouter" shown as source in Wireshark).

It's been quiet since yesterday but I'm sure it will pop up again.



BimmerE38FN

join:2002-09-15
Boise, ID
kudos:1
reply to AlanSixSons

Down grade to v2.03 and see if it happens again.

Use this for downgrading:
»forums.dlink.com/index.php?topic=42457.0



AlanSixSons

@videotron.ca

Downgrade? Not going there unless something is broken to the point that my network won't work or security id compromised.



BimmerE38FN

join:2002-09-15
Boise, ID
kudos:1
Reviews:
·CableOne
reply to AlanSixSons

I suggest down grading to see if the problem still exists. If so then the problem lies else where, if not then possible issue with FW. I did see some odd behavior with an early version of v2.07 that broke Shareport and had constant network activity with the LEDs. This was fixed and presume this is probably not the case here. v2.03 is very stable and was considered the best. Only thing that v2.07 does is has some IPv6 improvements.

I would try v2.03 as a test. You can always go back to v2.07 after. I used both and they work well.

You may want to visit the D-Link forums for additional review and help suggestions.



Alan6Sons

@videotron.ca

I'll consider that, thanks.

The "problem" has not occurred in 2 days now (that I'm aware of). Perhaps I'll leave Wireshark running for 48 hours and trap IGMP's to see if it's still there.

It might be a one off bug that only occurs after a re-boot.

Filtering with Wireshark, presently, the router is issuing the IGMP request once every 2 minutes and 5 seconds. That's reasonable.

I'll try a re-boot later to see if it kicks off the deluge.



BimmerE38FN

join:2002-09-15
Boise, ID
kudos:1
reply to AlanSixSons

You might want to set up a Syslog server and capture data there as well.

I might contact D-Link support, level 2 and ask about the IGMP queries and see what they say.

Keep us posted.



AlanSixSons

@videotron.ca

I rebooted the DIR-655 last night.

Within 10 seconds of it coming up the IGMP query flood began and lasted 21 minutes and 13 seconds at about 20 queries/sec.

Then they resumed at a rate of 2 minutes and 5 seconds.

No other deluges have occurred.

I'd guess they've got a bug but it's a one off and harmless thing so not worth worrying about.

I'll stay with the current 2.07 firmware.

Thanks to all for your suggestions.



BimmerE38FN

join:2002-09-15
Boise, ID
kudos:1
Reviews:
·CableOne

2 edits
reply to AlanSixSons

Whats your ISP service? DSL or Cable?
Whats your modem of ISP modem? Does it have a built in router or is it stand alone? Some with built in routers can be problematic with external routers. If it's got a built in router, can it be bridged? If not, does it have a DMZ?

You sure its coming from the router? No other device?
»www.h3c.com/portal/Technical_Sup···85_0.htm

I would try v2.03 FW and see if it does the same thing and set up a syslog server. There are free syslog server program to capture the data. I don't think this is a bug since others don't seem to see this issue including mine.

Good luck.



AlanSixSons

@videotron.ca

Definitely out of the router since I can isolate to it alone using one or another PC. It's address is unmistakable regardless of "monitor" used while other devices are removed from the network.

I read the posts linked (your ref) and that seems to be a wild goose chase where they drew poor conclusions - does not match my case in any way.

As I've said, it deluges for 20 or minutes following a re-boot and then resumes a "normal" behaviour. It has not re-occurred (without a re-boot of the router).

That is sufficient unto the day. I certainly will not change the firmware over this.

Issue closed for me.



AlanSixSons

@videotron.ca
reply to BimmerE38FN

In addition:
- this bug occurs when the cable modem is physically disconnected.
- the router DMZ is off



BimmerE38FN

join:2002-09-15
Boise, ID
kudos:1
reply to AlanSixSons

Good luck.