Extreme fluctuations in ping

By Marty9231
Sep 19, 2012
Post New Reply
  1. Hey guys,

    I have some serious issues with my internet... As you can read in the title, my ping, and therefore my connection, is fluctuating. You'd probably think extreme would be between 50-300, but mine is more like 30-4000. I'm using the "ping -t google.com" command in cmd to check my average ping, to see whenever it spikes.

    I should probably tell you something about my situation here, because it isn't 100% ideal:
    I'm in a shared house, because I'm in university now. I have a total of 3 'housemates', although they have completely seperate living area's. We all share the internet connection though, but I don't think they're the issue.

    The thing is my ping fluctuates heavily between 30 and 4000 ping with large periods of time when it just says "request timed out." because there's no connection at all. At first I thought it was my housemates who were just constantly downloading, but I ruled that out because it remained throughout the weekend when they weren't even here. The only moments I did have complete access to the internet with normal ping (20-60) was in the very early morning (~7:30) and the late evening (~23:30). I also figured that even the most intense of downloading wouldn't completely shutdown the internet for everyone else for like 7 hours straight.

    That's when I contacted the house owner about it. They told me they've had problems with slow or on/off internet before, and that I should just reset the router and modem. I would've done that sooner, but I didn't have access before. Now I do, so I did just that and it removed the spikes that caused complete loss of internet. Instead it now fluctuates between 100-1000. There's one thing though: I can't seem to connect to the router's webpage, as in I can't even find where it's at. It's a Netgear 'Rangemax' Wireless Router, so if someone know's how to connect to it, please do tell :). (I've tried "routerlogin.net" "routerlogin.com", my default gateway, 192.168.1.1, 192.168.1.0, 192.168.0.1 and 192.168.0.0)

    I'm a pretty avid gamer, so these kind of pings aren't exactly acceptable to me. I'd like to know what is going on, and what can be causing this. Any help with solving this problem is more than welcome.

    Added is a snapshot from the cmd ping history. Maybe this will tell you more/enough.

    Thanks in advance!
    Marty

    Attached Files:

  2. jobeard

    jobeard TS Ambassador Posts: 13,018   +220

    If you use tracert 74.125.132.138, then
    • the first line of the output will be your local router
    • and the second will be your ISP gateway.
    assuming you're on windows, get the command prompt and enter
    pathping -n 74.125.132.138

    it will tell you how long it will take to complete - - WAIT FOR IT.

    the results will show you the time from one node to another for every node between you and the target.

    If the large variations are on line one or two, then it's the equipment at your residence.
    Anything else, it is beyond your control.
  3. Marty9231

    Marty9231 TechSpot Enthusiast Topic Starter Posts: 197

    I executed both those commands. The first one gave me a trace list of IP addresses with the time it took to reach them (I think) and it looks like this:


    Tracing route to wb-in-f138.1e100.net [74.125.132.138]
    over a maximum of 30 hops:

    1 16 ms 12 ms 27 ms A
    2 357 ms 626 ms 300 ms B
    3 641 ms 328 ms 300 ms C
    4 854 ms 617 ms 730 ms D
    5 293 ms 711 ms 231 ms E
    6 782 ms 422 ms 618 ms F
    7 599 ms 224 ms 756 ms G
    8 * * * Request timed out.
    9 559 ms 612 ms 282 ms wb-in-f138.1e100.net H


    The fact that the high ms starts at my provider isn't a good sign, I presume.
    The second gave me this:




    Tracing route to 74.125.132.138 over a maximum of 30 hops

    0 192.168.1.35
    1 192.168.1.254
    2 82.169.27.254
    3 195.69.144.247
    4 209.85.248.118
    5 209.85.255.70
    6 209.85.240.221
    7 216.239.49.45
    8 * * *
    Computing statistics for 175 seconds...
    Source to Here This Node/Link
    Hop RTT Lost/Sent = Pct Lost/Sent = Pct Address
    0 192.168.1.35
    0/ 100 = 0% |
    1 --- 100/ 100 =100% 100/ 100 =100% 192.168.1.254
    0/ 100 = 0% |
    2 456ms 0/ 100 = 0% 0/ 100 = 0% 82.169.27.254
    0/ 100 = 0% |
    3 471ms 1/ 100 = 1% 1/ 100 = 1% 195.69.144.247
    0/ 100 = 0% |
    4 470ms 0/ 100 = 0% 0/ 100 = 0% 209.85.248.118
    100/ 100 =100% |
    5 --- 100/ 100 =100% 0/ 100 = 0% 209.85.255.70
    0/ 100 = 0% |
    6 --- 100/ 100 =100% 0/ 100 = 0% 209.85.240.221
    0/ 100 = 0% |
    7 --- 100/ 100 =100% 0/ 100 = 0% 216.239.49.45

    I have no idea how to interpret that, so any help on that would be great.
    The final conclusion is probably that it's my ISP's fault, right?

    P.S. I should also tell you that for like 10 minutes after the modem/router reset, my ping was a perfect 20-30ms.
  4. jobeard

    jobeard TS Ambassador Posts: 13,018   +220

    All times are poor :( even the 16ms to hit the local router !!! ouch; mine is <1ms
    [GW*] looks like your ISP gateway is
    • C:\Users\Jeff>nslookup 82.169.27.254
    • Name: 82-169-27-254.ip.telfort.nl
    • Address: 82.169.27.254
    P.S. I should also tell you that for like 10 minutes after the modem/router reset, my ping was a perfect 20-30ms.[/quote]

    I have no idea why we see both 192.168.1.35 & 192.168.1.254 in the tracert. This suggests there are multiple
    routers wired routerA-->routerB-->ISP which is possible but normally not what you want.
    Find the network ADMIN and ask
    • do we have two routers wired in a daisy chain? (ie: the lan port of one to the wan port on the other)
    if so, disconnect from the Lan->Wan and connect LAN->Lan leaving the wan port on the second router empty.
  5. Marty9231

    Marty9231 TechSpot Enthusiast Topic Starter Posts: 197

    We don't have two routers, but the LAN cable from the modem does go to a 'normal' port on the router. I've noticed this when I reset it, but when I tried putting the cable in the regular 'internet input' port there was no internet at all, no idea why. Could that be the only problem?

    Also, could it be that there is a 'daisy chain' outside of the house?
  6. ITLogicSystems

    ITLogicSystems TechSpot Enthusiast Posts: 106

    Ok, it kinda sounds like to me that the tracert results showing 192.168.1.35 & .254 is b/c there IS two routers on your network. Here's what I think is happening....
    Many ISPs cable modems are routers as well, mine is I have comcast for example. I'd say the 192.168.1.254 is the cable modem ip address & it's setup with a DHCP pool that includes 192.168.1.35. When you said that the cable modem plugs into one of the normal switchports that's when I realized what was happening. so the cable modem is handing out ips to devices connected AND I bet that the router is config'd w/ DHCP as well - handing out IPs to devices connected to it via wire or wireless. So your laptop is getting an ip maybe from the cable modem or maybe from the router - anyway you look at it two DHCP servers on the same network can be trouble, unless they are on different subnets & have different DHCP pools.

    Now, that being said... ideally, if you could connect your laptop directly to the cablem modem, reset it & get an ip from it, connect to cable modem web interface - you could confirm my theory. once connected to cable modem, test your ping times again with info from previous posters (which have done an outstanding job troubleshooting btw) if ping times are great, then we know it's an issue w/ either the router itself OR it's a mis-config (most likely a mis-config). Check with your landlord or network admin about getting the router config'd as it needs to be, which is to be config'd just as a wireless switch.

    Hope this helps, please post back - I'm interested in how this turns out.
  7. jobeard

    jobeard TS Ambassador Posts: 13,018   +220

    Hmm; If you can get the HOUSE admin to make changes, I would suggest that the HOUSE router disable WiFi and support only wired connections - - giving him/her control of just who can access this network.

    The user(s) can then add a WiFi router for their convenience.

    Issue A: Multiple routers creating multiple subnets:
    Given-case-1:
    Code:
    isp===modem/router (192.168.1.1)
              |
              + --- user's router#1 (192.168.2.1)
              |
              + --- user's router#2 (192.168.3.1)
             ..
             and so on
    
    The advantage of the above is the multiple subnets cause all systems to get outbound services just fine, but portforwarding is a nightmare. The router#1 and #2 systems can not be reached by one another and act as a defacto firewall (the reason is there's no ROUTE from one to the other.)

    The disadvantage is print/file sharing across these subnets fails for the same reason.

    DHCP on each of the above will serve only its own subnet.

    Issue B: Multiple DHCP servers on the same subnet.
    Given-case-2:
    Code:
    isp===modem/routerA (192.168.1.1) --- routerB (192.168.1.254)
    
    Regardless of wired/wifi, any system attached to either of these routers which requests DHCP
    will create a 'race' for the reply (the one that replies the fastest will win).
    This will 'work' but is a very bad choice. It works only if each router has a unique DHCP pool
    (192.168.1.2->192.168.1.100 vs 192.168.1.101->192.168.1.253).
    If not unique, then the two DHCP could both handout the same IP address and create conflicts.

    Your case is like this and I would advise you just change YOUR router's address to 10.0.0.1
    which will give you CASE-1 above
  8. jobeard

    jobeard TS Ambassador Posts: 13,018   +220

    hmm, not good. This should work and even still give WiFi support. This makes me suspicious of your router.
  9. Marty9231

    Marty9231 TechSpot Enthusiast Topic Starter Posts: 197

    Alright, sorry for the late reply, been away for the weekend.

    The situation is now as follows: The modem has a phone cable coming into it (small UTP cable, don't know what else to call it). There is a single cable coming out the modem (excluding the power cable, btw) which is a regular UTP cable leading directly to 'port 1' on the router. Mind you that this is a regular router port, not the 'Internet in' port.

    When I got here sundaynight, everything was great, ping was around 30-40 and there was no issue whatsoever. However, today starting in the afternoon, things became like they were before. Ping hovers at around 400-600 with spikes up and down as high as 1000 and as low as 30.

    Because of this, and after reading your posts, it began to look like any other internet user gets everything, and I get nothing, just like the 'race' you were describing. Also, does the fact that the regular 'internet in' port on the router isn't working mean that the router is broken? Should it still work nearly the same with the cable going to 'port 1' on the router?
    Why would the ping be awesome on Sunday night (and before 9am and after midnight, btw), and be so incredibly high on weekdays? I'm sure it's not just that someone is downloading, because I've tested it when literally no one was home. Could these workday-timings have anything to do with the ISP?

    More directly responding to your previous post, how do I actually change my router's address to 10.0.0.1? And what exactly would this do for me?
  10. jobeard

    jobeard TS Ambassador Posts: 13,018   +220

    Yes, done that many times. FYI, this makes this device behave as a SWITCH, not a router ... more below
    unexplanable :( the tracert results suggest your router has issues (ping should be very small) as well as the upstream network beyond the ISP.
    this race is only for the DHCP request for an IP address, nothing to do with website access
    YES! moving from port1 to the Internet (WAN) port changes the operation from switch -> router, but not the website access
    AGREE!
    a) access your router's config page using your browser and its IP address {should be the 192.168.1.35 address}
    b) find the LAN config tab
    c) you should see 192.168.1.1 I believe. Change it to 10.0.0.1
    d) save it
    e) you SHOULD loose access immediately

    now move the UDP from port1 back to the Internet port and let the connection be created

    get a command prompt and issue IPCONFIG /ALL
    the Gateway should be 10.0.0.1 and your system address likely to be 10.0.0.2

    Browsing should be fine and tracert 8.8.8.8 should be low to 10.0.0.1 and up to 192.168.1.254.
    Beyond that, all bets are off
  11. Marty9231

    Marty9231 TechSpot Enthusiast Topic Starter Posts: 197

    Ok, this made me chuckle, but the 192.168.1.35 IP lead me straight to the printer...

    I found a page that requires login (192.168.1.10) but I tried all default username/password combinations I could find and none worked. Does this mean this is the wrong page? Is there any way to be sure what the right page is?

    P.S. The change of the IP to the printer might be caused by the router being reset earlier today.
  12. jobeard

    jobeard TS Ambassador Posts: 13,018   +220

    Post#4 gave me the IP addresses
    If 192.168.1.35 is a printer, then your TCP settings have change.
    Run tracert 8.8.8.8 again and the first IP address shown is YOUR router. Start there
  13. Marty9231

    Marty9231 TechSpot Enthusiast Topic Starter Posts: 197

    That gives me "192.168.1.254" but typing that in my browsers address bar gives me nothing. I do have to say that I noticed that there's only one IP before the provider now though.



    Tracing route to google-public-dns-a.google.com [8.8.8.8]
    over a maximum of 30 hops:

    1 3 ms 8 ms 5 ms 192.168.1.254
    2 19 ms 22 ms 22 ms 82-169-27-254.ip.telfort.nl [82.169.27.254]
    3 26 ms 27 ms 23 ms core1.ams.net.google.com [195.69.144.247]
    4 22 ms 21 ms 25 ms 209.85.248.118
    5 23 ms 24 ms 22 ms 209.85.255.74
    6 43 ms 24 ms 25 ms 216.239.49.36
    7 * * * Request timed out.
    8 24 ms 24 ms 25 ms google-public-dns-a.google.com [8.8.8.8]

    Trace complete.

    I'm beginning to think it's time to urge the house admin to contact the ISP...
     
  14. jobeard

    jobeard TS Ambassador Posts: 13,018   +220

    Sounds right !!
    and these look MUCH BETTER !!!
    hmm - - not quite yet. I think someone has had their hands on the house router and installed another device
    for (gulp) spying or just didn't know what they were doing.

    Do yourself a favor (and from this thread you now have some background in the problem) as well as helping the house;

    Download and install WD View Network

    Run that every time you go online to see what is on this router.
  15. Marty9231

    Marty9231 TechSpot Enthusiast Topic Starter Posts: 197

    That would be because in the early morning everything is fine. When I do this in the afternoon everything is like the first time I posted it...

    I doubt a device was installed for spying (Although I never know, because this is a student-shared residence) but can it be that the network printer is messing things up? Is it possible that just by being turned on and being connected to the network it is doing something wrong? The reason I ask is because I saw it had a complete network page with network configuration and everything.

    That program looks useful, I'll download it, run it and update you here tonight.
  16. jobeard

    jobeard TS Ambassador Posts: 13,018   +220

    hardly think so.
    I say that because we saw a path like
    Code:
    0 192.168.1.35
    1 192.168.1.254
    2 82.169.27.254
    ...
    
    *IF* 192.168.1.35 is a printer (very doubtful) then it would be wired like
    router--->printer-->192.168.1.254-->house systems and I've never seen a printer with two NICs.
    HOWEVER, it is possible that some smarty in the house sits on 192.168.1.35 and masquerades as a printer :(
    yeah, they do that, but there's nothing there that isn't also available from ipconfig /all
  17. Marty9231

    Marty9231 TechSpot Enthusiast Topic Starter Posts: 197

    Alright, I ran the program. It found 5 devices: 2 pc's (mine and someone elses), the printer and 2 (yes, 2) gateways, listed below in detail.

    • Gateway
      • Device Type
      • Gateway
      • IP
      • 192.168.1.254
      • MAC Address
      • 00:02:cf:9f:a4:2c
    • Residential Gateway
      • Device Type
      • Wireless Gateway
      • Manufacturer
      • NETGEAR, Inc.
      • Model
      • RangeMax(TM) Wireless Router
      • Model Number
      • WPN824v2
      • Description
      • RangeMax(TM) Wireless Router
      • Device Home Page
      • /start.htm
      • Host Name
      • Residential Gateway
      • IP
      • 192.168.1.10
      • MAC Address
      • 00:18:4d:52:4a:c8
      • Vendor Name
      • NETGEAR, Inc.
    I'm not sure what to make of this, so I'd like to hear your input. However, after seeing these results I checked the router (rangemax) webpage again (192.168.1.10) and I got a login window like last time. The only problem is that all username/password combinations (tried all combinations known to netgear) are wrong. Even though it should have reset when I did a hard-reset on the router and modem (right?).

    On a sidenote, the ping/connectivity has been fine all evening. This is making me more and more confused...
  18. jobeard

    jobeard TS Ambassador Posts: 13,018   +220

    When you see both 192.168.1.254 & 192.168.1.10
    1. find your IP with IPCONFIG /ALL
    2. run TRACERT 8.8.8.8 and abort after the 4th reply
    you should see #1 being your router
    • (I assume it's the NETGEAR, Inc. RangeMax(TM) Wireless Router WPN824v2)
    and then house router at 192.168.1.254 and then the ISP gateway.

    We have to reset your router and move it away from the 192.168.1.x subnet.

    Disconnect your router from the house router.
    Press the reset and hold it for 5-10seconds
    Disconnect from the A/C power, wait 30seconds
    connect your system to your router and then power on your router.

    Netgear routers default to admin/password
    To login to your NETGEAR router administration interface, open the following URL using your web browser -
    http://192.168.1.1 or http://192.168.0.1 or http://www.routerlogin.net or http://www.routerlogin.com

    get control of the router settings and the password. We'll fix the WiFi later.
    set the router address to 10.0.0.1 and the DHCP range to 2-16
    set the admin password as you please
    save the settings and you will loose the connection (that's expected)

    login again http:/10.0.0.1/

    Be sure to disable UPnP and REMOTE Management

    now you can setup the WiFi: Pick a channel, a unique SSID but not obviously identifiable with you.
    select a WPA key (or wpa-tpik key).
    save the settings and restart again.

    NOW you can wire houseRouter-->yourRouter-->yourSystem

    Tracert 8.8.8.8 should show
    #1 10.0.0.1
    #2 192.168.1.254
    #3 ISP Gateway
    ... blah blah

    ping times should remain constant
  19. Marty9231

    Marty9231 TechSpot Enthusiast Topic Starter Posts: 197

    Now I'm confused. The only network devices in play here are the Modem (in: cable + power, out: UDP) and the RangeMax Router (in: UDP + power, out: wifi). From what I understand the RangeMax router is the houseRouter, so what do you mean by 'yourRouter'?

    I figured I needed to link my pc directly to the router at some point, but for that I'll need a long enough UDP cable (the router is down the stairs). Does the router need to be linked to the modem during the reset and setting of the new address? Or do I disconnect it before, and connect it after the address is set?

    Anyway, I'll only be able to test the router --UDP--> computer connection next monday, because I don't have an UDP cable here. Unless I can disconnect the router entirely, take it upstairs and link it to my pc and the power here, configure stuff, disconnect, take it back down and connect everything again where it's supposed to be.

    On another sidenote: at 23:00 exact, the 'Gateway' device on the network (listed in my previous post) disappeared, and now the 'Residential Gateway' is the only one connected. This makes me think it's something other than the modem->router chain I can actually see. What do you think of this?
  20. jobeard

    jobeard TS Ambassador Posts: 13,018   +220

    ??? WHAT??
    Someone's playing with the wires!!
    Your network is unsafe (imo) and no one should be logging onto bank accounts until this is solved!

    Networks don't behave this way.
    Your confused - - try setting on this end and figuring this out :grin:

    OK, from the top;
    What do you mean by HOUSE ROUTER? Is it yours or does it belong to the dorm?

    Where is Modem (in: cable) device and who has physical access to it?

    Where is the RangeMax Router, who has access to it and who manages its configuration.

    If the wires are Modem --- RouterA --- RouterB and A goes offline, the everything on B has no service until
    it is rewire Modem -- RouterB.

    Your trace route is documenting that you absolutely have Modem--RouterA---RouterB---yourSystem.
    It is possbile that (Modem-RouterA) are in the same box, but then routerA can never disappear.

    Someone is messing with you !!!!
  21. Marty9231

    Marty9231 TechSpot Enthusiast Topic Starter Posts: 197

    I rechecked with the tool a couple of times after my post, and the IP of the 'Gateway' device was still there after 23:00, only now it was listed as a 'Network Device' instead of 'Gateway'. So it didn't disappear, but it did 'change'.

    From the top;
    There are only two network devices (that I know of) and they are the modem and the router. They both belong to the house owner, but I have a feeling that they have no clue as to how to properly operate them, as they told me that 'restarting them' fixes everything.

    The modem is located on a shelf in the hallway, in theory everyone has access to it. The RangeMax router is right next to it, so everyone has access to that as well. I don't think anyone is managing any configuration. These people strike me as the 'take for granted' type, and I think they just assume internet is there. I assume that because the house owner just told me to reset both of them out of nowhere, which would in theory give me complete access to it (they told me I could just do that whenever I wanted/needed to, so I don't think they have a clue what they're doing).

    The (visual) wiring is like this: --Modem--Router(RangeMax)~~YourSystem. Also, note there are no wired connections anywhere in the house except the modem--router connection. Since the RangeMax (visible) router remains online through the night etc, the router that changed name from 'Gateway' to 'Network Device' would have to be the one possibly inside the modem or out of sight. If it's out of sight it would mean it's only connected through WiFi though.

    I just looked at the Modem a little more closely, and it is a 'ZyXEL P-2602R-D1A'. It looked completely normal to me, except for one thing. It had two 'Phone' ports on it, like it's a router but just for phone lines. I'm not sure, never seen it before. I'll add a picture so you can see for yourself.

    Normally I'd believe that someone was messing with me, except now I don't think the house owner has a clue what they're doing. Why would they allow me 100% access while trying to 'mess with me' at the same time...?

    Edit: Breakthrough, I think. While I was uploading the picture for this thread, my ping spiked up massively for a very short while. I made the logical link that uploading was maybe causing the high ping and lack of internet. I ran an upload test of 30MB (Testmy.net/upload) and the results were as expected. From a constant 20-40 ping, it spiked up to ~600 constantly. The latter is the kind of ping I have during the day. Input?

    Attached Files:

  22. jobeard

    jobeard TS Ambassador Posts: 13,018   +220

    Well, those 2x phone jacks are to provide voice lines for the homeowner - - that's a DSL modem after all (see attached.)

    We agree the homeowner doesn't have a clue what they're doing.
    No one is changing the wiring.

    Here's my problem:
    Networks flow from one device to another SERIALLY, eg the modem->router.
    A router always has an IP address (while a hub or switch never do). Having an address and given serial traffic
    causes tracert to show each device (or node) in the path to the destination.

    Therefore, tracert showing
    1. 192.168.1.35
    2. 192.168.1.254
    3. 82.169.27.254
    clearly says you have 'a circuit' like modem->router(254)->router(35)->yourSystem.

    The attachment shows the ZyXEL has an address at 192.168.1.1 and this is the issue and
    thus the reason you MUST change the WiFi router address to 10.0.0.1.
    YOU CAN NOT HAVE TWO ROUTERS IN THE SAME SUBNET (eg 192.168.1.x).

    Attached Files:

  23. Marty9231

    Marty9231 TechSpot Enthusiast Topic Starter Posts: 197

    If you're saying that 192.168.1.35 is a router, then it's probably the printer interfering, since I'm sure the printer has .35 as address. To be sure the tracert doesn't show old values, I'll tracert again later tonight and post the results.

    Changing the IP address of the router will have to wait until sunday night because that's when I'll have access to a sufficiently long UDP cable.

    Did you give the upload-related theory a thought?
  24. jobeard

    jobeard TS Ambassador Posts: 13,018   +220

    On a DSL link, uploads will have an impact. It would appear that the ZyXEL is adversely effected (never did like those things).

    Let's not become obsessive on what 192.168.1.35 is or is not - - rather let's focus on getting a network
    layout tha is known to work. After that, I expect it to not matter at all.

    btw: You should be able to remove the WiFi router, take it to your room, fix it and then return it to it's proper place - - just a thought.
    .

  25. Marty9231

    Marty9231 TechSpot Enthusiast Topic Starter Posts: 197

    Alright, agreed. If I'm able to remove, then change, then re-attach the router, things are much easier. I'll try to get to work tomorrow, and update you afterwards.

    Is there anything we can do to further investigate the uploading thing? I did a tracert again and the .35 device was gone entirely, the route now goes Localrouter (.254)->ISP->(Bunch of other IP's)->Google.

    The pingtimes on those hops were like this (approx): 30->600->600->600 ->etc.
    On my second try at tracert, the pingtime on the local router listed this:
    1 182ms 171ms 64ms 192.168.1.254

    It clearly shows a fluctuation in the 3 pingtimes to the local router. What could be causing such a difference?


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.