Internet randomly cutting out for 5 minutes several times throughout the day

[achedgy]

I've seen this behaviour at a few of my sites running unifi controller 6.4.54 (latest) Looks like in certain circumstances clients can't see the DHCP server when 2.4Ghz and 5Ghz SSID's are combined. Split them out (or just turn 5Ghz off for the moment) that seems to resolve it. Expect a new version will be along shortly that fixes it

[Sonic007]

I've seen this behaviour at a few of my sites running unifi controller 6.4.54 (latest) Looks like in certain circumstances clients can't see the DHCP server when 2.4Ghz and 5Ghz SSID's are combined. Split them out (or just turn 5Ghz off for the moment) that seems to resolve it. Expect a new version will be along shortly that fixes it

 

We are running 6.1.71 but good to know that, thankyou.

[Sonic007]

Ok, so this morning it is happening again.... So far at 09:15 and then recently at 10:14

Today is has only been down about a minute or two so I don't have much time to get testing.

 

From what I have been able to do when it is down:

 

- I can ping the domain controller.

 

- I can NOT ping 8.8.8.8

[speakercon]

What firewall do you have? Can you connect to/ping that when the issue is happening?

[Sonic007]

Firewall is with the ISP, Schools Broadband.

[speakercon]

Ah I see, is this a new connection? Are you able to ping the router during the issues & do you have VLANS?

[Sonic007]

Ah I see, is this a new connection? Are you able to ping the router during the issues & do you have VLANS?

 

Was installed in July and was working fine until now.

 

I can ping the router and my domain controller, but cant ping any external websites.

No VLANS.

[speakercon]

I'd be inclinded to think like you its an issue with your connection, but your DHCP issue casts doubt on that.

 

Does the dhcp issue only happen at the same time as the internet outage? Is it only affecting devices joining the network during the issue time, or do devices loose their IP that were already connected?

[SchoolsBroadband]

Was installed in July and was working fine until now.

 

I can ping the router and my domain controller, but cant ping any external websites.

No VLANS.

 

Hi Sonic,

 

I suspect you've already raised a case with out team but if not do send me a PM.

 

I'd recommend keeping a couple of constant pings going. One to the router we supply and one to the IP of the Fortigate at the other end. Then you'll know where the packets are dropped.

 

I'd also recommend doing this on a few different devices at the same time to see if its device specific or if its a common issue for all devices to rule that out.

 

Also when there's an issue do a tracert command. You can then tell where your packets get up to. Might be worth doing that too whilst everything is working properly and then work you way up through the IP list by doing constant pings to see where the packet is being dropped.

 

There could be an outside chance we have an OSPF issue on your link specifically where for some reason our router is losing its neighbour (our core) although i doubt it but will check.

 

I'll fire you a PM over and see if I can help at all.

 

Thanks

 

Dave

[kingoranks]

@Sonic007 Best of luck with finding the cause.

[PaddyNewman]

I still think the fact you can ping but can't go out is going to be internal and arp- a should hopefully highlight that with the gateway MAC. I had to deal with it recently where a student put his phone on a static IP which clashed with the router, but I've seen countless in the past. Windows will respond to ping, phones don't so was easy to track down on the edge device as I saw no pings to it, so they were sucked away before, which indicates stolen gateway IP.

[SchoolsBroadband]

yes. it might also be worth seeing if your DHCP scope is getting full up or you have two DHCP servers by mistake.

 

As others say looking in the ARP cache will show you if two MAC addresses have been given the same IP address. If you've got two different MAC addresses that relate to the router i.e. Gateway then this will definitely break stuff.

 

Dave

[password1234]

Not a faulty Switch or something? Had something similar few months ago at a school, ended up being a faulty POE Switch!

[Sonic007]

Not a faulty Switch or something? Had something similar few months ago at a school, ended up being a faulty POE Switch!

 

 

I think that is unlikely as I can still access all network resources and server.

The problem affects everyone too, wherever and however they are connected in the building.

[Sonic007]

I still think the fact you can ping but can't go out is going to be internal and arp- a should hopefully highlight that with the gateway MAC. I had to deal with it recently where a student put his phone on a static IP which clashed with the router, but I've seen countless in the past. Windows will respond to ping, phones don't so was easy to track down on the edge device as I saw no pings to it, so they were sucked away before, which indicates stolen gateway IP.

 

It's just gone down again now.

So I cant ping any external site but can ping router and domain controller.

 

Tracert to google.com displays "request times out" on the second step after router default gateway.

[PaddyNewman]

As in it shows the routers IP then * * * ?

 

You should type arp -a and take note of the gateway MAC address.

 

When it goes down again, do the same and see if the MAC has changed. If it has someone is stealing the GW IP and thats going to be horrible to work out who, but will tell you some info with the MAC.

[Sonic007]

yes. it might also be worth seeing if your DHCP scope is getting full up or you have two DHCP servers by mistake.

 

As others say looking in the ARP cache will show you if two MAC addresses have been given the same IP address. If you've got two different MAC addresses that relate to the router i.e. Gateway then this will definitely break stuff.

 

Dave

 

So it's just stoppped working again.

 

I went on to the domain controller and in cmd did arp-a

This listed a whole list of IP addresses and their physical addresses.

 

I could not see the domain controller listed there. Is that normal?

[Davit2005]

Can you ping from Router to the Internet from the CLI or GUI of the firewall. Sorry not familiar with the firewall. If you have not got access I'd suggest you speak to your ISP and get them to give you at least read only access, if they do not kick up a fuss and involve the SMT or who pays the ISP bills.

[Sonic007]

As in it shows the routers IP then * * * ?

 

You should type arp -a and take note of the gateway MAC address.

 

When it goes down again, do the same and see if the MAC has changed. If it has someone is stealing the GW IP and thats going to be horrible to work out who, but will tell you some info with the MAC.

 

 

Yes, so it shows the routers IP address and then the next hops are all starred out timing out.

 

I did do an arp-a from the domain controller a few seconds ago when it went down and for the gateway address it says type: dynamic and the MAC has stayed the same when internet is up or down.

[PaddyNewman]

You should do this from your machine, your machine is the one affected and to find the gateway it relies on arp entries. It asks who has 192.168.1.1 for ex, device on that responds with 192.168.1.1 is at 00:00:00: etc

 

If you windows device is showing a MAC for the gateway but it differs to the one when its working (this is why you need to take note of it now, even if its just the first 6 digits) and when it doesn't work, see what it comes up with.

 

you can also try a ping -a 192.168.1.1 (use your gw address) and if the name responds with something silly like randoms-Macbook, then you know where its at.

 

Intermittent connections are annoying as hell, and it could be a terrible external connection, but for that you can use thinkbroadbands BQM.

[atcoates]

Luckily we are a primary school and most students don't know much about I.T. (Yes I know.... famous last words.... and we probably have a kid genius hacker brewing in year5 or something).

 

Will take a closer look and ping.

I recently had a year 5 Pupil that tried to set up his own wifi hot spot to avoid the filtering. We've had year 4 pupils replace the proxy settings on Ipads etc (stopped that now)

[Sonic007]

Thankyoufor your help Paddy, It is very appreciataed.

 

I've checked Mac of routers gateway and going to wait for it to go down again to compare.

 

Just checked the ping -a on our gateway and it doesnt show any other machine listed, just the IP so hopefully that rules that one out.

 

It is definately a pain to be diagnosing thats for sure! It doesnt help when staff are putting on the pressure too and coming out with things like "well when I'm at home i just reboot the router. Have you tried that". Oh my! Happy Monday to me!

Edited November 15, 2021 by Sonic007

[speakercon]

Are you able to ping the remote firewall?

[JATSO]

We have the occasional dropouts at one of my schools, mostly happened when the new IP phone system was linked into out network, we complained and had them move to their own router, we get the odd one now and again still but not as many times, our ISP reckon it is a poor connection from the router to the switch which I have changed, so far its been ok but they soon let you know when their teams meeting goes off.

 

At my other school the 169 xx address issue was caused by there not being enough addresses in the scope, easily solved and a reboot of the wifi.

[Sonic007]

OK, so thought I would follow this up...

 

So for the past day we have had a stable Internet connection without any problems.

 

Now the only thing that has changed is that there are 3 staff currently off sick so I am going to be monitoring them very carefully when they return.