Re: [gentoo-user] Internet slow at times. Can't figure out why. ISP??

[J. Roeleveld]

On Tuesday, April 7, 2020 5:14:14 AM CEST Dale wrote:
> Hey,
>
> As some may recall I bought a new router and modem.  I was sort of
> hoping one or both of those would solve a issue I've noticed for a good
> long while.  At times, my internet gets really slow, slower than it
> should be at least.  I have DSL and it isn't to fast to begin with.  At
> times tho, I'm only getting about 20 or 30% of what I should.  This is
> what the modem shows for speed:
>
> Downstream Rate     1536 Kbps
> Upstream Rate     384 Kbps
>
> Don't laugh OK.  I live in the sticks and for many years, I was lucky to
> get 26K down on dial-up.  I hoping for faster one day but this is better
> than dial-up, mostly.  ;-)

If it works.
And I remember when I was stuck with a 14k4 modem in the olden days.

> Here's some info.  This slow down seems to always happen in the
> evenings, somewhere between 6 and 9PM.

Isn't this when people sit down to eat and possible start watching netflix or 
other streaming services?
Or the kids playing games before going to bed?

> Generally, the rest of the time
> it is pretty close to its max speed.  Because it works most of the time,
> I'm thinking this is not hardware or cable related.  I'd think it more
> consistently slow if it was.  That said, it does the same with any
> modem, any router or any sets of cables.  I even bought some bulk cable
> and ends then made my own cables and tested them with a ohm meter to be
> sure they were really good.  No improvement.  I also disabled the
> wireless on my cell phone to be sure it wasn't doing something funny. It
> is set to download only when I tell it but there is one google thing
> that ignores that.

I agree. It doesn't sound like a hardware problem. If it were, the issue would 
be far more consistent and not limited to a, near fixed, time period.

> The only things I see is in the logs.  Here is some of the log from the
> modem, currently the Netgear 7550.
>
>
> 2020/04/06 21:54:15 CDT WRN | kernel | logInboundBlocked:IN=ppp0 OUT=
> MAC= SRC=185.175.93.23 DST=74.188.249.233 LEN=44 TOS=0x00 PREC=0x00
> TTL=241 ID=29175 PROTO=TCP SPT=56054 DPT=5937 WINDOW=1024 RES=0x00 SYN
> URGP=0 OPT (020405AC)
>
> 2020/04/06 21:54:13 CDT WRN | kernel | logInboundBlocked:IN=ppp0 OUT=
> MAC= SRC=176.113.115.54 DST=74.188.249.233 LEN=44 TOS=0x00 PREC=0x00
> TTL=240 ID=34879 PROTO=TCP SPT=50930 DPT=1683 WINDOW=1024 RES=0x00 SYN
> URGP=0 OPT (020405AC) 2020/04/06 21:54:03 CDT WRN | kernel |
> logInboundBlocked:IN=ppp0 OUT= MAC= SRC=176.113.115.52
> DST=74.188.249.233 LEN=44 TOS=0x00 PREC=0x00 TTL=240 ID=21875 PROTO=TCP
> SPT=50932 DPT=31240 WINDOW=1024 RES=0x00 SYN URGP=0 OPT (020405AC)
> 2020/04/06 21:53:43 CDT WRN | kernel | logInboundBlocked:IN=ppp0 OUT=
> MAC= SRC=185.153.198.249 DST=74.188.249.233 LEN=44 TOS=0x08 PREC=0x20
> TTL=234 ID=8388 PROTO=TCP SPT=58950 DPT=33995 WINDOW=1024 RES=0x00 SYN
> URGP=0 OPT (020405AC) 2020/04/06 21:53:39 CDT WRN | kernel |
> ICMP:logOutboundBlocked:IN= OUT=ppp0 SRC=74.188.249.233
> DST=152.32.191.35 LEN=34 TOS=0x00 PREC=0x00 TTL=64 ID=6687 PROTO=ICMP
> TYPE=0 CODE=0 ID=16298 SEQ=0 2020/04/06 21:53:32 CDT WRN | kernel |
> logInboundBlocked:IN=ppp0 OUT= MAC= SRC=51.178.78.153 DST=74.188.249.233
> LEN=44 TOS=0x08 PREC=0x20 TTL=238 ID=54321 PROTO=TCP SPT=58684 DPT=8000
> WINDOW=65535 RES=0x00 SYN URGP=0 OPT (020405AC) 2020/04/06 21:53:24 CDT
> WRN | kernel | logInboundBlocked:IN=ppp0 OUT= MAC= SRC=185.153.198.240
> DST=74.188.249.233 LEN=44 TOS=0x08 PREC=0x20 TTL=234 ID=43550 PROTO=TCP
> SPT=50631 DPT=47025 WINDOW=1024 RES=0x00 SYN URGP=0 OPT (020405AC)
> 2020/04/06 21:53:19 CDT WRN | kernel | logInboundBlocked:IN=ppp0 OUT=
> MAC= SRC=216.58.193.142 DST=74.188.249.233 LEN=40 TOS=0x00 PREC=0x80
> TTL=121 ID=0 DF PROTO=TCP SPT=443 DPT=50020 WINDOW=0 RES=0x00 RST URGP=0
> 2020/04/06 21:53:01 CDT WRN | kernel | logInboundBlocked:IN=ppp0 OUT=
> MAC= SRC=146.88.240.4 DST=74.188.249.233 LEN=78 TOS=0x00 PREC=0x00
> TTL=245 ID=54321 PROTO=UDP SPT=43443 DPT=137 LEN=58 2020/04/06 21:52:58
> CDT WRN | kernel | logInboundBlocked:IN=ppp0 OUT= MAC=
> SRC=176.113.115.247 DST=74.188.249.233 LEN=44 TOS=0x00 PREC=0x00 TTL=240
> ID=64147 PROTO=TCP SPT=50902 DPT=31405 WINDOW=1024 RES=0x00 SYN URGP=0
> OPT (020405AC) 2020/04/06 21:52:50 CDT WRN | kernel |
> logInboundBlocked:IN=ppp0 OUT= MAC= SRC=170.106.36.63 DST=74.188.249.233
> LEN=44 TOS=0x08 PREC=0x00 TTL=243 ID=54321 PROTO=TCP SPT=59903 DPT=5938
> WINDOW=65535 RES=0x00 SYN URGP=0 OPT (020405AC)
>
>
> I googled but didn't really find anything, good or bad, about those
> entries. This is from the router, the TP-Link I bought a few months ago.

Looks like standard port-scanners. The logs indicate they are blocked. So 
should be ok. Make sure you have all the security settings enabled on the 
router (and only disable the ones that are causing issues)

> Index Time Type Level Log Content
> 199 Apr 6 21:57:17 DHCP INFO DHCPS:Send ACK to 192.168.0.100
> 198 Apr 6 21:57:17 DHCP INFO DHCPS:Recv REQUEST from 00:01:53:80:DC:35
> 197 Apr 6 21:21:57 DHCP INFO DHCPS:Send ACK to 192.168.0.101
> 196 Apr 6 21:21:57 DHCP INFO DHCPS:Recv REQUEST from A8:87:B3:B4:F9:5E
> 195 Apr 6 20:57:17 DHCP INFO DHCPS:Send ACK to 192.168.0.100
> 194 Apr 6 20:57:17 DHCP INFO DHCPS:Recv REQUEST from 00:01:53:80:DC:35
> 193 Apr 6 20:24:21 DHCP INFO DHCPS:Send ACK to 192.168.0.101
> 192 Apr 6 20:24:21 DHCP INFO DHCPS:Recv REQUEST from A8:87:B3:B4:F9:5E
> 191 Apr 6 19:57:17 DHCP INFO DHCPS:Send ACK to 192.168.0.100
> 190 Apr 6 19:57:17 DHCP INFO DHCPS:Recv REQUEST from 00:01:53:80:DC:35
>
> I'm only copying a small portion of it because it is very repetitive.
> It's pretty much the same thing over and over again. I'm not thinking
> those are errors tho. The router sure does send recv DHCP stuff often tho.

That's not often. I see 80 entries in the log related to my DHCP server all 
having the same timestamp.

> Does anyone see anything that is a problem here? I'm thinking my ISP is
> just overloaded and throttling the connection. I've swapped hardware and
> cables to the point that I don't see how it could be that. Possible I
> guess but not sure how several cables, two routers and three modems, two
> different brands, can all have the same issue.
>
> Am I missing anything? Any other ideas? Thoughts?

Personally, considering the timeperiod you mentioned, I am guessing your 
neighbours are all using the internet at the same time and the local exchange 
is not able to provide the full bandwidth to all the customers at the same 
time.

--
Joost