connection interruptions - need help please

interruptions

asked 2023-02-19 17:45:22 +0000

mailgraf
1 ●2 ●2

updated 2023-02-19 17:48:19 +0000

Hi there

I am new to this forum and recently started to learn Wireshark. I have some basic knowledge of networking (DHCP, DNS, TCP/IP) and of its hardware. I use a Fritzbox-router, 3 Zyxel POE-switches with 3 Zyxel Access-Points.

the issue

I randomly experience connection interruptions within my network. The devices (mostly notebooks and iPads) are still connected to Wifi but they cannot reach any website nor a local device. After I disconnect and reconnect to Wifi it works fine again. Nor the logs of the switches, router or Access points show any hardware-related loss of connections, I even exchanged most cables to rule out any bad cabling.

I think I can exclude any hardware-related reason which cause the interruptions. I dont see any obvious errors in the logs like IP-address conflicts or a specific service causing the interruptions.

recently I ran Wireshark on my MacBook Pro M1 (running macos 13.1 (22C65)). I used my iPad 8th Gen running iPad OS 16.3.1. Suddenly the iPad couldnt open websites anymore and the TV streaming-app stopped working.

I noticed that there a lot of ARP-requests from and to 192.168.1.140 (iPad) and 192.168.1.77 (Apple TV), the MacBook has the IP 192.168.1.25. From line 603 there a lot of TCP-retransmission but honestly I cant read much out of it.

I would be glad to get some help in order to dig depper into the issue, it is driving me nuts because I dont know where to start.

all the best

Andrew

edit retag flag offensive close merge delete

add a comment

3 Answers

Sort by » oldest newest most voted

answered 2023-08-30 02:35:33 +0000

Rockjack
1

facing same issue on my website... tried on many forums but could not find any solution which resolve my issue.

edit flag offensive delete link

add a comment

answered 2023-02-19 20:53:05 +0000

BigFatCat
31 ●3 ●90 ●5

ARP REQUESTS is not receiving ARP REPLY. Most likely is either the ARP REQUEST or ARP REPLY was lost. When TCP sends ACK retransmissions because it sent a TCP packet that required a TCP response. There are not any ARP Reply to any of the ARP Requests. Most commonly, the ARP request or the ARP Reply has been dropped.

The TCP problem is because the 3-way handshake failed. The device 192.168.1.25 sends a SYN-ACK, but the capture doesn't show 192.168.1.140 sending an ACK response. Because 192.168.1.140 did not send an ACK response, the TCP handshake failed.

The 192.168.1.140 receive direction appears to be the problem. I would capture at 192.168.1.140 to check if the SYN-ACK packets and ARP Requests are received. If packets are received then I would check for signal level/quality issues from 192.168.1.140.

edit flag offensive delete link

Comments

Hi there

many thanks for the quick reply and explanation. I basically understand where the problem may could come from. 192.168.1.140 is an iPad and AFAIK Wireshark cannot be installed on iOS-devices. what would you recommend to do to capture the tablets traffic?

Basically I dont think that the signal level is an issue as the AP is around 10 feet away and installed on the ceiling, there is a just a wooden door between the tablet and AP. While measuring the signal it is around 60-65dbm, so still pretty good.

all the best

Andrew

mailgraf ( 2023-02-19 21:31:24 +0000 )edit

I've not found a tool that captures packets directly on an IOS device. There are a couple articles on using the MAC to trace packets on an IOS device.Airtool 2 and Apple Developer for packet capture. It looks like it uses built-in Apple applications. I want to try it, but I don't have a MAC. Access to a WiFI 6 sniffer will be helpful too.

There are a couple more things to try, if you haven't done it yet.

Does the IPAD have issues with all 3 APs?
What happens if disable/enable WIFI on the IPAD? The IPAD would have to reestablish with the AP.
Do you have access to different models IPAD? See if the trouble is with any IPAD or only specific IPAD or model. IPAD WIFI antennas are internal.

BigFatCat ( 2023-02-20 11:51:39 +0000 )edit

Thats a good point, I just took the iPad to another room where it is like 5 feet away from the AP (ceiling) without any obstacles in between. Just running the streaming-app to see if the interruptions occur again.

When I disable/enable Wifi on the iPad it reconnects successfully and the connection works fine again for a range of 30min to more than 3 hours. so very irregular.

No unfortunately I dont have another iPad to test it. Maybe 2.4Ghz helps as its range is better.

I just ran Wireshark on my MacBook and captured with the following filter: host 192.168.1.140. I wonder if its normal that from line 120-155 ARP requests are being set and it takes around 300secs to answer on line 156 if I interpret it correctly? 192.168.1.77 is an Apple TV 4K client.

mailgraf ( 2023-02-20 13:11:50 +0000 )edit

Hi,

The packet in frame 156 is a multicast DNS (mDNS) from 192.168.1.140.

The ARP Reply info column text would read: "192.168.1.140 is at xx:xx:xx:xx," while the ARP Reply destination MAC address would be the 192.168.1.140 MAC address, not BROADCAST.

I would try to install a Wi-Fi analyzer with a spectrum analyzer on the MAC and IOS. I haven't any recommendations. I would download either trial or free version. It will display the signal strength of any 2.4G or 5G received. BTW, don't be surprised what you find.

You can try to ping your gateway, but I suspect that should fail too.

BigFatCat ( 2023-02-21 13:58:07 +0000 )edit

I already use the built-in Wifi Analyzer (Airport) from Apple which does a decent job. The signal strength within 5Ghz is around -51dbm to -65dbm. Within 2.4Ghz its -50dbm to -63dbm.

Last night I switched from 5Ghz to 2.4Ghz on the iPad and since then it seems to be stable, fingers crossed. I will observe the behaviour and see if its still reliable in a couple of days.

anyway, thanks for all the quick and helpful replies, I see that network-problems can be VERY difficult.

mailgraf ( 2023-02-21 17:12:01 +0000 )edit

see more comments

answered 2023-02-20 08:27:20 +0000

hugo.vanderkooij
76 ●190 ●4

Can you capture all traffic at the WiFi level? See https://wiki.wireshark.org/CaptureSet... for more details and see if something odd happens at the WiFi level?

3 POE switches sounds a bit overkill to me for 3 AP's. But that's just me.

And if this happens on the 5GHz band make sure you don't use channes that shut off if they spot radar signals. There is some interresting stuff to read at https://lifemote.com/2022/11/22/inter... about 5 GHz issues.

edit flag offensive delete link

Comments

I will read through the wiki-post, I captured the traffic via built-in Wifi of my MacBook Pro, not sure if this is the same as capturing like described in the wiki.

I must add that it is a house with 3 stories, each story has a switch and one POE-AP attached to it.

yeah its on 5Ghz, I disabled all DFS-channels to avoid radar-issues. on the other hand I testwise connected to 2.4Ghz to see if the band could cause the problem.

at the first glance it seems like the iPad 192.168.1.140 cant reply the ARP requests from other devices, thats already something to work with. the odd thing is that there is no error-message or obvious information in the Wifi-logs like disconnects or similiar.

on the other hand the switch supports mirror-mode, I could also try to set it up and capture the traffic at switch-level.

mailgraf ( 2023-02-20 09:12:57 +0000 )edit

add a comment