Troubleshooting a slow connection - what could it be?

edanto

I'm at a relative's house and they've asked for my help in figuring out why their broadband is so annoying slow.

I've checked a couple of the most obvious things, but I can't see anything to explain the odd behaviour.

What's happening is that any time it tries to connect to a new domain, it takes 15-20 seconds to open the page and after than then it goes along at a normal speed. (ie the first time it connects to the irishtimes.com it will take ages to open the home page, but after that pages load reasonably fast).

Here's a tracert showing a load of boards (which I'd already been on for the first time) and bbc.co.uk which it hadn't been on recently.

C:\Documents and Settings\x>tracert boards.ie

Tracing route to boards.ie [89.234.66.107]
over a maximum of 30 hops:

1 <1 ms <1 ms <1 ms 192.168.1.1
2 22 ms 23 ms 23 ms bas005.bmt.esat.net [193.95.142.246]
3 24 ms 22 ms 24 ms vlan101.rt001.bmt.esat.net [193.95.141.1]
4 22 ms 24 ms 23 ms teng0-0-0-0.core001.bmt.esat.net [193.95.140.4]

5 24 ms 23 ms 23 ms teng0-0-0-5.core001.cwt.esat.net [193.95.129.47]

6 23 ms 23 ms 24 ms ge7-0-0.br002.cwt.esat.net [193.95.129.57]
7 24 ms 25 ms 24 ms to-inex-dub-deg-gw.digiweb.ie [193.242.111.20]
8 25 ms 24 ms 24 ms ip-89-234-66-107.dedi.digiweb.ie [89.234.66.107]


Trace complete.

C:\Documents and Settings\x>tracert bbc.co.uk

Tracing route to bbc.co.uk [212.58.224.138]
over a maximum of 30 hops:

1 <1 ms <1 ms <1 ms 192.168.1.1
2 126 ms 27 ms 28 ms bas005.bmt.esat.net [193.95.142.246]
3 23 ms 23 ms 23 ms vlan103.rt002.bmt.esat.net [193.95.142.1]
4 23 ms 22 ms 23 ms teng0-0-0-1.core001.bmt.esat.net [193.95.140.20]

5 24 ms 25 ms 23 ms teng0-0-0-5.core001.cwt.esat.net [193.95.129.47]

6 23 ms 23 ms 24 ms ge7-0-0.br002.cwt.esat.net [193.95.129.57]
7 42 ms 43 ms 43 ms pos2-0.br002.ldn.esat.net [193.95.131.50]
8 43 ms 44 ms 43 ms bbc-gw1-linx.prt0.thdoe.bbc.co.uk [195.66.226.10
3]
9 44 ms 44 ms 43 ms 212.58.238.149
10 45 ms 45 ms 43 ms virtual-vip.thdo.bbc.co.uk [212.58.224.138]

Trace complete.


Firewall etc
It's using ESET Smart Security and shows the same behaviour whether the firewall is on or off

Speedtest

Download speed 2631 Kbps
Upload speed 317 Kbps
QOS 99 %
RTT 2 ms
Max Delay 27 ms
Avg Delay 9 ms
Max Bandwidth 70400 Kbps
Route Speed 262140 Kbps
Forced Idle 0 %
Route Conc 26.7

The most telling result from the speedtest is the attached TCP pause graph. It shows the exact behaviour that we're seeing, and really long pause before anything happens!


How would I troubleshoot to find out if this is caused by the computer, the router or the broadband supplier?

ps Since the router is the easiest thing to change in this situation, I'm working on swapping that out! Anyone know the default BT ppoe passwords?

Spear

edanto wrote: »

What's happening is that any time it tries to connect to a new domain, it takes 15-20 seconds to open the page and after than then it goes along at a normal speed. (ie the first time it connects to the irishtimes.com it will take ages to open the home page, but after that pages load reasonably fast).

Which possibly suggests a slow DNS lookup. Try changing to the Google public DNS at 8.8.8.8 and 8.8.4.4 and see what impact that has.

edanto

Thanks. I tried that, and it hasn't made much of a difference.

Now that I've been using the computer for a bit longer, it no longer seems like the pauses appear with just the first connection. They're more pronounced with the first connection, but even to refresh this thread took about 10 seconds.

There's an old netopia 3347WG router knocking about, but even with the vodafone ppoe login it doesn't seem to connect. I've tried to update the firmware to get rid of the eircom branding on it, and allow me to connect with vodafone with it, but the upgrade failed.

I found this post where someone suggests a patch on the 3347, but the link to the patch is dead now. http://support.smarttelecom.ie/forums/showpost.php?p=6199&postcount=2 Any ideas how to use the 3347WG in this situation?

EDIT: I've abandoned trying to upgrade the firmware for now and am trying to make the 3347 work with the vodafone login. Going to use those google DNS servers above, but the question now is what to put in this area of the 3347 connection config:

Static IP Address:
IP Gateway:

I'm fairly sure there isn't a static IP here, so will I leave that at 0.0.0.0?

I think I should be able to find the vodafone home broadband IP gateway with a bit of googling...


Any other suggestions you might have are very welcome!

thanks

Spear

The IP sutff is done by DHCP, and not statically set.

I'm curious to see if there's anything opening a large number of TCP connections. Could you try run this util and see if anything stands out:

http://technet.microsoft.com/en-us/sysinternals/bb897437

William Powell

That would be on of the easily hackable Wireless Eircom routers. If its on default settings it doesn't matter who your ISP is you are still wide open on the wireless connection, maybe its slow because of other users who shouldn't be using it?

Edit> hadn't realised the Netopia router was one you were setting up, it works fine with voafone but don't have the info to hand, do however change the default WEP to WPA.

edanto

I ran that, and here are the results.

[System Process]	0	TCP	molly	30606	localhost:1320	1320	TIME_WAIT										
[System Process]	0	TCP	molly	1365	localhost:30606	30606	TIME_WAIT										
[System Process]	0	TCP	molly	1361	localhost:30606	30606	TIME_WAIT										
[System Process]	0	TCP	molly	1369	ey-in-f101.1e100.net:http	http	TIME_WAIT										
[System Process]	0	TCP	molly	1366	localhost:30606	30606	TIME_WAIT										
[System Process]	0	TCP	molly	1359	localhost:30606	30606	TIME_WAIT										
[System Process]	0	TCP	molly	1367	ey-in-f101.1e100.net:http	http	TIME_WAIT										
[System Process]	0	TCP	molly	1363	ey-in-f101.1e100.net:http	http	TIME_WAIT										
[System Process]	0	TCP	molly	1360	localhost:30606	30606	TIME_WAIT										
[System Process]	0	TCP	molly	1368	ey-in-f101.1e100.net:http	http	TIME_WAIT										
[System Process]	0	TCP	molly	1364	ey-in-f101.1e100.net:http	http	TIME_WAIT										
[System Process]	0	TCP	molly	1371	209.85.143.104:http	http	TIME_WAIT										
[System Process]	0	TCP	molly	1370	localhost:30606	30606	TIME_WAIT										
[System Process]	0	TCP	molly	1331	a92-123-154-81.deploy.akamaitechnologies.com:http	http	TIME_WAIT										
[System Process]	0	TCP	molly	1335	a92-123-154-81.deploy.akamaitechnologies.com:http	http	TIME_WAIT										
[System Process]	0	TCP	molly	1327	a92-123-154-81.deploy.akamaitechnologies.com:http	http	TIME_WAIT										
[System Process]	0	TCP	molly	1326	localhost:30606	30606	TIME_WAIT										
[System Process]	0	TCP	molly	1330	localhost:30606	30606	TIME_WAIT										
[System Process]	0	TCP	molly	1334	localhost:30606	30606	TIME_WAIT										
[System Process]	0	TCP	molly	1337	a92-123-154-81.deploy.akamaitechnologies.com:http	http	TIME_WAIT										
[System Process]	0	TCP	molly	1333	a92-123-154-81.deploy.akamaitechnologies.com:http	http	TIME_WAIT										
[System Process]	0	TCP	molly	1329	a92-123-154-81.deploy.akamaitechnologies.com:http	http	TIME_WAIT										
[System Process]	0	TCP	molly	1328	localhost:30606	30606	TIME_WAIT										
[System Process]	0	TCP	molly	1332	localhost:30606	30606	TIME_WAIT										
[System Process]	0	TCP	molly	1336	localhost:30606	30606	TIME_WAIT										
[System Process]	0	TCP	molly	1343	a92-123-154-48.deploy.akamaitechnologies.com:http	http	TIME_WAIT										
[System Process]	0	TCP	molly	1347	a92-123-154-48.deploy.akamaitechnologies.com:http	http	TIME_WAIT										
[System Process]	0	TCP	molly	1340	a92-123-154-81.deploy.akamaitechnologies.com:http	http	TIME_WAIT										
[System Process]	0	TCP	molly	1346	localhost:30606	30606	TIME_WAIT										
[System Process]	0	TCP	molly	1342	localhost:30606	30606	TIME_WAIT										
[System Process]	0	TCP	molly	1338	localhost:30606	30606	TIME_WAIT										
[System Process]	0	TCP	molly	1341	a92-123-154-81.deploy.akamaitechnologies.com:http	http	TIME_WAIT										
[System Process]	0	TCP	molly	1345	a92-123-154-48.deploy.akamaitechnologies.com:http	http	TIME_WAIT										
[System Process]	0	TCP	molly	1339	localhost:30606	30606	TIME_WAIT										
[System Process]	0	TCP	molly	1344	localhost:30606	30606	TIME_WAIT										
alg.exe	3100	TCP	molly	1032	molly	0	LISTENING										
AppleMobileDeviceService.exe	908	TCP	molly	27015	molly	0	LISTENING										
chrome.exe	3536	TCP	molly	1151	localhost	30606	ESTABLISHED	2	1,300	1	305						
chrome.exe	3536	TCP	molly	1358	localhost	30606	ESTABLISHED	1	654	1	125						
chrome.exe	3536	TCP	molly	1372	localhost	30606	ESTABLISHED	2	1,627	3	1,738						
ekrn.exe	1124	TCP	molly	30606	localhost:1372	1372	ESTABLISHED	1	5,753	2	1,115						
ekrn.exe	1124	TCP	molly	30606	localhost:1151	1151	ESTABLISHED	1	305	2	1,300						
ekrn.exe	1124	TCP	molly	1152	ey-in-f102.1e100.net	http	ESTABLISHED	2	1,300	1	305						
ekrn.exe	1124	TCP	molly	30606	molly	0	LISTENING										
ekrn.exe	1124	TCP	molly	30606	molly	0	LISTENING										
ekrn.exe	1124	TCP	molly	30606	molly	0	LISTENING										
ekrn.exe	1124	TCP	molly	1362	ey-in-f101.1e100.net	http	ESTABLISHED	1	654	1	125						
ekrn.exe	1124	TCP	molly	1373	209.85.143.104	http	ESTABLISHED	2	1,627	2	484						
jqs.exe	1312	TCP	molly	5152	molly	0	LISTENING										
lsass.exe	1004	UDP	molly	isakmp	*	*											
lsass.exe	1004	UDP	molly	4500	*	*											
mDNSResponder.exe	900	TCP	molly	5354	molly	0	LISTENING										
mDNSResponder.exe	900	UDP	molly	5353	*	*											
mDNSResponder.exe	900	UDP	molly	1026	*	*											
mDNSResponder.exe	900	UDP	molly	57218	*	*											
svchost.exe	1276	TCP	molly	epmap	molly	0	LISTENING										
svchost.exe	1396	UDP	molly	ntp	*	*											
svchost.exe	1396	UDP	molly	ntp	*	*											
svchost.exe	1516	UDP	molly	1900	*	*											
svchost.exe	1516	UDP	molly	1900	*	*											
System	4	TCP	molly	microsoft-ds	molly	0	LISTENING										
System	4	TCP	molly	netbios-ssn	molly	0	LISTENING										
System	4	UDP	molly	netbios-ns	*	*		24	1,200	3	150						
System	4	UDP	molly	netbios-dgm	*	*											
System	4	UDP	molly	microsoft-ds	*	*											

I've looked up what ekrn.exe is, and it's part of the ESET security software.
http://www.wilderssecurity.com/showthread.php?t=199699
http://www.wilderssecurity.com/showpost.php?p=1124960&postcount=17

I'll look into disabling that feature (where all web traffic seems to be sent for analysis to ESET), as that may have been slowing things down.

edanto

William Powell wrote: »

That would be on of the easily hackable Wireless Eircom routers. If its on default settings it doesn't matter who your ISP is you are still wide open on the wireless connection, maybe its slow because of other users who shouldn't be using it?

Appreciate the comment, and good to know that router is risky.

Just to clear things up, I'm not using the eircom router at the moment, the connection is with a Zyxel router (originally supplied by BT, who were then bought by vodafone) and I'm considering replacing it with the eircom netopia 3347 to see if that gets rid of the problem.

By the way, something else that I've adjusted to see if it would make a difference - there was a connection timeout setting in the Zyxel router to 100seconds that I've increased to 3600 seconds.

Spear

edanto wrote: »

I ran that, and here are the results.


I'll look into disabling that feature (where all web traffic seems to be sent for analysis to ESET), as that may have been slowing things down.

Nothing in there looks dodgy otherwise though. Looks like swapping routers is the best bet currently.

William Powell

Spear wrote: »

Nothing in there looks dodgy otherwise though. Looks like swapping routers is the best bet currently.

So why are the chrome connections being made to LOCAL HOST and not direct to the web, didn't think that was part of the way ESET works but don't use it so can't say for sure?

Spear

William Powell wrote: »

So why are the chrome connections being made to LOCAL HOST and not direct to the web, didn't think that was part of the way ESET works but don't use it so can't say for sure?

That's common for many apps, and often used by antivirus software. I meant there was no sign of malware/trojans that would be consuming outgoing TCP connections.

edanto

Thanks guys.

No success to report yet, still struggling to get this old eircom router working correctly on the vodafone at home broadband connection, but I've asked over in the vodafone forum to check that I'm doing that correctly. http://www.boards.ie/vbulletin/showthread.php?p=69537781

As regards the security holes in the eircom netopia 3347 router setup, I'm happy that I've patched them by changing the SSID and bumping the security up to WPA-PSK, as per http://www.bartbusschots.ie/blog/?p=793

All of the ESET traffic checking features are completely disabled now and the problem persists.

edanto

Thanks for the help. Got the router changed out - the old Zyxel thing is in the bin (it was constantly dropping the connection) and we're using the netopia now. Had to upgrade the firmware with a two-step process, links etc on the thread linked above.

All of the speed issues with the broadband connection have been fixed with this new router. When using a laptop (wireless connection to the router), it just hums along.

However, when using the desktop, there is still a 5-10 second delay with each page loading, more pronounced when going to a new domain.

So - would the next thing to investigate be the network card, do you think? Or try alternate DNS servers?

William Powell

OK so what happens if you plug the laptop in on a cable (disable the wireless temporarily)? Does it still hum or have the same issues as the wired destop system?

edanto

Damn I should have tested that, but I've left the house now and won't be back for a fortnight or so.

I'll update the thread when I know, I might be able to ask someone else to test it.

Thanks guys.