• 0

Network Keeps Dropping off


Question

dipsylalapo

Hey everyone, 

 

I haven't touched my network setup in a long time as it's been working with no issues for months. 

 

Over the last week or so, I've noticed that some devices struggle to stay connected to the network. At the moment, there's a Kindle and a desktop that are struggling to stay connected. 

 

I've no idea where to start looking into this so any pointers would be great!

 

I have a USG, two Unifi APs (Lite) and a D-Link switch (DGS-1100-08P).

Link to post
Share on other sites

14 answers to this question

Recommended Posts

  • 0
Mindovermaster

These are wireless devices, (computers) I'm guessing? Could be your APs failing. Or somehow losing power. How old are the unifi APs?

 

Wait for Budman for further instructions. 😛 

Link to post
Share on other sites
  • 0
dipsylalapo
3 minutes ago, Mindovermaster said:

These are wireless devices, (computers) I'm guessing? Could be your APs failing. Or somehow losing power. How old are the unifi APs?

 

Wait for Budman for further instructions. 😛 

Yeah all wireless devices. Just over a 12 months old so I really hope not!

Link to post
Share on other sites
  • 0
adrynalyne
11 minutes ago, Mindovermaster said:

These are wireless devices, (computers) I'm guessing? Could be your APs failing. Or somehow losing power. How old are the unifi APs?

 

Wait for Budman for further instructions. 😛 

Multiple APs failing?🤨

@dipsylalapo

Start here: look at the events and alerts in the Unifi controller for clues. When is the last time you restarted your network equipment?
 

 

Link to post
Share on other sites
  • 0
dipsylalapo
2 minutes ago, adrynalyne said:

Multiple APs failing?🤨

@dipsylalapo

Start here: look at the events and alerts in the Unifi controller for clues. When is the last time you restarted your network equipment?
 

 

Just this morning, there was an update that was pushed. I don't think they two are connected as the timings don't match up.

 

Nothing specific in the alerts.

Link to post
Share on other sites
  • 0
dipsylalapo

So I think I've resolved it. I did some Googling and changed the DTIM period from 1 to 3. Not something that I'd changed or has been a problem before, but it seems to have resolved the issue.

 

The 18 or so devices that I have connected seem to be holding steady. Something that hasn't happened all day. 

 

Bizarre.

 

Edit - @BudManPlease stand down 😉

  • Haha 1
Link to post
Share on other sites
  • 0
Mindovermaster

Glad you got it sorted, bro! :) 

  • Thanks 1
Link to post
Share on other sites
  • 0
+BudMan

That makes no sense.. Changing the mode from 1 to 3 would allow devices to say sleep longer.. 3 allows for longer time period before multicast/broadcast traffic is sent..  And when the client should wake up so to speak and look for multicast traffic.. But can be problematic for batter life if they stay away for the longer period until the next beacon, etc..  Do you have a lot of multicast/broadcast traffic on the network?

 

This could be a red herring sort of "fix".. And the devices that are having the issues are non apple devices?

 

I would leave it at 3 for a few days, and then try setting it back to 1 - does the issue come back?

 

So the issue is they drop off, when their lease expires?  Since they can not get a new IP?  That could be related to why an increase in the dtim helped.. But points more to a problem with your dhcp server..

 

If you put it back, and see the problem - I would check to see what the lease time is, when client gets lease - and then when does it drop off?

Link to post
Share on other sites
  • 0
adrynalyne
1 hour ago, BudMan said:

That makes no sense.. Changing the mode from 1 to 3 would allow devices to say sleep longer.. 3 allows for longer time period before multicast/broadcast traffic is sent..  And when the client should wake up so to speak and look for multicast traffic.. But can be problematic for batter life if they stay away for the longer period until the next beacon, etc..  Do you have a lot of multicast/broadcast traffic on the network?

 

This could be a red herring sort of "fix".. And the devices that are having the issues are non apple devices?

 

I would leave it at 3 for a few days, and then try setting it back to 1 - does the issue come back?

 

So the issue is they drop off, when their lease expires?  Since they can not get a new IP?  That could be related to why an increase in the dtim helped.. But points more to a problem with your dhcp server..

 

If you put it back, and see the problem - I would check to see what the lease time is, when client gets lease - and then when does it drop off?

I bet he triggered a re-provision with the setting change  and that was what fixed whatever weird state the APs were in. 

Link to post
Share on other sites
  • 0
+BudMan

Quite possible sure..  It seems odd that changing dtim would have such an issue to be honest.. My guess is something to do with dhcp.. That could possibly be related..   Loss of lease would for sure drop a client off the network.

Link to post
Share on other sites
  • 0
dipsylalapo
On 5/9/2020 at 10:37 PM, BudMan said:

That makes no sense.. Changing the mode from 1 to 3 would allow devices to say sleep longer.. 3 allows for longer time period before multicast/broadcast traffic is sent..  And when the client should wake up so to speak and look for multicast traffic.. But can be problematic for batter life if they stay away for the longer period until the next beacon, etc..  Do you have a lot of multicast/broadcast traffic on the network?

 

This could be a red herring sort of "fix".. And the devices that are having the issues are non apple devices?

 

I would leave it at 3 for a few days, and then try setting it back to 1 - does the issue come back?

 

So the issue is they drop off, when their lease expires?  Since they can not get a new IP?  That could be related to why an increase in the dtim helped.. But points more to a problem with your dhcp server..

 

If you put it back, and see the problem - I would check to see what the lease time is, when client gets lease - and then when does it drop off?

Of course you were right :) Sorry missed these last few posts. The issue is back today. 

 

One of the devices (an iPad mini) still has the issue but another iOS device has joined the fray with random disconnects. 

 

I've set the DTIM back to 1 and I'll see what happens. Do you need to know the bits re. the DHCP now or after they have issues?

 

EDIT - So the iPad Mini is still not connecting. It has an IP on the lease table, due to expire 24 hours from now.

Link to post
Share on other sites
  • 0
dipsylalapo

So just an update on this it. The drop off seem to happen around the time the DHCP lease expires. It seems to take a few attempts or longer for it get an IP. 

Link to post
Share on other sites
  • 0
+BudMan

Yeah that would make more sense.. Whats your dhcp server - some ###### router?

 

To be honest 3 vs 1 on dtim would prob make that worse..  How exactly are you setup?  What is the layout of your network.. You said usg and some AP - but are the ap wired, or using wireless uplink to each other?  Never ran dhcp on the usg myself - running it at my sons place, but its only been a week or so - and to be honest just the little bit been over there setting stuff up, have seen some dhcp issues.. shrugged it off - because it worked after a bit, etc.

 

He just got a new place, and had a usgp3 on the shelf, told him he could have it - he got a flexHD for his AP.. And stuff reports to my controller so I can keep an eye on the network... But I can see getting him a pfsense box at some point..

 

I had that usg as my router for a few weeks, couldn't get rid off it fast enough if you ask me (sg4860 was on back order at the time).. While I love their AP.. And the usg is a great price point.. And has some great eye candy, etc.. Not overly impressed to be honest - the management is horrible for any sort of firewall rules, etc..

 

Wouldn't be surprised if issues with the dhcpd on it.. What firmware you running?

 

With a working dhcp as it suppose to, your lease should never get past the 50% mark, since that is when it renews.  So if you have a 24 hour lease, every 12 hours you should get a new 24 hour lease.. It should never get close to expired..   The closer it gets the more often it asks for renew.. Until finally it gives up, drops the lease and does a discover - you should never get there.  If you are, something is wrong.

 

If its doing that - then yeah you could see a disconnect from internet, and if taking a bit to get new one from discover - you could see some down time.

Link to post
Share on other sites
  • 0
dipsylalapo
On 5/13/2020 at 10:23 PM, BudMan said:

Yeah that would make more sense.. Whats your dhcp server - some ###### router?

 

From what I can tell that's all set to Auto/default at the moment.

Quote

To be honest 3 vs 1 on dtim would prob make that worse..  How exactly are you setup?  What is the layout of your network.. You said usg and some AP - but are the ap wired, or using wireless uplink to each other?  Never ran dhcp on the usg myself - running it at my sons place, but its only been a week or so - and to be honest just the little bit been over there setting stuff up, have seen some dhcp issues.. shrugged it off - because it worked after a bit, etc.

I have my cable modem attached to my USG  which is connected to a switch and the two APs are hardwired to this. Like below

image.thumb.png.1b82c6becc53012a4f1c992f50cee79e.png

On 5/13/2020 at 10:23 PM, BudMan said:

Wouldn't be surprised if issues with the dhcpd on it.. What firmware you running?

 

It's running 4.4.51.5287926 which is latest stable build

 

On 5/13/2020 at 10:23 PM, BudMan said:

With a working dhcp as it suppose to, your lease should never get past the 50% mark, since that is when it renews.  So if you have a 24 hour lease, every 12 hours you should get a new 24 hour lease.. It should never get close to expired..   The closer it gets the more often it asks for renew.. Until finally it gives up, drops the lease and does a discover - you should never get there.  If you are, something is wrong.

 

If its doing that - then yeah you could see a disconnect from internet, and if taking a bit to get new one from discover - you could see some down time.

Is there any way I can check/confirm this? Set a shorter lease time (say a few hours) and see what happens there?

 

On Saturday when I was looking into it a bit more I noticed that a machine we have flat out stopped connecting to the network because my wife was in the middle of something and needed to get going ASAP, I put together a new wireless network and move over the 2/3 devices that were having issues to it. Since then those devices have been fine. I'm going to do some digging today to see if I can see if there's a difference in the set up. 

 

Thanks again!

Link to post
Share on other sites
  • 0
+BudMan
On 5/18/2020 at 3:03 AM, dipsylalapo said:

Is there any way I can check/confirm this? Set a shorter lease time (say a few hours) and see what happens there?

That would be a good way to get your problem window into a shorter time frame from troubleshooting sure.

 

Do you have dhcp snooping enabled or not?  If you have it enabled have you setup the trusted dhcp server?

Link to post
Share on other sites
This topic is now closed to further replies.
  • Recently Browsing   0 members

    No registered users viewing this page.

  • Similar Content

    • By Barney T.
      This topic is for the placement of links to how-to articles, tips, FAQs, or helpful information related to internet, network, and security. Please post links to the actual articles.
       
      Internet Basics
       
      Test Your connection speed! Alternate connection speed test  
       
      Networking Basics
       
      What is a good network configuration?  
       
      Security Basics
       
      http://www.us-cert.gov/ http://osvdb.org/ http://www.sans.org/ http://nvd.nist.gov/ http://cve.mitre.org/  
             Security Tools
       
      http://nmap.org/ http://www.tenable.com/products/nessus http://ettercap.github.io/ettercap/ http://www.wireshark.org/          Security Tools for basic users:
       
      http://technet.microsoft.com/en-US/security/cc184924.aspx http://www.microsoft.com/en-us/download/details.aspx?id=39273  
       
      FAQ's
    • By Copernic
      Wireshark 3.4.6
      by Razvan Serea

      

      Wireshark is a network packet analyzer. A network packet analyzer will try to capture network packets and tries to display that packet data as detailed as possible. You could think of a network packet analyzer as a measuring device used to examine what's going on inside a network cable, just like a voltmeter is used by an electrician to examine what's going on inside an electric cable (but at a higher level, of course). In the past, such tools were either very expensive, proprietary, or both. However, with the advent of Wireshark, all that has changed. Wireshark is perhaps one of the best open source packet analyzers available today.

      Deep inspection of hundreds of protocols, with more being added all the time Live capture and offline analysis Standard three-pane packet browser Multi-platform: Runs on Windows, Linux, OS X, Solaris, FreeBSD, NetBSD, and many others Captured network data can be browsed via a GUI, or via the TTY-mode TShark utility The most powerful display filters in the industry Rich VoIP analysis Read/write many different capture file formats Capture files compressed with gzip can be decompressed on the fly Live data can be read from Ethernet, IEEE 802.11, PPP/HDLC, ATM, Bluetooth, USB, Token Ring, Frame Relay, FDDI, and others (depending on your platfrom) Decryption support for many protocols, including IPsec, ISAKMP, Kerberos, SNMPv3, SSL/TLS, WEP, and WPA/WPA2 Coloring rules can be applied to the packet list for quick, intuitive analysis Output can be exported to XML, PostScript®, CSV, or plain text Wireshark 3.4.6 bug fixes:



      wnpa-sec-2021-04 DVB-S2-BB dissector infinite loop The following bugs have been fixed:

      Macro filters can’t handle escaped characters Issue 17160. Display filter crashes Wireshark Issue 17316. IEEE-1588 Signalling Unicast TLV incorrectly reported as being malformed Issue 17355. IETF QUIC TLS decryption error with extraneous packets during the handshake Issue 17383. Statistics → Resolved Addresses: multi-protocol (TCP/UDP/…​) ports not displayed Issue 17395. Updated Protocol Support

      DNP, DVB-S2-BB, ProtoBuf, PTP, QUIC, RANAP, and TACACS New and Updated Capture File Support

      Ascend, ERF, K12, NetScaler, and pcapng Download: Wireshark 3.4.6 | Wireshark 64-bit | ~50.0 MB (Open Source)
      Download: Portable Wireshark 3.4.6 | Wireshark for macOS
      View: Wireshark Website | Wireshark 3.4.6 changelog

      Get alerted to all of our Software updates on Twitter at @NeowinSoftware

    • By Copernic
      Wireshark 3.4.5
      by Razvan Serea

      

      Wireshark is a network packet analyzer. A network packet analyzer will try to capture network packets and tries to display that packet data as detailed as possible. You could think of a network packet analyzer as a measuring device used to examine what's going on inside a network cable, just like a voltmeter is used by an electrician to examine what's going on inside an electric cable (but at a higher level, of course). In the past, such tools were either very expensive, proprietary, or both. However, with the advent of Wireshark, all that has changed. Wireshark is perhaps one of the best open source packet analyzers available today.

      Deep inspection of hundreds of protocols, with more being added all the time Live capture and offline analysis Standard three-pane packet browser Multi-platform: Runs on Windows, Linux, OS X, Solaris, FreeBSD, NetBSD, and many others Captured network data can be browsed via a GUI, or via the TTY-mode TShark utility The most powerful display filters in the industry Rich VoIP analysis Read/write many different capture file formats Capture files compressed with gzip can be decompressed on the fly Live data can be read from Ethernet, IEEE 802.11, PPP/HDLC, ATM, Bluetooth, USB, Token Ring, Frame Relay, FDDI, and others (depending on your platfrom) Decryption support for many protocols, including IPsec, ISAKMP, Kerberos, SNMPv3, SSL/TLS, WEP, and WPA/WPA2 Coloring rules can be applied to the packet list for quick, intuitive analysis Output can be exported to XML, PostScript®, CSV, or plain text Wireshark 3.4.5 bug fixes:



      TShark does not print GeoIP information Issue 14691. TShark error when piping to "head" Issue 16192. Parts of ASCII representation in Packet Bytes pane are missing Issue 17087. Buildbot crash output: fuzz-2021-02-22-1012761.pcap Issue 17254. NDPE attribute of NAN packet is not dissected Issue 17278. TECMP: reserved flag interpreted as part of timestamp Issue 17279. Master branch does not compile at least with gcc-11 Issue 17281. DNS IXFR/AXFR multiple response Issue 17293. File too large Issue 17301. Build fails with CMake 3.20 Issue 17314. The following vulnerabilities have been fixed:

      wnpa-sec-2021-04 MS-WSP dissector excessive memory consumption. Issue 17331.

      Updated Protocol Support

      DECT, DNS, EAP, Kerberos, LDAP, MS-WSP, SMB2, Sysdig, TECMP, and WiFi NAN

      New and Updated Capture File Support

      pcapng Download: Wireshark 3.4.5 | Wireshark 64-bit | ~50.0 MB (Open Source)
      Download: Portable Wireshark 3.4.5 | Wireshark for macOS
      View: Wireshark Website | Wireshark 3.4.5 changelog

      Get alerted to all of our Software updates on Twitter at @NeowinSoftware

    • By Copernic
      Wireshark 3.4.4
      by Razvan Serea

      

      Wireshark is a network packet analyzer. A network packet analyzer will try to capture network packets and tries to display that packet data as detailed as possible. You could think of a network packet analyzer as a measuring device used to examine what's going on inside a network cable, just like a voltmeter is used by an electrician to examine what's going on inside an electric cable (but at a higher level, of course). In the past, such tools were either very expensive, proprietary, or both. However, with the advent of Wireshark, all that has changed. Wireshark is perhaps one of the best open source packet analyzers available today.

      Deep inspection of hundreds of protocols, with more being added all the time Live capture and offline analysis Standard three-pane packet browser Multi-platform: Runs on Windows, Linux, OS X, Solaris, FreeBSD, NetBSD, and many others Captured network data can be browsed via a GUI, or via the TTY-mode TShark utility The most powerful display filters in the industry Rich VoIP analysis Read/write many different capture file formats Capture files compressed with gzip can be decompressed on the fly Live data can be read from Ethernet, IEEE 802.11, PPP/HDLC, ATM, Bluetooth, USB, Token Ring, Frame Relay, FDDI, and others (depending on your platfrom) Decryption support for many protocols, including IPsec, ISAKMP, Kerberos, SNMPv3, SSL/TLS, WEP, and WPA/WPA2 Coloring rules can be applied to the packet list for quick, intuitive analysis Output can be exported to XML, PostScript®, CSV, or plain text Wireshark 3.4.4 bug fixes:

      NTP Version 3 Client Decode PDML output issue (Reference ID Issue) Issue 17112. 3.4.2: public wireshark include files are including build time "config.h" Issue 17190. wireshark-3.4.3/epan/dissectors/packet-s7comm.c:3521: bad array index ? Issue 17198. SIP protocol: P-Called-Party-ID header mixed up with P-Charge-Info header Issue 17215. Asterix CAT010 Decode Error Issue 17226. _ws.expert columns not populated for IPv4 Issue 17228. Buildbot crash output: fuzz-2021-02-12-1651908.pcap Issue 17233. gQUIC: Wireshark 3.4.3 fails to dissect a packet (gQUIC q024) that v3.2.6 succeeds. Issue 17250. The following vulnerabilities have been fixed:

      wnpa-sec-2021-03 Wireshark could open unsafe URLs. Issue 17232. CVE-2021-22191. Updated Protocol Support



      ASTERIX, Frame Relay, GQUIC, NTP, NVMe Fabrics RDMA, S7COMM, and SIP

      New and Updated Capture File Support

      iSeries Download: Wireshark 3.4.4 | Wireshark 64-bit | ~50.0 MB (Open Source)
      Download: Portable Wireshark 3.4.4 | Wireshark for macOS
      View: Wireshark Website | Wireshark 3.4.4 changelog

      Get alerted to all of our Software updates on Twitter at @NeowinSoftware

    • By zikalify
      Vodafone launches ‘unbreakable' Pro Broadband packages
      by Paul Hill



      Vodafone has announced the launch of its new Pro Broadband packages which it says will ensure you can always get online no matter where in your home you are. If you don’t receive coverage throughout your domicile, the firm said you can end your contract without facing a penalty.

      Under the new Superfast, Ultrafast and Gigafast plans, users will be provided with Super WiFi wireless range boosters that use software that works with the router’s Intelligent WiFi feature to provide the best performance. If they detect any wireless congestion from neighbours they will work around this to ensure you get a reliable connection.

      To make customers’ connections even more reliable, Vodafone has launched a new dedicated team called WiFi Xperts - a trained squad of engineers who proactively monitor networks and contact customers if they detect issues. New customers will be contacted by the WiFi Xperts within 10 days of their service to make sure everything is working properly.

      If you do run into issues with your connection between the router and the local telephone exchange, the router will utilise the Broadband Back-up feature which is essentially a 4G mobile connection via a USB plugged into the router to help you stay connected until WiFi is restored. The mobile USB is capped at 50GB but this can be extended if needed.

      It’s an interesting offer from Vodafone; we’ve all experienced a WiFi outage at some point or other and they can be frustrating. With more people learning and working from home, having a stable connection is more important than ever.