cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
drock
Beginner
567 Views
Message 1 of 5

No bandwidth, connection up - HH3 OUT: BLOCK [65], IN:BLOCK [16]

Posting here in the hope that someone can explain some router messages to me, which I've searched for already on the forum but not found a suitable answer for. I work in IT, so I don't particularly enjoy time spent on 'technical' helplines - hopefully someone who knows what they're talking about will read this!

 

Our line has 10.5 Mbit downstream and has been performing pretty much within a few percent of that for a year (since we took on the connection). Over the last 4 or 5 days we've been absolute loss of bandwidth without loss of connection, which has been occuring at any time but particularly between 4pm and 11pm. The times I've been able to test the bandwidth, the speed starts out at 1Mbit at most and quickly falls away to nothing (I've not been able to complete any test I manage to get started during one of these periods). I've done some web dev in the past, so the best I can explain it is like a DDOS attack or someone leeching our bandwidth for some nefarious purpose.

 

Poking around in the HH3 router's logs, there are a lot of instances of the following firewall messages:

 

OUT: BLOCK [65] First packet is Invalid (Invalid tcp flags for current tcp state: TCP [192.168.1.xx]:xxxx->[xx.xx.xxx.xxx]:xxx on ppp0)

  • I assume these aren't much harm - connections that have expired or somesuch? I get them in conjunction with the following message, which is why I put them here, but they can occur isolated.

IN: BLOCK [16] Remote administration (TCP [218.77.79.34]:58566->[xx.xxx.xx.xxx]:xxxx on ppp0)

  • These are the messages that worry me. This one is from somewhere in China as many of them are, but they can come from anywhere. Normally from telecommunication/IT companies or universities, but they happen frequently (approx every hour) and each time from a different location, so I find it strange that every IT/telecommunication company and institution from Google to the University of Timbuktu (made that one up) is taking a nibble at us in a round-robin fashion.

When bandwidth disappears, these remote admistration attempts become very frequent (every five to ten mins during loss of bandwidth). I've changed my public IP many times during an 'attack', but nothing changes. Networking is not my forte, so I'm not even sure if that would help, although my intuition says they need that to consistently 'attack'. My questions are thus:

 

For my curiosity, am I being overly cyncial in believing these remote administration attempts are coming from one centralised location?

For my paranoia, are these attempts related to the loss of our bandwidth?

If they are related, how on earth do you explain that to a tier 1 BT tech support operative so they actually pass it up the chain?

If they're not related, any advice on getting past a tier 1 BT tech support operative would be handy anyway 😄

 

0 Ratings
4 REPLIES 4
Keith_Beddoe
Distinguished Sage
Distinguished Sage
556 Views
Message 2 of 5

Re: No bandwidth, connection up - HH3 OUT: BLOCK [65], IN:BLOCK [16]

Do you have any incoming ports open (port forwarding), as these are often the target for SYN floods, quite often from the country mentioned.

These attacks send lots of SYN packets, but ignore any ACK responses. This can cause your connection to "hang", until the incomplete handshakes time out.

 

Normally, changing your public IP will stop them for a while. You can do this by using the disconnect tab on you home hubs Internet settings, then reconnecting again.

 

I see this on my web server sometimes, and have set up IP filtering rules to block incoming connections from quite a number of offending subnets.

 

It may have nothing to do with that.

 

It could simply be a high error rate (CRC) events, causing the slowdown.

 

Have you checked your ADSL stats during the slowdown?

ADSL Statistics

 

 

 

0 Ratings
drock
Beginner
544 Views
Message 3 of 5

Re: No bandwidth, connection up - HH3 OUT: BLOCK [65], IN:BLOCK [16]

Thanks for the reply.

 

Just come out of one of these periods, which lasted from 4pm to 6pm and has been consistent with the past few days. The most I managed in that time was to get my forum post off. Going by recent outages, it'll happen briefly between now and 9pm before it goes almost completely down again for a couple of hours.

 

You're right about the CRC events:

 

ADSL Line Status
Connection Information
Line state:Connected
Data Transmitted/Received (GB):0.0 / 4.3
Downstream:10.56 Mbps
Upstream:1.078 Mbps
 
ADSL Settings
VPI/VCI:0/38
Type:PPPoA
Modulation:G.992.5 Annex A
Latency type:Fast
Noise margin (Down/Up):8.6 dB / 6.2 dB
Line attenuation (Down/Up):35.6 dB / 17.9 dB
Output power (Down/Up):20.4 dBm / 12.1 dBm
FEC Events (Down/Up):0 / 0
CRC Events (Down/Up):773421 / 80
Loss of Framing (Local/Remote):0 / 0
Loss of Signal (Local/Remote):0 / 0
Loss of Power (Local/Remote):0 / 0
HEC Events (Down/Up):2011802 / 55
Error Seconds (Local/Remote):18330 / 37

 

The down noise margin has crept up the last few days, but it was balanced perfectly at the beginning of the problems (I'm assuming the power cycles I've put the hub through and contributed to a temporary rise).

 

The other values, I have no idea what they mean for my connection. Do they look ok or are they the cause of these CRC events? I can pretty much set my watch on when bandwidth completely disappears for a long stretch - does that give any indication of where the fault lies? Saying that, we've had blackouts of a few mins sprinkled throughout the day.

 

 

0 Ratings
imjolly
Distinguished Sage
Distinguished Sage
531 Views
Message 4 of 5

Re: No bandwidth, connection up - HH3 OUT: BLOCK [65], IN:BLOCK [16]

Your errors appear very high but you have not shown connection time which is important.  If short time then the very high number of errors will be restricting your download speed

 

can you run btspeedtester and when first test completes then run diagnostic test  and post results 

 

 

btspeedtester



If you like a post, or want to say thanks for a helpful answer, please click on the Ratings 'Thumbs up' on left hand side.
If someone answers your question correctly please let other members know by clicking on ’Mark as Accepted Solution’.
0 Ratings
Keith_Beddoe
Distinguished Sage
Distinguished Sage
529 Views
Message 5 of 5

Re: No bandwidth, connection up - HH3 OUT: BLOCK [65], IN:BLOCK [16]

Probably some form of electrical interference, plasma TVs are a common source, but there are plenty of others.

 

If you have a medium wave portable radio, tuned to a quiet part of the dial, you may hear what is causing it.

Also, if you are not plugged directly into the master socket, then any extension wiring would also pickup any interference.

 

0 Ratings