Inbound traffic suddenly stops

[#1]

If we're looking for potential issues with the Vigor 166 or trying to eliminate it, I could dig out the old Openreach modem and put it in place of the 166. It's a simple box but it always worked. I wonder where it is?

If you can find it, then its got to be worth a try... if the problem still happens then we can at least eliminate the 166 as the cause.

[#2]

@DavidJ 

Thank you for affirming my understanding of this issue.

In short the suggestion is that some configuration modification to the router leads to one either the modem or remote end ceasing reception of out bound traffic or not returning responses to that traffic.

In the traffic analysis (either in the router I/F or [ X ] ) is there anything "odd" in the dialogue prior to the observed subsequent symptom?

The suggestion around what is happening somewhat infers that something somewhere out there has taken "exception" to what it received and has ceased to listen or has ceased to respond.

Thinking outside of the box and clutching at straws...

• Are you on a fixed IP or a dynamic IP - these alter the routing of your traffic to / from the internet
• Are you using the Plusnet (server based) firewall service

Have you looked on the UniFi community - there are a few references to unresponsiveness, such as UniFi Dream Machine intermittent not responding, dropping internet, performing bad | Ubiquiti Commun... but that was two years ago ... amd might not be entirely relevant.

[#3]

In short the suggestion is that some configuration modification to the router leads to one either the modem or remote end ceasing reception of out bound traffic or not returning responses to that traffic.

I know, it's weird! And (don't laugh), it can be something like turning the led status light on/off. A couple of weeks ago it had been running fine for 2 or 3 weeks. Then I added a mac address to the list of permitted wifi clients. As soon as the change was saved the problem started. I can't see what impact status LEDs or adding a mac address should have on the wan connection! A reboot, with the current firmware, will fix the issue. With later router firmware, reboots usually don't fix the problem. I know it's weird but those are the facts.

In the traffic analysis (either in the router I/F or [ X ] ) is there anything "odd" in the dialogue prior to the observed subsequent symptom?

Not that I can see. Everything is fine then suddenly duplicate TCP ACKs and retransmissions and DNS/ping requests with no response start happening.

Thinking outside of the box and clutching at straws...

• Are you on a fixed IP or a dynamic IP - these alter the routing of your traffic to / from the internet
• Are you using the Plusnet (server based) firewall service

Fixed IP and it's been the same for several years.

The Plusnet firewall is off. I've never used it. What rules I need I create on my router.

The router is definitely a factor in this, although Ubiquiti tech support point to the fact that the lack of DNS/ping responses can't be down to the router. If I swap out the router/modem for a BT Hub everything is fine, so it could be said that there's no issue with broadband. It would appear to be a combination of the two.

You've probably seen in my last response to @MisterW, I'm going to swap out the Vigor 166 modem for the old Openreach modem (if I can find it), if only to eliminate it from the problem.

Have you looked on the UniFi community - there are a few references to unresponsiveness, such as UniFi Dream Machine intermittent not responding, dropping internet, performing bad | Ubiquiti Commun... but that was two years ago ... amd might not be entirely relevant.

I have but not come across anything that might help. I'll swap out the 166, report back and take it from there.

[#4]

"I know, it's weird! And (don't laugh), it can be something like turning the led status light on/off."

No I will not laugh - I have seen utterly weird and inexplicable issues over the years which leaves me with a disposition that when all reasonable explanations have been explained, one is looking for something very bazar!

In past incidents after weeks of fruitless investigation, I finally correlated broadband disconnections with the train timetable, however not all trains were causing disconnections.  It took a deal more analysis to discover that it was only 11 coach Pendolinos which gave rise to the disconnections ... then with more refinement of the analysis I could discern the direction of travel of the train (North or South bound) from the connection monitoring.

A separate investigation in the same location (again after weeks of analysis) identified a correlation of problems with the arrival of dusk ... which eventually was found to be the IR illuminators on the CCTV system sending a PSU out of tolerance.

Many years in IT support have lead to me pointing to causes which no one thought possible or likely until the were forced to check the code.

The challenge here is that we cannot see what is happening on the [ VDSL ] side of the [ MODEM ].  We can see what the [ ROUTER ] sought to transmit, but we have no way of knowing that it was transmitted ... and absolutely no clue as to why an innocuous change to the [ ROUTER ] should bring about the seen experience.

It is moving into the realms of Voodoo!

When you have encountered this condition, do you restart ONLY the [ ROUTER ] leaving the [ MODEM ] in its exact same state?

Are the line stats accessible?  Is it possible to set up separate direct monitoring of the sync state and line stats?  My mind is wandering to the (laughable) idea that the event on the router gives rise to an RFI pulse which interferes with the modem's ability to transmit and receive ... which I suspect would give rise to the symptoms reported.  However mad this sounds, this would not be the first "you must be joking" suggestion I have made which actually fixed the issue.

You diagnostic approach to this issue is highly commendable; this is no 'ordinary' tech issue! 👍

[#5]

In the traffic analysis (either in the router I/F or [ X ] ) is there anything "odd" in the dialogue prior to the observed subsequent symptom?

Not that I can see. Everything is fine then suddenly duplicate TCP ACKs and retransmissions and DNS/ping requests with no response start happening.

@DavidJ if you've got a saved capture I'd be happy to have a look and see if I can spot anything.

[#6]

Many years in IT support have lead to me pointing to causes which no one thought possible or likely until the were forced to check the code.

Likewise. I always remember this true story which illustrates the point.

A lady in America took her car back to the garage saying it sometimes wouldn't start. When asked for more detail, she explained that she would stop for ice cream on the way home from work and, if she bought vanilla, the car would start fine. However, if she bought chocolate ice cream, the car would not start. The mechanic did not believe her but she insisted this was true so he offered to ride home with her a couple of times to see this for himself. Sure enough... vanilla ice cream - no problem. Chocolate ice cream - wouldn't start. The car went back to the garage but initially they couldn't find anything wrong. However, in the end they discovered the problem. In the shop where she bought her ice cream, the vanilla ice cream she liked was at the front of the store. However, the chocolate ice cream she liked was at the rear, and it was a big store. Turns out there was a design flaw in the fuel system where an air lock would form for a short period of time as the engine cooled. When she bought vanilla, she was in and out too quickly for the air lock to form. However, she was in the store for longer when she bought chocolate ice cream from the back of the store - just enough time for the air lock to form.

Never discount the facts, however weird they may seem!

And before, you ask... my router problem happens no matter what flavour ice cream I buy!

Back to the voodoo...

When you have encountered this condition, do you restart ONLY the [ ROUTER ] leaving the [ MODEM ] in its exact same state?

I only restart the router. I don't touch the modem, leaving the line sync'd with the exchange.

Are the line stats accessible?

The stats are certainly accessible when everything is working and they're accessible after the modem drops and reconnects the pppoe session. I haven't tried to access them when the problem occurs - there's only a short window between the traffic problem occurring and the router reconnecting the pppoe session. When I do check, nothing has changed. Sync time, status, speed and SNR values remain the same. I haven't checked the more detailed line stats.

Is it possible to set up separate direct monitoring of the sync state and line stats?

Don't think so.

I've had the Vigor 166 for a couple of years and it's been rock solid. However, before that I had a Vigor 130 which was more temperamental, although never showing this problem. I spoke to Draytek support about it at the time and they decided in the end that it didn't 'like my line' (their words, not mine) and they swapped it for my current 166. Although the 166 has been solid and hasn't been updated or changed in any way since way before these problems started, I'm wondering if it too has lost its liking for my line. I've found the old Openreach modem and I'll swap it over. Let's see if that makes any difference.

Thanks again for all your help and that includes @MisterW and the others who've contributed

[#7]

If you've got a saved capture I'd be happy to have a look and see if I can spot anything.

I do have a saved copy. It's about 80MB but I can chop it down to around where the problem is happening. How do you want me to get it to you? And do I need to remove/obfuscate anything? It has my fixed IP in it and my dsl username (when the pppoe session reconnects). Not sure what else is in there.

I'm just about to swap out the 166 for the old Openreach modem so I'll see what difference that makes first.

[#8]

Problem correlated to choice of ice cream - love it!

David - thank you for the laugh I needed today!

[#9]

True story!

And you're very welcome.

[#10]

i do have a saved copy. It's about 80MB but I can chop it down to around where the problem is happening. How do you want me to get it to you? And do I need to remove/obfuscate anything? It has my fixed IP in it and my dsl username (when the pppoe session reconnects). Not sure what else is in there.

I'm just about to swap out the 166 for the old Openreach modem so I'll see what difference that makes first.

lets see if the the  OR modem makes a difference. If not then I'll PM  you with an email address. Yes,  obfuscate your IP and username.

[#11]

Well, this is promising.

I swapped out the Vigor 166 for the old Openreach modem yesterday evening and so far so good. I've made several configuration changes to the UDM - things that have previously triggered the problem - and there have been no signs of the problem.

The problem didn't always arise with the version of the UDM firmware I'm currently running but it almost always happened with later versions. So I'll update the firmware on the UDM tomorrow and report back.

Fingers crossed!

[#12]

@DavidJ thanks for the update.

If it continues with no problems, then we just need to try and understand what was happening

[#13]

Still promising...

Updated the UDM to the latest firmware yesterday - no problems.

Made all the configuration changes that, in the past, have triggered the issue - no problem.

Everything is running smoothly.

I'll reboot the UDM a couple of times over the weekend to see if that triggers anything.

If it doesn't, I think we've found the culprit.

As you said @MisterW, the fun part will be trying to understand what was happening.

Have a great Easter weekend.

[#14]

@DavidJ ,  just out of interest, is there much difference in sync speeds between the Vigor 166 and old Openreach modem ?

[#15]

“I have a Draytek Vigor 166 modem which shows the line has been up for more than 1000 hours.”

From that I imply that throughout this saga / diagnostic the modem was not reset / had a continuous xDSL session.

I find it odd that some event on the router causes the modem to sulk … which all seems to be “fixed” by rebooting the router … whilst the router is left in its thought to be sulking state.