Internet randomly cutting out for 5 minutes several times throughout the day

[sippo]

Like I said in post 2, faulty router provided by the ISP.

[Sonic007]

Hi all,

 

Many thanks to all who are helping me out at the moment. It is very much appreciated.

 

I've just spent the past 3 hours in the freezing server room trying to figure things out.

 

I've been on to the ISP who are still conducting tests but are telling me it is currently all fine their end.

 

So I'm still pulling my hair out thinking let's revisit DNS...

 

But when it works, it works, so surely that rules out DNS issues?

 

Only thing I've spotted is I currently have two entries in DNS Manager. I'm guessing it's always been like this but thought I'd flag it up just in case.

Listed I have:

DC01

DC01.ad.mydomain (Note: actual name replaced with mydomain)

 

Upon a quick google it seems others have this too in Windows Server 2016. I am guessing it shouldnt be affecting anything. They both contain the same thing.

 

 

I'm now trying DNS tests such as dnslookup which returns the domain controller that DNS is running on.

I type in a website and it gives me the address so I presume its all working well there.

 

 

I cant see anything wrong in Server Manager for DNS.

I have the ISP's forwarders listed and that has been fine for weeks.

 

Anything else I could try out?

 

 

Thankyou.

Edited December 6, 2021 by Sonic007

[bald_pig]

Hi all,

 

Many thanks to all who are helping me out at the moment. It is very much appreciated.

 

I've just spent the past 3 hours in the freezing server room trying to figure things out.

 

I've been on to the ISP who are still conducting tests but are telling me it is currently all fine their end.

 

So I'm still pulling my hair out thinking let's revisit DNS...

 

But when it works, it works, so surely that rules out DNS issues?

 

Only thing I've spotted is I currently have two entries in DNS Manager. I'm guessing it's always been like this but thought I'd flag it up just in case.

Listed I have:

DC01

DC01.ad.mydomain (Note: actual name replaced with mydomain)

 

Upon a quick google it seems others have this too in Windows Server 2016. I am guessing it shouldnt be affecting anything. They both contain the same thing.

 

 

I'm now trying DNS tests such as dnslookup which returns the domain controller that DNS is running on.

I type in a website and it gives me the address so I presume its all working well there.

 

 

I cant see anything wrong in Server Manager for DNS.

I have the ISP's forwarders listed and that has been fine for weeks.

 

Anything else I could try out?

 

 

Thankyou.

 

None of that could be the issue, you disconnected your entire network from the router and still had the issue with a directly attached machine.

[Michael]

If it was me at SB, I'd be capturing on the specific proxy you are going through at that point in time, maybe I'm just out of the loop, but Mikrotik are pretty cheap as far as I'm concerned, do they have any other options?

 

Presumably they monitor your edge device? If they see no drops, does it even traverse their WAN. I don't know how they work but as it's Netsweeper and likely WAgent Auth, it's their own MPLS, which is why if they see no drops, I'd be looking at either routing being squiffy or the proxy, I'd be routing you to a specific one and monitoring when you call to say you are down to check you are hitting the bridge at least.

 

I don't know too much about Mikrotik either, but they're marginally cheaper than say a Ubiquiti Edge Router. Nevertheless, I come across this a lot, if it's supplied by an ISP then the ISP should be able to manage/monitor it and view logs etc... even if the customer can't.

 

I'd like to think SB have already escalated this to BT just to rule out issues if everything checks out.

[Michael]

And presumably, despite all our contributions, it has nothing to do with this?

[Davit2005]

Start with the basics I feel, i.e. basic connectivity/ping/physical internet line tests, put DNS to one side.

 

Setup continuous pings from a PC connected directly to the MikroTik (as said before you may need the ISP to configure a port on the MiKroTik to be able to communicate with the Internet and internal IPs such as your firewall) also Have you got a diagram of the network, if so please post but obscure any identifiable/confidential info and public IP addresses.

 

Press your SMT or who pays the bills to put pressure on the ISP to help do as much as they can include a proper physical line test by Openreach (I'm assuming it is a Openreach connection of some sorts).

[Sonic007]

I've gone back to basics to check everything again....

 

- Checking my DHCP leases, only about 280 addresses in use. Plenty spare.

 

- Replaced Ethernet cables between OpenReach FSP150 and Router and also replaced cable between router and switch.

 

- Rebooted main switch. Checked it out, cant see any faults with it. It is simply a gigabit switch.

 

- Tested connection again by plugging laptop directly into router, static IP, Google DNS. Doesnt connect. So I'm thinking it has got to be something beyond the router.

 

- Applied latest updates to my domain controller, rebooted everything last night. DHCP, DNS, everything running and not showing any problems.

 

- No new devices added to network, only things on static IP's are my servers and certain devices added by me. Everything else on DHCP.

[MatthewL]

Faulty line or equipment it sounds like but could be be duplicate IP address on the external interface, rare but seen it happen. Does it cut out at the same time each time?

[Sonic007]

Happens absolutely randomly. Any time, sometimes for a minute, sometimes for 5 minutes or more.

Happens many times during day.

 

And since I kept on being disconnected when remoting in last night, I would say it happens both night and day too.

[Michael]

Happens absolutely randomly. Any time, sometimes for a minute, sometimes for 5 minutes or more.

Happens many times during day.

 

And since I kept on being disconnected when remoting in last night, I would say it happens both night and day too.

 

Again that's more useful information, as the LAN's quiet. Are devices typically left on, or is everything classroom based switched off every night?

[Sonic007]

Again that's more useful information, as the LAN's quiet. Are devices typically left on, or is everything classroom based switched off every night?

 

 

It varies, teachers often leave machines on, some are turned off. Every day is different.

[Boredguy]

When you've had the drop in school and your logged on to your workstation, has the event log shown that your IP address from the DHCP server has changed. Highly unlikely based on all the testing and checks you've done before.

 

Can't remember if you said you loose network connectivity when it happens, or just internet access.

If it's just internet access I'd be looking more at the router than LAN since there should be nothing affecting your network traffic internally unless there is a rogue DHCP server kicking in and your stations are picking up an invalid address.

[Sonic007]

When you've had the drop in school and your logged on to your workstation, has the event log shown that your IP address from the DHCP server has changed. Highly unlikely based on all the testing and checks you've done before.

 

Can't remember if you said you loose network connectivity when it happens, or just internet access.

If it's just internet access I'd be looking more at the router than LAN since there should be nothing affecting your network traffic internally unless there is a rogue DHCP server kicking in and your stations are picking up an invalid address.

 

When the Internet connection drops, device IP addresses remain the same. I have full connectivity to the domain and other network resources, just no Internet.

[PaddyNewman]

Plug a dumb switch between LAN and firewalls internal port, leave a machine with a static assigned IP in there looking at Google for DNS (exclude the IP from DHCP obviously)

 

If LAN surfing dies and that laptop dies, its ISP/router problem, send straight to them, its a router/line issue simple as

 

Means you can use the same port without removing your LAN, much easier.

[Boredguy]

When the Internet connection drops, device IP addresses remain the same. I have full connectivity to the domain and other network resources, just no Internet.

In that case I'd certainly be looking at it being router/connection issue.

 

Believe you said you were with SchoolBroadband so assume their support team have been assisting on investigations from their side

[SchoolsBroadband]

@Sonic007 It's with our team at the moment but it may also be an idea in the evening disconnecting the LAN apart from a single PC directly into the Mikrotik router and this then sends a constant ping to the next hop after the Mikrotik router (use a tracert command to discover this). If you do that and you see the same issues then you can discount your internal network and its either router, carrier or something on our network.

 

Thanks

 

Dave

[Sonic007]

So initially I had tried connecting by setting up a static IP address on a laptop and setting DNS to Google. I tried it when the internet was down and it returned that it was still not allowing me to connect.

 

Now I thought lets try it when the Internet is working.....So set the laptop to static IP, set Google 8.8.8.8 as DNS and interestingly it does not connect either.

If I set the DNS back to my domain controllers DNS settings then it runs fine. (When the internet is up of course).

[SchoolsBroadband]

So initially I had tried connecting by setting up a static IP address on a laptop and setting DNS to Google. I tried it when the internet was down and it returned that it was still not allowing me to connect.

 

Now I thought lets try it when the Internet is working.....So set the laptop to static IP, set Google 8.8.8.8 as DNS and interestingly it does not connect either.

If I set the DNS back to my domain controllers DNS settings then it runs fine. (When the internet is up of course).

 

That's likely a firewall setting. It's not great practise to all pupils to connect to a different DNS server. We (and you if you have your own VDOM) can create a firewall rule to allow access to DNS from a specific IP (as we currently do for your domain controller).

[Sonic007]

Thankyou for looking into the issue @SchoolsBroadband

 

I look forward to knowing what it could be. Until this started happening we were absolutely fine so hopefully we can work it out.

 

As I'm typing this right now I have access but it could go again within minutes. It is so random.

[CollierP]

Thankyou for looking into the issue @SchoolsBroadband

 

I look forward to knowing what it could be. Until this started happening we were absolutely fine so hopefully we can work it out.

 

As I'm typing this right now I have access but it could go again within minutes. It is so random.

 

Hi @Sonic007,

 

Sorry to see you experiencing issues. I've sent you an email but we've made a change to test a theory, can you monitor and let us know if there is any change?

 

Kind regards,

 

Paul

Head of Technical Operations

[Sonic007]

Many thanks @CollierP and @SchoolsBroadband

Your help is very much appreciated.

 

 

Do you want me to leave our network connected and run some pings from there or still go ahead and disconnect our network and hook up a laptop directly to the router to run some pings?

[Sonic007]

So far the Internet seems stable for the past 2 hours.

 

 

Edit:

 

Going to leave work now. Will pick up on things in the morning and see how the connection is.

Edited December 7, 2021 by Sonic007