Router's "My Home Network" instability

[#1]

Just FYI I managed to get the login screen on port 81 at 1132. Thanks for your reply MisterW, you know far more than I do in this area

[#2]

MisterW, thanks for weighing in.  I'm running Wireshark  promiscuously from the wired side.  So in essence, I have Wireshark (ver. 1.12.7) hard wired into the ZeroHub switch ports.  I'll try to set this up and get the FireStick running as well.  I'll try to post a complete capture file.
Anotherone - thanks for accessing the webcam.  Unfortunately, as far as ARP is concerned, you didn't.  I left Wireshark runnning all night since my previous post, and there were no ARP replies grabbed from the Foscam .  None. And it's not showing as connected in My Home Network as of this post time..  The FireStick has gone now too you'll see.  The Wi-Fi entry is someone's laptop.
  ZeroHub is a switch.  That's port to port unicasting isn't it?  Can someone please confirm whether the ZeroHub is a switch and not a hub ?

[#3]

Whoops.  Forgot attachment...

[#4]

Quote

MisterW, thanks for weighing in.  I'm running Wireshark  promiscuously from the wired side.

Ahh, I thought you might be, as it's obviously easier to sniif from the wired side.
I had a theory (and it's only a theory!) on one of the other threads that arp traffic MIGHT not be getting across the LAN-WLAN 'bridge' in the router under some circumstances. It would be useful if possible to sniff on the wireless side as well , I think Wireshark can do that given a suitable wireless adapter http://searchnetworking.techtarget.com/feature/Wireless-sniffing-best-practices-using-Wireshark . I would have a go myself but unfortunately i don't have a 2704 to play with.

[#5]

Quote

ZeroHub is a switch

I've got some info on how the TG582n works internally (I'll try and dig it out when I get home) and I imagine most routers work very similarly. The LAN ports are usually just a simple physical switch but then there is some 'bridge' to connect the WLAN and the internal router port.

[#6]

Re the "My Home Network", for whatever reason, it's useless, not always showing all the connected devices and sometimes never showing some if other posts are anything to go by. You need to look at expert_user ARP and DHCP pages as mentioned in reply #2.

[#7]

Quote

It would be useful if possible to sniff on the wireless side as well , I think Wireshark can do that given a suitable wireless adapter

FWIW I've just tried that on a Linux(Ubuntu) box with a USB wireless dongle and it does work. Probably depends whether the wireless adapter will support 'promiscuous' mode...

[#8]

Quote from: Anotherone

You need to look at expert_user ARP and DHCP pages as mentioned in reply #2.

On my ZeroHub, there is a 1 to 1 correspondence between the normal and expert pages for the ARP table. I've just seen a device drop off and reappear in both screens.  I'd expect this actually as they both should really just be a presentation layer for the underlying table.
Although, seeing references to bugs  like below  in a production box doesn't make me come over all warm and fuzzy:-
0',
                          '0',
              '0',//lang_setting
              '0', //STC_ADVANCED_PAGE
              '0', //STC_BASIC_PAGE
              'admin',
              'user',
              'support',
              '0',
              '1', //70
              '0', //MTS_BASIC_PAGE
              '0', //MTS_ADVANCED_PAGE              
              '0',//bug 13798
              '0', //SAGEM_BASIC_PAGE
                          '0',
                          '0',
                          '&nbsp',
                          '0' //bug 11333
                          );
I should be able to sniff wireless from a laptop I think.  I'll try to set something up...

[#9]

Err, slight hitch.  How do I post a capture file onto the forum please..?

[#10]

Ah ha, size will be the limiting factor - zip it if need be. But when you click Reply, or Preview if using the quick reply box, there's button bottom left + Additional Options and Attachments - click that 4096KB is the limit, but also the file types, so add the extension .pdf onto the end of the filename and mention in your post to remove that after it's downloaded by whoever wants to look.

[#11]

Hi chaps, I've been doing some thinking about this problem. Could it possibly be due to wifi power saving mode in either the router and/or clients ?
My theory ( and it's just a theory ) is that power saving is preventing the arp broadcast packet going out from the router to the WLAN. With a normal wifi client ( e.g laptop ) it probably doesn't matter, since sooner or later they're likely to wake up and want to send data to the internet. If their own arp cache is not valid they will send arp broadcasts for the gateway address, to the router which will presumably refresh the router's own arp cache as well. The cams however probably aren't sending any data and therefore won't send any arp request themselves, hence the routers arp cache expires and if it doesn't get replies to it's own arp requests the cams will be 'lost' .
Any thoughts ? 

[#12]

I've run a capture overnight.  It's already filtered for ARP only, sniffed on the wireless side.  To use the file, please change the extension to .pcapng.  This is a Wireshark file.
Some other info:
There are is a linux server, windoze pc, linux laptop, Firestick and 2 webcams running all night.  There is no power saving mode on the webcams, but there is a sleep mode on the Firestick.  From the traffic, it's unlikely that the ZeroHub went into power saving mode either.  The capture was started, then I used the FireStick and rebooted one of the web cams, and looked through it.  I then left it all night.  I then rebooted the web cam again, and used the Firestick again. The capture was then stopped.
:06 is the ZeroHub (.254 static)
:15 is the server (.205 static)
:64 is windoze (.3)
:87 is linux laptop (.2)
:0b is Firestick (.1)
:05 is webcam0 (.200 static)
:d9 is webcam1 (.201 static)(shenzhen)
You can see that the cameras are very quiet, especially :05 which was up and running all the time, but not looked through.  The Firestick comes and goes from the ARP table, but you can be viewing through the cameras and they do do not appear in the Home Network list.  How can this possibly be?  It shouldn't.  If the ZeroHub is a switch, there will be another list of MAC addresses stored, pairing MAC address to switch ports.  Or MAC addresses to LAN /WAN bridge???  Might this operate independently of pure ARP?  But whilst :d9 is wireless, there's a really thick double shielded patch cable up :05's socket.  Packet 28 is interesting as you can see ZeroHub's request, but it's ignored by the webcam.
The port forward to the camera has stayed up now for 3 days, but won't last.  
I'm experimenting with crafting my own ARP packets to get ARP on demand, but I'm a beginner at that bit.  I'm approaching the limit of my networking skills on this one  

[#13]

I think the capture hasn't captured all the ARP traffic on the network. It only appears to have captured traffic to or from :87 or to the broadcast address.
Packets 5 to 10 probably indicate that those ARP requests were not answered, packet 28 is probably an ARP request where the reply was not captured.
Promiscuous mode doesn't really make any difference here, even though it's wireless, it won't capture traffic between other devices and the AP. To capture all the wireless traffic, you'll need to capture in monitor mode. And to decrypt the traffic between other devices, to see the ARP and other packets within the wifi packets, you'll need to capture the moment when they connect to the wireless, and put the wireless password into wireshark. With WPA2 encryption, although each device uses the same wireless password, each device generates its own unique encryption key when it connects to the wireless network. There's also a group key used for broadcast traffic.

[#14]

Hi, ejs is of course correct , the arp replies are not broadcasts and therefore we won't see them from other devices
The capture does show that at least the broadcasts are getting through to the wlan which sort of scuttles my theory.
Given that replies weren't showing when capturing on the wired side it does look like the cams aren't replying.
Where we go from here I'm not sure...

[#15]

I don't think setting promiscuous mode on your Ethernet adapter will allow you to see traffic to other Ethernet devices, the Ethernet switch will still be acting as a switch? I think we can only infer that something isn't getting a reply when it is sending repeated (broadcast) queries for the same address.
A monitor mode wireless capture should capture all wireless traffic, but the capture files become inconveniently large fairly quickly, so it would be more suitable to capture short experiments rather than leave running for a long time.