Is someone stealing my bandwidth?

Question

I have a lot of internet problems (very slow connection, randomly not working). I've tried a tracert:

Tracing route to www.l.google.com [7
over a maximum of 30 hops:

  1     1 ms    <1 ms    <1 ms  alicegate [192.168.1.1] <-- This is my router.

  2     *       71 ms    71 ms  192.168.100.1           <-- This looks strange.

  3    72 ms    70 ms    74 ms  172.17.65.165

and so on...

The second hop looks really strange to me... It looks like a LAN IP but not an internet IP. Could I be right?

My setup is really super-flat:

a single pc using a wifi router to connect to my isp. I thought it was clear from the traceroute, sorry :)

Answer 1

That looks like you are on Virgin Media; All (I think) their modems have an address of 192.168.100.1

Answer 2

Your ISP may be using a private IP range for its DSL provision and then passing it through a NAT gateway. This is most often done on mobile broadband, but some ISPs do it to conserve IP addresses.

More worrying is the * in the second line.

The round-trip time of 71 ms is fine for DSL - if your bandwidth were being maxed out I'd expect that to be in the high hundreds. The * indicates a dropped packet.

I'd get your ISP to do a line check to see if there is a problem with your phone line.

Answer 3

It looks like you might have a separate dsl modem and wifi router. That would explain the extra hop to an local IP. If so, check and make sure that the cable between the two is securely in place. The dropped packet there is not a good sign, and 71ms is kind of high for latency times at that level.

Alternatively, this might be for equipment hosted by your provider. In that case, I'd look for a different provider. I want to see ping times to my provider of <50ms, and I don't want to see dropped packets. I also want to see a public, non-NAT'd internet address available for my connection and my connection only. At very least call their support and see if they can check the line.

Answer 4

Direct connect a single computer to your ISP provided device. You can get WinMTR to monitor pings and packet loss simultaneously. If you are running linux, you can simply grab MTR from your package manager. You'll want to test to your primary DNS server and leave it run for a least an hour. If your latency remains relatively stable and around 100ms or less and your packet loss is under 3%, you are within spec. Run a speed test and verify that you are getting within 80% of your advertised bandwidth. Most ISPs will only guarantee about 80% or so.

If you experience any problems at all with the above tests, then you will need to connect your ISP provided device to the point where the connection comes into the building (also called a NID or a DMARC). If your problems go away, the issue is your IW and you will need to fix it yourself or hire a low voltage tech. If it does not go away, then it is time to call your ISP.