3

My network has lag spikes lasting for a few seconds every 7.5 mins. The spikes also effect any other computer connected connected to my wirless router at the time. My wife has to connect her laptop via a cable to prevent the lag causing problems when she's VPNing into her work.

If I switch my PC off the problem goes away!

I've got an Edimax 7728ln 802.11n wireless card and Speedtouch 585v7 (I'm with Be)

I've Tried...
Updated the drivers from Edimax Ralink website: 2.0.3.0 (it does say 3.0.2.0 in devices properties though)
I've used the driver from the chipset manufacturer Ralink, the RT2860 driver ver. 3.1.0.0 seems to have improved the situation somewhat.

WLAN Optimizer doesn't seem to be helping

What can I do?

Updates..
I've written a program that logs the times the network slows down so I'm pretty sure it's happening at multiples of 150 seconds with significant (4-6 pings in excess of 1000ms with a least one time-out) incidents every 3rd time.

If the computer is on, my wife's laptop (or my work laptop) will be effected by the same latency. It's really annoying when using RDP to connect to work's terminal server! But it is still annoying!

Wireshark..
I get a load of these SSDP Notify being sent

7031    755.714745  192.168.1.69    239.255.255.250 SSDP    NOTIFY * HTTP/1.1 
7032    755.834765  192.168.1.69    239.255.255.250 SSDP    NOTIFY * HTTP/1.1 
7033    755.856770  192.168.1.69    239.255.255.250 SSDP    NOTIFY * HTTP/1.1 
7034    756.061745  192.168.1.69    239.255.255.250 SSDP    NOTIFY * HTTP/1.1
....

(about 6 or 7 sprinkled between each delayed ECHO (ping) Request/Reply

Wireshark Results...
Awesome, with wireshark I could pretty much eliminate all network traffic other than ICMP stuff and these annoying SSDP messages, wich I'm pretty positive are causing the problems.

I've updated the driver on my WLAN card, to what looks like a newer driver directly from the chipset manufactuer RALink and that seems to have improved the situation somewhat, the spikes now are only about 200-500ms each no time-outs.

I'm also guessing it maybe the router that is having the problem with these packets, not my PC as they affect any computer connected to the WLAN interface of the router, LAN connected computers aren't affected!

Improve this question
3
  • What's your OS? Have you checked your PC's logs? Are you really confident that your PC is the cause of the problem, and it wasn't just a couple of isolated coincidences?
    – Andy
    Jun 11, 2010 at 15:16
  • Win 7 Ultimate 64bit, the problem only manifests itself when my PC is on. I've updated the question with some further info.
    – Dog Ears
    Jun 11, 2010 at 18:22
  • +1 for the great documentation of the problem and efforts. If all questions were like this...
    – Torben Gundtofte-Bruun
    Aug 20, 2010 at 21:13

3 Answers 3

Reset to default
2

Use Wireshark

Download a copy of Wireshark and start it up monitoring your PC's network card. I recommend not doing any web surfing or anything that will cause more network activity while it's running. Let it run until the network slow down occurs.

Once the network slowdown ends, stop Wireshark from monitoring your network card and go back thru the log of what happened and try to figure out what's causing it.

Sounds to me like some program/service running on your computer is trying to chat/discover things on the network and is being very aggressive about it.

A good tell-tale is to look at what port the flood of packets are trying to connect to. If the port number is not random, this can tip you off as to what's going on or what service it is trying to connect to. Frequently Wireshark will even identify the protocol/service for you.

Feel free to edit your original question and post back part of the Wireshark log.

EDIT: Nice troubleshooting, man.

I did a little Googling and came across two possible answers:

1) https://kb.berkeley.edu/jivekb/entry.jspa?entryID=2455 -- An entry about disabling Windows UPnP services which uses SSDP

2) http://www.windowsnetworking.com/kbase/WindowsTips/WindowsXP/RegistryTips/Network/DisableWindowsMessengerbroadcastsonUDPport1900.html -- An article about Windows Messenger using SSDP. In fact, the IP address listed in the article is the same as yours, so this might be your answer.

Good luck!

Improve this answer
2
  • I think I'm starting to get somewhere... (see update to question, as requested)
    – Dog Ears
    Jun 11, 2010 at 19:34
  • @Dog Ears: I edited my answer. Hope one of those helps.
    – Pretzel
    Jun 11, 2010 at 23:34
3

Boot the system with a livecd and see if the issues persist. If not, then some piece of software, possibly malicious, is saturating your network. If the issues persist with the livecd, then the problem is hardware. Change out NIC, router, PC (test NIC in a different system). If it is software, thoroughly scan your system, and enable a very strict outbound firewall to alert whenever something tries to go out. Or, use wireshark if you're familiar with the tool.

Improve this answer
1
  • +1 Sounds like something for sure. May sound odd but look at printer drivers. Some printers are very chatty and check in with the company server regularly
    – Dave M
    Jun 11, 2010 at 16:11
1

Using a tool like Process Explorer, you can keep an eye on your CPU load and identify what process appears or elevates during the network slowdown.

Improve this answer
4
  • nothing, there is no cpu spikes at all..!
    – Dog Ears
    Jun 11, 2010 at 18:19
  • In that case, I'd use the same app to start taking down processes, maybe several at a time, until the events stopped. Tedious, but you could narrow it down that way. Obviously, your approach would have to be tempered with a little knowledge what processes do what. Black Viper's site come's in handy for that. Process Explorer facilitates Googling process names, too. Good luck.
    – JRobert
    Jun 11, 2010 at 20:57
  • Um... Did you mean Process Monitor?
    – Hello71
    Jun 13, 2010 at 2:58
  • No, I did mean PEx. (I didn't know of PMon - but it sounds like another capable tool.)
    – JRobert
    Jun 13, 2010 at 13:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .