Intermittent Connectivity Issues

[Fuwaads]

I’ve also noticed yesterday and this morning when my internet is back up, whenever I open a site, it tells me that a high amount of traffic is detected from my domain and I need to confirm that I’m not a robot.

My internet connection is still intermittent though.

 

[r00igev@@r]

I’ve also noticed yesterday and this morning when my internet is back up, whenever I open a site, it tells me that a high amount of traffic is detected from my domain and I need to confirm that I’m not a robot.

My internet connection is still intermittent though.

Fire up wireshark on your laptop connected to the ONT and then DM me. It will highlight which of your neighbours are doing dodgy ****!

 

[r00igev@@r]

Hi

I'm still investigating the cause of this and it looks like repeated DHCP requests from a mac are triggering our DDOS protection and are blocking mac addresses for 15min intervals.

Just suppress that rule and then trace the mac?

Edit: Why was the customer forced to jump through hoops by having to test himself directly on the ONT? Other ISPs do the same.

The NOC should have know about this and done a service correlation.

 

[MEG101]

Thank you @r00igev@@r ,

I have put in my cancellation through with Afrihost as well as asked them for an early release of my line so i may sign up with another ISP. I am still waiting for the line to be released.
I will look for another ISP but my options are:

1. AXXESS
2. WEBAFRICA
3.COOLIDEAS
4. FREDD ISP

Any Recommendation which to go with? A TTConnect technician advised I go with FREDD as they are the ISP for TTConnect but I haven't heard of them before.

Axxess is very good, I have a JustDSL connection for my mom in Great Brakriver and the network is rock solid. No issues whatsoever. Will switch over when fiber becomes available.

Never, please never ever use Webafrica!! Too many bad reviews on this MyBB Forums.

I have heard many good things and read great reviews of Cool Ideas. Friend of mine has them and he is more than happy with a rock solid connection.

Fredd ISP I do not know of, so I cannot comment on them.

Happy hunting for a new ISP.

 

[Fuwaads]

Fire up wireshark on your laptop connected to the ONT and then DM me. It will highlight which of your neighbours are doing dodgy ****!

Cool man, will do it later though. With no Internet connection I sadly need to drive 45 mins to the office.

Does Afrihost have support technicians that actually go out to a customers home? Or do they just let the FON do that?

 

[AfriNatic]

Just suppress that rule and then trace the mac?

Edit: Why was the customer forced to jump through hoops by having to test himself directly on the ONT? Other ISPs do the same.

The NOC should have know about this and done a service correlation.

I work in Noc now.

I'm aware of the issue.

We are stuck between a rock and hard place. Switch the mitigation off and face 45min of ICMP v6 neighbor solicitation floods or have the mitigation on that reduces that to a couple of minutes but comes with other issues.

The bypass the router is a standard thing to rule out router issues.

 

[r00igev@@r]

We are stuck between a rock and hard place. Switch the mitigation off and face 45min of ICMP v6 neighbor solicitation floods or have the mitigation on that reduces that to a couple of minutes but comes with other issues.

Why not just move the guilty party off the VLAN into a holding VLAN? Or alternatively just terminate their services?

The bypass the router is a standard thing to rule out router issues.

I don't classify it as standard but last resort. The standard is to first investigate known problems and workarounds. In this case there is a known problem.

 

[AfriNatic]

Why not just move the guilty party off the VLAN into a holding VLAN? Or alternatively just terminate their services?

I don't classify it as standard but last resort. The standard is to first investigate known problems and workarounds. In this case there is a known problem.

We need to find them. It's mostly Tenda routers that are causing the floods.

Then there is also the usual unicast flooding from compromised routers that causes a v4 TCP destination unreachable flood.

 

[AfriNatic]

@Fuwaads

Please can you reboot your router and ONT.

We have made changes. Please let me know if there is any improvment.

 

[Fuwaads]

@Fuwaads

Please can you reboot your router and ONT.

We have made changes. Please let me know if there is any improvment.

Thanks, i will have a look as soon as i get home. Will provide some feedback after 3:30

 

[r00igev@@r]

We need to find them. It's mostly Tenda routers that are causing the floods.

The only things worse than a Huawei is a Tenda.

Then there is also the usual unicast flooding from compromised routers that causes a v4 TCP destination unreachable flood.

Do you guys have level 1 threat intelligence implemented?

 

[Fuwaads]

@Fuwaads

Please can you reboot your router and ONT.

We have made changes. Please let me know if there is any improvment.

Hi, I’ve rebooted my router and ONT at 3:30. Internet then worked for about 15 mins before dropping again. In a space of 1hr20mins, the internet has dropped 3 times for a total period of 40 mins.

It’s currently off but it shows that I’m connected on all my devices. Just says no internet connection when opening a page or anything net related. Can’t even do a speed test from my phone.

 

[AfriNatic]

Hi, I’ve rebooted my router and ONT at 3:30. Internet then worked for about 15 mins before dropping again. In a space of 1hr20mins, the internet has dropped 3 times for a total period of 40 mins.

It’s currently off but it shows that I’m connected on all my devices. Just says no internet connection when opening a page or anything net related. Can’t even do a speed test from my phone.

Hi

Can you give me a time stamp when the connection stopped working?

 

[Fuwaads]

Hi

Can you give me a time stamp when the connection stopped working?

Can’t give earlier but now it’s been off just before 7 and still off at the moment.

 

[Fuwaads]

@AfriNatic

The connection has restored at 19:27, then went off again at 19:33.

It is currently off again now.

This is what happens all day everyday. Sometimes off for over an hour before returning for 5 mins

 

[AfriNatic]

@AfriNatic

The connection has restored at 19:27, then went off again at 19:33.

It is currently off again now.

This is what happens all day everyday. Sometimes off for over an hour before returning for 5 mins

Thanks. I'm consulting with our network engineer.

Can you login to the Huawei router and under mac close clone the mac address of the internet adapter connected to the huawei and see if the connection is restored?

 

[Fuwaads]

Internet is back up again.

How do I do the clone MAC address? Where would I find that?

 

[AfriNatic]

Internet is back up again.

How do I do the clone MAC address? Where would I find that?

You can login to the router 192.168.3.1

Once logged in click on the Connect to the internet at the top of the page.

Scroll down and look for no mac clone. Enable it and from the drop-down select clone interface mac.

 

[Fuwaads]

Thanks. I'm consulting with our network engineer.

Can you login to the Huawei router and under mac close clone the mac address of the internet adapter connected to the huawei and see if the connection is restored?

Ok ive managed to do that.
I’ve rebooted my router and it’s back on.
Will update when/if it drops again.

 

[Fuwaads]

You can login to the router 192.168.3.1

Once logged in click on the Connect to the internet at the top of the page.

Scroll down and look for no mac clone. Enable it and from the drop-down select clone interface mac.

Thanks. It didn’t have the clone interface. It just said:
No Mac clone,
Pc Mac clone , and
Enter manually.

I’ve found the Mac clone under more functions, basic settings and LAN MAC address. Would that work as well?