<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.EmailStyle18
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-AU link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D;mso-fareast-language:EN-US'>I’ll have another look at actual router level access from the WAN but I’d still see it in my netflow collection from that interface.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D;mso-fareast-language:EN-US'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D;mso-fareast-language:EN-US'>I’m 99.99% percent it isn’t coming from me or even to me directly, I thought the same as you and did a lot of digging to double check.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D;mso-fareast-language:EN-US'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D;mso-fareast-language:EN-US'>I have both SNMP and Netflow monitoring and logging configured on the modem and neither show any significant activity during these time periods on either the up or the downstream. <o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D;mso-fareast-language:EN-US'><o:p> </o:p></span></p><div><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Thanks,<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#333333'>Ayden Beeson<i> </i></span><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p></o:p></span></p></div><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D;mso-fareast-language:EN-US'><o:p> </o:p></span></p><div><div style='border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm'><p class=MsoNormal><b><span lang=EN-US style='font-size:11.0pt;font-family:"Calibri","sans-serif"'>From:</span></b><span lang=EN-US style='font-size:11.0pt;font-family:"Calibri","sans-serif"'> Nathan Brookfield [mailto:Nathan.Brookfield@simtronic.com.au] <br><b>Sent:</b> Wednesday, 10 September 2014 1:46 PM<br><b>To:</b> Beeson, Ayden<br><b>Cc:</b> ausnog@lists.ausnog.net<br><b>Subject:</b> Re: [AusNOG] Strange ADSL problem - troubleshooting / diagnosis advice wanted<o:p></o:p></span></p></div></div><p class=MsoNormal><o:p> </o:p></p><div><p class=MsoNormal>Have you requested an IP Address change (If Static), it sounds like someone is pushing some traffic towards your WAN and flooding the connection.<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal style='margin-bottom:12.0pt'>Alternatively you have an impacted machine being used as part of a botnet and it is smashing your upstream pipe.<o:p></o:p></p><div><p class=MsoNormal>Kindest Regards,<o:p></o:p></p></div><p class=MsoNormal>Nathan Brookfield <o:p></o:p></p><div><p class=MsoNormal><o:p> </o:p></p><div><p class=MsoNormal>Chief Executive Officer<o:p></o:p></p></div><div><p class=MsoNormal><span style='font-size:13.0pt'>Simtronic Technologies Pty Ltd</span><o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>Web: <a href="http://simtronic.com.au">http://simtronic.com.au</a><o:p></o:p></p></div><div><p class=MsoNormal>Phone: 1300 592 330<o:p></o:p></p></div><div><p class=MsoNormal>Fax: (02) 4749 4950<o:p></o:p></p></div></div></div><div><p class=MsoNormal style='margin-bottom:12.0pt'><br>On 10 Sep 2014, at 13:24, "Beeson, Ayden" <<a href="mailto:ABeeson@csu.edu.au">ABeeson@csu.edu.au</a>> wrote:<o:p></o:p></p></div><div><p class=MsoNormal>Hey everybody,<br><br>Firstly let me start by saying - This is a residential ADSL question, but I'm asking on the list as I'm looking for some specific DSL troubleshooting tips I may not be aware of / a better understanding of the network from the DSLAM onwards. I hope this email is not considered inappropriate for the list, I have lodged it with my ISP already (Exetel, via a Telstra wholesale ADSL2+ DSLAM connection) but I have a feeling given the strangeness of this one I'm in for a bit of a tough time to get it fixed. I'm not here to harass my ISP who may or may not have people on this list, nor beg for assistance etc, this is more of a general "here's a weird one, anybody got any thoughts?" kind of deal.<br><br>With that said, onto the problem and questions:<br><br>The problem:<br>Most nights (and potentially during the day, I'm not sure as I'm not at home to see it) my internet connection is working fine (I sync at around 16-17 mbit, so pretty decent) when all of a sudden my connection becomes almost unusable. It presents like congestion, but far more severe and almost instantly, with most TCP applications completely failing to work (i.e. can't load even my ISP's homepage due to connection timeouts) and UDP applications working very poorly, often only receiving data in occasional bursts every 10-30 seconds.<br><br>Voice communications (TeamSpeak in this case) work poorly but do get consistent data through, though the jitter makes it unusable and it often drops out too.<br><br>The connection goes from 100% fine to 1% functional in the space of about 2-5 seconds, but then stays like that for anywhere between 1 - 10 minutes.<br><br>So far I have done the basic things, check my modem, attenuation, ping checks, traceroutes etc. I have also confirmed my network is not using the link (both my SNMP and netflow from my modem indicate I'm using very little to 0 data before and during the "event") and the traceroutes look the same both when its fine and when its broken (other than the dropped packets and failed timed out lookups when its broken), the one thing I have noticed consistently is that the latency between my modem and the next L3 hop goes from a normal 29ms to 60ms.<br><br>The traceroutes or pings to <a href="http://www.exetel.com.au">www.exetel.com.au</a> (figured it was best to check with an ISP internal host) all show this latency increase, but the latency doesn't jump around, which is another reason I don't believe its congestion related. It is always 29ms when working fine, and always 60ms when it's playing up.<br><br>Given the next hop is beyond the dslam and who knows where (Sydney I'm guessing, my experience with production DSL networks is purely a customer level view) I have no visibility as to what is occurring there, but from all the things I can see, it's not my network causing it. A modem restart doesn't seem to resolve it, though it's hard to tell seeing as my modem takes a few minutes to boot, it's often "resolved" before my modem comes back. I'm pretty sure a few times it was still broken briefly after my modem came back as well and it does resolve itself without my rebooting my modem too.<br><br>On the topic, my modem is a Cisco 887 running an IOS 15 version that was mostly / completely up to date when I last checked, though that was a little while ago. I have checked processor usage, memory, attenuation / noise, audible line quality (via the POTS phone) as well as the basic IP troubleshooting and log checks, nothing is coming up at all that would indicate a problem on my end.<br><br>The Questions:<br>1. Any ideas what might be causing this issue that could still on my end? I have checked all the obvious things, IP wise its rock solid, so it'd have to be on the DSL side, though nothing has changed on my gear for a long long time now.<br>2. Any ideas what might cause behaviour like this on the provider side? Anything I could suggest they look at in particular?<br>3. Any additional commands / checks I can do on my equipment to confirm / assist in diagnosing anything from items 1 or 2?<br><br>I had not had this problem in the past, my copper line seems to be in very good condition as I very rarely experience any dropouts or disconnections at all, this has just started recently and as of last night seems to possibly be getting worse...<br><br>Any advice / general theories are welcome :)<br><br>Thanks,<br>Ayden Beeson B.InfoTech, CCNA<br>Technology Specialist (Networks)<br>Division Of Information Technology<br>Charles Sturt University<br>P.O. Box 789<br>Albury NSW 2640<br>Ph :02 60519788<br>Fax:02 60519919<br><a href="mailto:abeeson@csu.edu.au">abeeson@csu.edu.au</a><br><a href="http://www.csu.edu.au">www.csu.edu.au</a><br><br>Charles Sturt University<br><br>| ALBURY-WODONGA | BATHURST | CANBERRA | DUBBO | GOULBURN | MELBOURNE | ONTARIO | ORANGE | PORT MACQUARIE | SYDNEY | WAGGA WAGGA |<br><br>LEGAL NOTICE<br>This email (and any attachment) is confidential and is intended for the use of the addressee(s) only. If you are not the intended recipient of this email, you must not copy, distribute, take any action in reliance on it or disclose it to anyone. Any confidentiality is not waived or lost by reason of mistaken delivery. Email should be checked for viruses and defects before opening. Charles Sturt University (CSU) does not accept liability for viruses or any consequence which arise as a result of this email transmission. Email communications with CSU may be subject to automated email filtering, which could result in the delay or deletion of a legitimate email before it is read at CSU. The views expressed in this email are not necessarily those of CSU.<br><br>Charles Sturt University in Australia <a href="http://www.csu.edu.au">http://www.csu.edu.au</a> The Grange Chancellery, Panorama Avenue, Bathurst NSW Australia 2795 (ABN: 83 878 708 551; CRICOS Provider Numbers: 00005F (NSW), 01947G (VIC), 02960B (ACT)). TEQSA Provider Number: PV12018<br><br>Charles Sturt University in Ontario <a href="http://www.charlessturt.ca">http://www.charlessturt.ca</a> 860 Harrington Court, Burlington Ontario Canada L7N 3N4 Registration: <a href="http://www.peqab.ca">www.peqab.ca</a><br><br>Consider the environment before printing this email.<br>_______________________________________________<br>AusNOG mailing list<br><a href="mailto:AusNOG@lists.ausnog.net">AusNOG@lists.ausnog.net</a><br><a href="http://lists.ausnog.net/mailman/listinfo/ausnog">http://lists.ausnog.net/mailman/listinfo/ausnog</a><o:p></o:p></p></div></div>
<P><A title="Charles Sturt University" href="http://www.csu.edu.au/"><IMG
border=0 alt="Charles Sturt University"
src="cid:csu-logo6cf4.bmp"></A></P>
<P
style="FONT-FAMILY: Arial, Helvetica, sans-serif; COLOR: #c42129; FONT-SIZE: 8px">| ALBURY-WODONGA | BATHURST | CANBERRA | DUBBO | GOULBURN | MELBOURNE | ONTARIO | ORANGE | PORT
MACQUARIE | SYDNEY | WAGGA
WAGGA |</P>
<HR>
<SPAN
style="FONT-FAMILY: Arial, Helvetica, sans-serif; FONT-SIZE: 9px; FONT-WEIGHT: bold">LEGAL
NOTICE</SPAN><BR><SPAN
style="FONT-FAMILY: Arial, Helvetica, sans-serif; FONT-SIZE: 9px">This email
(and any attachment) is confidential and is intended for the use of the
addressee(s) only. If you are not the intended recipient of this email, you must
not copy, distribute, take any action in reliance on it or disclose it to
anyone. Any confidentiality is not waived or lost by reason of mistaken
delivery. Email should be checked for viruses and defects before opening.
Charles Sturt University (CSU) does not accept liability for viruses or any
consequence which arise as a result of this email transmission. Email
communications with CSU may be subject to automated email filtering, which could
result in the delay or deletion of a legitimate email before it is read at CSU.
The views expressed in this email are not necessarily those of CSU.</SPAN>
<P style="FONT-FAMILY: Arial, Helvetica, sans-serif; FONT-SIZE: 9px"><A
style="COLOR: #c42129" href="http://www.csu.edu.au">Charles Sturt University in
Australia</A> The Grange Chancellery, Panorama Avenue, Bathurst NSW Australia
2795 (ABN: 83 878 708 551; CRICOS Provider Number: 00005F (National)). TEQSA
Provider Number: PV12018 <BR><A style="COLOR: #c42129"
href="http://www.charlessturt.ca/">Charles Sturt University in Ontario</A> 860
Harrington Court, Burlington Ontario Canada L7N 3N4 Registration: <A
style="COLOR: #c42129" href="http://www.peqab.ca">www.peqab.ca</A></P>
<P style="FONT-FAMILY: Arial, Helvetica, sans-serif; FONT-SIZE: 9px"><IMG
style="WIDTH: 79px; HEIGHT: 66px" border=0 hspace=0 alt=""
src="cid:anniversay5f45.bmp"
width=124 height=99></P><SPAN
style="FONT-FAMILY: Arial, Helvetica, sans-serif; FONT-SIZE: 9px">Consider the
environment before printing this email.</SPAN> <br></body></html>