• 0

Network Keeps Dropping off


Question

dipsylalapo

Hey everyone, 

 

I haven't touched my network setup in a long time as it's been working with no issues for months. 

 

Over the last week or so, I've noticed that some devices struggle to stay connected to the network. At the moment, there's a Kindle and a desktop that are struggling to stay connected. 

 

I've no idea where to start looking into this so any pointers would be great!

 

I have a USG, two Unifi APs (Lite) and a D-Link switch (DGS-1100-08P).

Link to post
Share on other sites

14 answers to this question

Recommended Posts

  • 0
Mindovermaster
Posted (edited)

These are wireless devices, (computers) I'm guessing? Could be your APs failing. Or somehow losing power. How old are the unifi APs?

 

Wait for Budman for further instructions. 😛 

Link to post
Share on other sites
  • 0
dipsylalapo
3 minutes ago, Mindovermaster said:

These are wireless devices, (computers) I'm guessing? Could be your APs failing. Or somehow losing power. How old are the unifi APs?

 

Wait for Budman for further instructions. 😛 

Yeah all wireless devices. Just over a 12 months old so I really hope not!

Link to post
Share on other sites
  • 0
adrynalyne
Posted (edited)
11 minutes ago, Mindovermaster said:

These are wireless devices, (computers) I'm guessing? Could be your APs failing. Or somehow losing power. How old are the unifi APs?

 

Wait for Budman for further instructions. 😛 

Multiple APs failing?🤨

@dipsylalapo

Start here: look at the events and alerts in the Unifi controller for clues. When is the last time you restarted your network equipment?
 

 

Link to post
Share on other sites
  • 0
dipsylalapo
2 minutes ago, adrynalyne said:

Multiple APs failing?🤨

@dipsylalapo

Start here: look at the events and alerts in the Unifi controller for clues. When is the last time you restarted your network equipment?
 

 

Just this morning, there was an update that was pushed. I don't think they two are connected as the timings don't match up.

 

Nothing specific in the alerts.

Link to post
Share on other sites
  • 0
dipsylalapo

So I think I've resolved it. I did some Googling and changed the DTIM period from 1 to 3. Not something that I'd changed or has been a problem before, but it seems to have resolved the issue.

 

The 18 or so devices that I have connected seem to be holding steady. Something that hasn't happened all day. 

 

Bizarre.

 

Edit - @BudManPlease stand down 😉

  • Haha 1
Link to post
Share on other sites
  • 0
Mindovermaster

Glad you got it sorted, bro! :) 

  • Thanks 1
Link to post
Share on other sites
  • 0
+BudMan

That makes no sense.. Changing the mode from 1 to 3 would allow devices to say sleep longer.. 3 allows for longer time period before multicast/broadcast traffic is sent..  And when the client should wake up so to speak and look for multicast traffic.. But can be problematic for batter life if they stay away for the longer period until the next beacon, etc..  Do you have a lot of multicast/broadcast traffic on the network?

 

This could be a red herring sort of "fix".. And the devices that are having the issues are non apple devices?

 

I would leave it at 3 for a few days, and then try setting it back to 1 - does the issue come back?

 

So the issue is they drop off, when their lease expires?  Since they can not get a new IP?  That could be related to why an increase in the dtim helped.. But points more to a problem with your dhcp server..

 

If you put it back, and see the problem - I would check to see what the lease time is, when client gets lease - and then when does it drop off?

Link to post
Share on other sites
  • 0
adrynalyne
1 hour ago, BudMan said:

That makes no sense.. Changing the mode from 1 to 3 would allow devices to say sleep longer.. 3 allows for longer time period before multicast/broadcast traffic is sent..  And when the client should wake up so to speak and look for multicast traffic.. But can be problematic for batter life if they stay away for the longer period until the next beacon, etc..  Do you have a lot of multicast/broadcast traffic on the network?

 

This could be a red herring sort of "fix".. And the devices that are having the issues are non apple devices?

 

I would leave it at 3 for a few days, and then try setting it back to 1 - does the issue come back?

 

So the issue is they drop off, when their lease expires?  Since they can not get a new IP?  That could be related to why an increase in the dtim helped.. But points more to a problem with your dhcp server..

 

If you put it back, and see the problem - I would check to see what the lease time is, when client gets lease - and then when does it drop off?

I bet he triggered a re-provision with the setting change  and that was what fixed whatever weird state the APs were in. 

Link to post
Share on other sites
  • 0
+BudMan

Quite possible sure..  It seems odd that changing dtim would have such an issue to be honest.. My guess is something to do with dhcp.. That could possibly be related..   Loss of lease would for sure drop a client off the network.

Link to post
Share on other sites
  • 0
dipsylalapo
On 5/9/2020 at 10:37 PM, BudMan said:

That makes no sense.. Changing the mode from 1 to 3 would allow devices to say sleep longer.. 3 allows for longer time period before multicast/broadcast traffic is sent..  And when the client should wake up so to speak and look for multicast traffic.. But can be problematic for batter life if they stay away for the longer period until the next beacon, etc..  Do you have a lot of multicast/broadcast traffic on the network?

 

This could be a red herring sort of "fix".. And the devices that are having the issues are non apple devices?

 

I would leave it at 3 for a few days, and then try setting it back to 1 - does the issue come back?

 

So the issue is they drop off, when their lease expires?  Since they can not get a new IP?  That could be related to why an increase in the dtim helped.. But points more to a problem with your dhcp server..

 

If you put it back, and see the problem - I would check to see what the lease time is, when client gets lease - and then when does it drop off?

Of course you were right :) Sorry missed these last few posts. The issue is back today. 

 

One of the devices (an iPad mini) still has the issue but another iOS device has joined the fray with random disconnects. 

 

I've set the DTIM back to 1 and I'll see what happens. Do you need to know the bits re. the DHCP now or after they have issues?

 

EDIT - So the iPad Mini is still not connecting. It has an IP on the lease table, due to expire 24 hours from now.

Link to post
Share on other sites
  • 0
dipsylalapo

So just an update on this it. The drop off seem to happen around the time the DHCP lease expires. It seems to take a few attempts or longer for it get an IP. 

Link to post
Share on other sites
  • 0
+BudMan

Yeah that would make more sense.. Whats your dhcp server - some ###### router?

 

To be honest 3 vs 1 on dtim would prob make that worse..  How exactly are you setup?  What is the layout of your network.. You said usg and some AP - but are the ap wired, or using wireless uplink to each other?  Never ran dhcp on the usg myself - running it at my sons place, but its only been a week or so - and to be honest just the little bit been over there setting stuff up, have seen some dhcp issues.. shrugged it off - because it worked after a bit, etc.

 

He just got a new place, and had a usgp3 on the shelf, told him he could have it - he got a flexHD for his AP.. And stuff reports to my controller so I can keep an eye on the network... But I can see getting him a pfsense box at some point..

 

I had that usg as my router for a few weeks, couldn't get rid off it fast enough if you ask me (sg4860 was on back order at the time).. While I love their AP.. And the usg is a great price point.. And has some great eye candy, etc.. Not overly impressed to be honest - the management is horrible for any sort of firewall rules, etc..

 

Wouldn't be surprised if issues with the dhcpd on it.. What firmware you running?

 

With a working dhcp as it suppose to, your lease should never get past the 50% mark, since that is when it renews.  So if you have a 24 hour lease, every 12 hours you should get a new 24 hour lease.. It should never get close to expired..   The closer it gets the more often it asks for renew.. Until finally it gives up, drops the lease and does a discover - you should never get there.  If you are, something is wrong.

 

If its doing that - then yeah you could see a disconnect from internet, and if taking a bit to get new one from discover - you could see some down time.

Link to post
Share on other sites
  • 0
dipsylalapo
On 5/13/2020 at 10:23 PM, BudMan said:

Yeah that would make more sense.. Whats your dhcp server - some ###### router?

 

From what I can tell that's all set to Auto/default at the moment.

Quote

To be honest 3 vs 1 on dtim would prob make that worse..  How exactly are you setup?  What is the layout of your network.. You said usg and some AP - but are the ap wired, or using wireless uplink to each other?  Never ran dhcp on the usg myself - running it at my sons place, but its only been a week or so - and to be honest just the little bit been over there setting stuff up, have seen some dhcp issues.. shrugged it off - because it worked after a bit, etc.

I have my cable modem attached to my USG  which is connected to a switch and the two APs are hardwired to this. Like below

image.thumb.png.1b82c6becc53012a4f1c992f50cee79e.png

On 5/13/2020 at 10:23 PM, BudMan said:

Wouldn't be surprised if issues with the dhcpd on it.. What firmware you running?

 

It's running 4.4.51.5287926 which is latest stable build

 

On 5/13/2020 at 10:23 PM, BudMan said:

With a working dhcp as it suppose to, your lease should never get past the 50% mark, since that is when it renews.  So if you have a 24 hour lease, every 12 hours you should get a new 24 hour lease.. It should never get close to expired..   The closer it gets the more often it asks for renew.. Until finally it gives up, drops the lease and does a discover - you should never get there.  If you are, something is wrong.

 

If its doing that - then yeah you could see a disconnect from internet, and if taking a bit to get new one from discover - you could see some down time.

Is there any way I can check/confirm this? Set a shorter lease time (say a few hours) and see what happens there?

 

On Saturday when I was looking into it a bit more I noticed that a machine we have flat out stopped connecting to the network because my wife was in the middle of something and needed to get going ASAP, I put together a new wireless network and move over the 2/3 devices that were having issues to it. Since then those devices have been fine. I'm going to do some digging today to see if I can see if there's a difference in the set up. 

 

Thanks again!

Link to post
Share on other sites
  • 0
+BudMan
On 5/18/2020 at 3:03 AM, dipsylalapo said:

Is there any way I can check/confirm this? Set a shorter lease time (say a few hours) and see what happens there?

That would be a good way to get your problem window into a shorter time frame from troubleshooting sure.

 

Do you have dhcp snooping enabled or not?  If you have it enabled have you setup the trusted dhcp server?

Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    No registered users viewing this page.

  • Similar Content

    • By Son_Of_Dad
      After many years of hard work my Netgear D6300 seems on it's last legs back when I purchase it I think my only wireless access was from phone, tablet & Xbox, now I have about 2 dozen devices I'm a bit concerned on the best way to migrate all of them? Would the quickest way be to connect the new router to the existing one so I can setup new SSID's then switch network in use through various phone apps? Since I'll likely be picking up another Netgear do they offer any utility to assist?
    • By Copernic
      Wireshark 3.2.6
      by Razvan Serea

      

      Wireshark is a network packet analyzer. A network packet analyzer will try to capture network packets and tries to display that packet data as detailed as possible. You could think of a network packet analyzer as a measuring device used to examine what's going on inside a network cable, just like a voltmeter is used by an electrician to examine what's going on inside an electric cable (but at a higher level, of course). In the past, such tools were either very expensive, proprietary, or both. However, with the advent of Wireshark, all that has changed. Wireshark is perhaps one of the best open source packet analyzers available today.

      Deep inspection of hundreds of protocols, with more being added all the time Live capture and offline analysis Standard three-pane packet browser Multi-platform: Runs on Windows, Linux, OS X, Solaris, FreeBSD, NetBSD, and many others Captured network data can be browsed via a GUI, or via the TTY-mode TShark utility The most powerful display filters in the industry Rich VoIP analysis Read/write many different capture file formats Capture files compressed with gzip can be decompressed on the fly Live data can be read from Ethernet, IEEE 802.11, PPP/HDLC, ATM, Bluetooth, USB, Token Ring, Frame Relay, FDDI, and others (depending on your platfrom) Decryption support for many protocols, including IPsec, ISAKMP, Kerberos, SNMPv3, SSL/TLS, WEP, and WPA/WPA2 Coloring rules can be applied to the packet list for quick, intuitive analysis Output can be exported to XML, PostScript®, CSV, or plain text Wireshark 3.2.6 changelog:

      The following vulnerabilities have been fixed

      wnpa-sec-2020-10 Kafka dissector crash. Bug 16672. CVE-2020-17498.

      The following bugs have been fixed



      Kafka dissector fails parsing FETCH responses. Bug 16623. Dissector for ASTERIX Category 001 / 210 does not recognize bit 1 as extension. Bug 16662. "invalid timestamp" for Systemd Journal Export Block. Bug 16664. Decoding Extended Emergency number list IE length. Bug 16668. Some macOS Bluetooth PacketLogger capture files aren’t recognized as PacketLogger files (regression, bisected). Bug 16670. Short IMSIs (5 digits) lead to wrong decoding+warning. Bug 16676. Decoding of PFCP IE 'PFD Contents' results in "malformed packet". Bug 16704. RFH2 Header with 32 or less bytes of NameValue will not parse out that info. Bug 16733. CDP: Port ID TLV followed by Type 1009 TLV triggers [Malformed Packet]. Bug 16742. tshark crashed when processing opcda. Bug 16746. tshark with --export-dicom gives “Segmentation fault (core dumped)”. Bug 16748. Updated Protocol Support

      ASTERIX, BSSAP, CDP, CoAP, DCERPC SPOOLSS, DCOM, DICOM, DVB-S2, E.212, GBCS, GSM RR, GSM SMS, IEEE 802.11, Kafka, MQ, Nano, NAS 5GS, NIS+, NR RRC, PacketLogger, PFCP, RTPS, systemd Journal, TDS, TN3270, and TN5250

      New and updated capture file support

      PacketLogger and pcapng

      Download: Wireshark 3.2.6 | Wireshark 64-bit | ~50.0 MB (Open Source)
      Download: Portable Wireshark 3.2.6 | Wireshark for macOS
      View: Wireshark Website | Wireshark 3.2.6 changelog

      Get alerted to all of our Software updates on Twitter at @NeowinSoftware

    • By Copernic
      Wireshark 3.2.4
      by Razvan Serea

      

      Wireshark is a network packet analyzer. A network packet analyzer will try to capture network packets and tries to display that packet data as detailed as possible. You could think of a network packet analyzer as a measuring device used to examine what's going on inside a network cable, just like a voltmeter is used by an electrician to examine what's going on inside an electric cable (but at a higher level, of course). In the past, such tools were either very expensive, proprietary, or both. However, with the advent of Wireshark, all that has changed. Wireshark is perhaps one of the best open source packet analyzers available today.

      Deep inspection of hundreds of protocols, with more being added all the time Live capture and offline analysis Standard three-pane packet browser Multi-platform: Runs on Windows, Linux, OS X, Solaris, FreeBSD, NetBSD, and many others Captured network data can be browsed via a GUI, or via the TTY-mode TShark utility The most powerful display filters in the industry Rich VoIP analysis Read/write many different capture file formats Capture files compressed with gzip can be decompressed on the fly Live data can be read from Ethernet, IEEE 802.11, PPP/HDLC, ATM, Bluetooth, USB, Token Ring, Frame Relay, FDDI, and others (depending on your platfrom) Decryption support for many protocols, including IPsec, ISAKMP, Kerberos, SNMPv3, SSL/TLS, WEP, and WPA/WPA2 Coloring rules can be applied to the packet list for quick, intuitive analysis Output can be exported to XML, PostScript®, CSV, or plain text Wireshark 3.2.4 changelog:

      The following vulnerabilities have been fixed

      wnpa-sec-2020-08 The NFS dissector could crash. Bug 16476.

      The following bugs have been fixed

      SDP dissector does not parse sprop-parameter-sets field. Bug 16322. PVS-Studio analyser long list of issues. Bug 16335. Can’t have duplicate personal and global profile names. Bug 16423. pcapng file dissector incorrectly computes nanoseconds from timestamps because it assumes the resolution is in nanoseconds. Bug 16440. Read of uninitialized memory in detect_camins_file. Bug 16458. Read of uninitialized memory in lanalyzer_read_trace_record. Bug 16459. capture -> options -> select interface -> (choose) -> SEGV. Bug 16489. SOMEIP: SOME/IP dissector ignores the length field configuration of structs. Bug 16490. Packet List Pane doesn’t consume the entire pane. Bug 16491. Range parameter on numeric parameter in extcap plugin doesn’t work. Bug 16510. Export Packet Dissections not working on Windows (Wireshark 3.2.x). Bug 16516. capinfos "Capture duration" output is truncated if there are more than 11 digits of seconds and fractions of a second. Bug 16519. MIME Files Format/pcapng: Simple Packet Block parsed incorrectly. Bug 16526. SOMEIP: SOME/IP-SD unique id is not unique for eventgroup types (BUG). Bug 16549. Buildbot crash output: fuzz-2020-05-13-12195.pcap. Bug 16564. Updated Protocol Support

      AoE, APRS, ASN.1 BER, DIS, DTLS, FTP, GSM SMS, H.264, IMAP, Infiniband, ISObus VT, Kafka, LSD, MAC LTE, NAS 5GS, NFS, ONC RPC, OSC, pcapng, PDCP LTE, RADIUS, RLC LTE, RTSP, SDP, SIP, Snort, SOMEIP, STUN, TLS, and UMTS FP New and updated capture file support

      Camins, Catapult DCT 2000, Lanalyzer, and MPEG

      Download: Wireshark 3.2.4 | Wireshark 64-bit | ~50.0 MB (Open Source)
      Download: Portable Wireshark 3.2.4 | Wireshark for macOS
      View: Wireshark Website | Wireshark 3.2.4 changelog

      Get alerted to all of our Software updates on Twitter at @NeowinSoftware

    • By News Staff
      Get the Ultimate Cybersecurity Certification Bundle for only $39.99
      by Steven Parker



      Today's highlighted deal comes via our Online Courses section of the Neowin Deals store, where you can save 52% off the Ultimate Cybersecurity Certification Bundle. Your 28-hour roadmap as an ultimate security professional — Master network monitoring, PenTesting, and routing techniques and vulnerabilities.

      What's the deal?
      This deal consists of the following courses:

      Parsing TCP Socket Data with C/C++
      Understand Socket Programming & Build Apps in Your Network or Internet Introduction of C++ Sockets
      Learn the Most Fundamental & Practical IT Communications & Develop Your Own Socket Apps How Hackers Find SQL Injections in Minutes with Sqlmap
      Effectively Detect & Exploit SQL Injection Vulnerabilities — Ideal for Penetration Testers, Ethical Hackers, Bug Hunters, and More How Web Hackers Make Big Money: Remote Code Execution
      Become a Succesful RCE Hunter with 1-Hour Crash Course from Top Hacker Dawid Czagan Double Your Web Hacking Rewards with Fuzzing
      Learn the Vulnerability Detection Technique Used by Many Successful Hackers & Make Money in Bug Bounty Programs Practical Blockchain & Smart Contracts: Ethereum and Solidity
      Implement Blockchain in Your Software Projects & Upcoming Project Ideas CCNP Routing & Switching ROUTE300-101
      Join the Professional World of Cisco Systems & Gain a Higher Level of Routing Competence Setting up Nagios 4 Monitoring
      Set Up a Monitoring Console Showing the Health of Multiple Remote Servers The Ethical Hacking MasterClass
      Perform Advanced Penetration Testing, Exploit Vulnerable Systems & Patch Them Good to know
      Length of access: lifetime Certification of completion included Redemption deadline: redeem your code within 30 days of purchase For full descriptions, terms, and instructor info please click here.

      What's the benefit?
      This Ultimate Cybersecurity Certification Bundle normally costs $84.91 but it can be yours for just $39.99 for a limited time, that's a saving of $44.92 (54%) off!

      >> Get this deal, or learn more about it <<
      See all Online Courses on offer, This is a time-limited deal, ending soon!
      Get $1 credit for every $25 spent · Give $10, Get $10 · 10% off for first-time buyers.

      Not for you?
      If this offer doesn't interest you, why not check out the following offers:

      The Samsung Galaxy Z Flip 256GB Giveaway 20% off Ivacy VPN subscription with coupon code IVACY20 NordVPN subscription at up to 70% off Private Internet Access VPN subscription at up to 71% off Unlocator VPN or SmartDNS unblock Geoblock with 7-day free trial Disable Sponsored posts · Other recent deals · Preferred partner software

      Disclosure: This is a StackCommerce deal or giveaway in partnership with Neowin; an account at StackCommerce is required to participate in any deals or giveaways. For a full description of StackCommerce's privacy guidelines, go here. Neowin benefits from shared revenue of each sale made through our branded deals site, and it all goes toward the running costs.

    • By Copernic
      Wireshark 3.2.3
      by Razvan Serea

      

      Wireshark is a network packet analyzer. A network packet analyzer will try to capture network packets and tries to display that packet data as detailed as possible. You could think of a network packet analyzer as a measuring device used to examine what's going on inside a network cable, just like a voltmeter is used by an electrician to examine what's going on inside an electric cable (but at a higher level, of course). In the past, such tools were either very expensive, proprietary, or both. However, with the advent of Wireshark, all that has changed. Wireshark is perhaps one of the best open source packet analyzers available today.

      Deep inspection of hundreds of protocols, with more being added all the time Live capture and offline analysis Standard three-pane packet browser Multi-platform: Runs on Windows, Linux, OS X, Solaris, FreeBSD, NetBSD, and many others Captured network data can be browsed via a GUI, or via the TTY-mode TShark utility The most powerful display filters in the industry Rich VoIP analysis Read/write many different capture file formats Capture files compressed with gzip can be decompressed on the fly Live data can be read from Ethernet, IEEE 802.11, PPP/HDLC, ATM, Bluetooth, USB, Token Ring, Frame Relay, FDDI, and others (depending on your platfrom) Decryption support for many protocols, including IPsec, ISAKMP, Kerberos, SNMPv3, SSL/TLS, WEP, and WPA/WPA2 Coloring rules can be applied to the packet list for quick, intuitive analysis Output can be exported to XML, PostScript®, CSV, or plain text Wireshark 3.2.3 changelog:

      The following vulnerabilities have been fixed

      wnpa-sec-2020-07 The BACapp dissector could crash. Bug 16474. CVE-2020-11647. The following bugs have been fixed

      Add (IETF) QUIC Dissector. Bug 13881. Rename profile name loses list selection. Bug 15966. Dissector bug warning dissecting TLS Certificate Request with many names. Bug 16202. Only ACKs, but no DATA frames are visible in -> TCP Stream Graph -> Time Sequence (tcptrace). Bug 16281. Copy>Description does not work properly for all tree items. Bug 16323. Importing profiles in Windows - zip files fail and from directory crashes Wireshark. Bug 16410. Packet List selection is gone when adding or removing a display filter. Bug 16414. Check for updates, and auto-update, not working in 3.2.1. Bug 16416. f5ethtrailer: TLS trailer creates incorrect CLIENT keylog entries. Bug 16417. Buildbot crash output: randpkt-2020-03-04-18423.pcap. Bug 16424. File open dialog shows garbled time stamps. Bug 16429. RTCP Bye without optional reason reported as [Malformed Packet]. Bug 16434. [oss-fuzz] #20732: Undefined-shift in dissect_rtcp. Bug 16445. SOMEIP: SOME/IP-SD dissector fails to register SOME/IP ports, if IPv6 is being used (BUG). Bug 16448. tshark logs: "…​could not be opened: Too many open files.". Bug 16457. Typo in About Wireshark > Keyboard Shortcuts > Unignore All Displayed. Bug 16472. Buildbot crash output: randpkt-2020-04-02-31746.pcap. Bug 16477. Updated Protocol Support



      AFS, BACapp, Bluetooth, CoAP, Diameter3GPP, F5 Ethernet trailer, GSM RLC MAC, ISIS, ISIS CLV, ISIS HELLO, ISIS LSP, ISIS SNP, NAS 5GS, NR RRC, pcap, QUIC, RPCAP, RTCP, SOME/IP-SD, TLS, and WSP New and updated capture file support

      pcap

      Download: Wireshark 3.2.3 | Wireshark 64-bit | ~50.0 MB (Open Source)
      Download: Portable Wireshark 3.2.3 | Wireshark for macOS
      View: Wireshark Website | Wireshark 3.2.3 changelog

      Get alerted to all of our Software updates on Twitter at @NeowinSoftware