Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I live in a house with various other people who all swear that there is nothing wrong with any of their devices. The problem being is that when wireless is enabled on the router, ping sky-rockets and all-round internet performance drops off the face of the earth. As soon as I disable wireless and only allow my PC access to the internet, it runs perfectly again.

I'm assuming that there will be one device that's causing the issue but I have no way of identifying it as other users are fairly uncooperative. Here's a picture below showing what's happening with the ping with wireless on, then off, then back on again.

Top - WiFi on, Middle - WiFi off, Bottom - WiFi on.

Is there any easy way to identify the issue in a situation like this?

Thanks.

share|improve this question
    
We need some more info: ipconfig output (for both your ethernet and wireless card) would be useful, or at least your gateway config (AKA as the local LAN IP of the router). You can simply cut&paste it, no need for images. –  Sopalajo de Arrierez Apr 7 at 20:15
    
It could be useful, when investigating ARP Poisoning, to know the output of arp -a, at least for the value of your default gateway (probably your router). –  Sopalajo de Arrierez Apr 7 at 20:16
3  
Well... 6 devices at least on your LAN. If what you suspect is ARP Poisoning for WiFi, check if ARP table changes the Physical Address value (at least the value of your router: 192.168.0.1) after 1-2 minutes of switching to WiFi mode. –  Sopalajo de Arrierez Apr 7 at 20:31
1  
From the question it seems your internet performance is degrading. Unless your internal network performance is bad too (ping the router, access its admin console), you should consider the simplest of the problems: someone is doing a big-ass download or is using torrent. –  NothingsImpossible Apr 8 at 12:21
2  
This question doesn't seem to mention ARP poisoning at all. Poisoning could be used completely colloquially here. Not sure why people are so quick to assume you think it's an ARP thing. –  Cruncher Apr 8 at 20:34

9 Answers 9

Can you (temporarily) enable MAC filtering on the Wifi?

With that, you should be able to whitelist one MAC at a time and see which one is the culprit.

For what it's worth, I would suspect someone is running BitTorrent or something similar.

share|improve this answer
    
Thanks for the suggestion, currently watching the wireless to see devices as they connect and pinging upon a change. It almost seems to happen without any reason. –  Declan Greally Apr 7 at 20:30
    
@DeclanGreally Have you considered that your router is underpowered? What make/model is it? What firmware is it running? –  moswald Apr 8 at 23:35
1  
It's probably not going to happen immediately after a device is enabled, but rather after several minutes or an hour or so, when whatever bogus software starts up. –  Daniel R Hicks Apr 9 at 11:17
1  
+1 for suspecting one or more people using BitTorrent. Chances are if they are not that tech-savvy they have no limit on connections and that would definitely add some major load to the router. –  Smalltown2k Apr 9 at 14:29

Even when (some of the) other answers are more practical to find your problem, as long as the original question request something like "How to find and ARP poisoning running?", I am going to give an easy-to-apply in a few steps method to detect ARP Poisoning valid for any Windows version extracted from a generic (non-WiFi), faster and simpler method here.:

If you suspect about ARP Poisoning happening only for WiFi , the usual first method is to check if your ARP table changes the Physical Address value (at least the value of your router, for example: 192.168.0.1) after 1-2 minutes of switching to WiFi mode from cable network mode.

Try these steps:

1.- Switch to non-poisoning scenario: Turn Off WiFi in your router.
2.- Open Shell as Administrator:

cmd

3.- Check ARP Table:

c:\>arp -a
Interface: 192.168.11.108 --- 0x2
Internet Address IP Physical Address    Type
192.168.0.1         00-24-a5-0e-a8-42   dynamical
192.168.0.102       50-e5-49-c5-47-15   dynamical
192.168.0.107       00-17-31-3f-d3-a9   dynamical

4.- Switch to posible-poisoning scenario: Turn ON WiFi in your router.
5.- Clear ARP Cache (Administrator shell required):

arp -d -a

6.- Wait 1-2 minutes (to make sure network traffic has started the poisoning).
7.- Check again ARP Table:

c:\>arp -a
Interface: 192.168.11.108 --- 0x2
Internet Address IP Physical Address    Type
192.168.0.1         00-17-31-3f-d3-a9   dynamical
192.168.0.102       50-e5-49-c5-47-15   dynamical
192.168.0.107       00-17-31-3f-d3-a9   dynamical

Compare with the other one. If the physical address (AKA as MAC) of your router has changed, then you have some ARP Poisoning in the scene.
To know who is sending the poisoning search for duplicates in the rest of the ARP Table (in the above-shown example, 192.168.0.107 is the poisoner). Explanation: the ARP poisoner device tells to all the network (LAN) something like "I am the router now".

share|improve this answer
    
How did you know 107 was the poisoner? From the screenshot above, everything is the same except for the router MAC addr. Thx in advance for explaining to me. –  Classified Apr 8 at 6:47
3  
It looks like the router MAC address in the final table is the same as 107. –  sWW Apr 8 at 8:12
    
@Classified, sWW is right: on the ARP check during WiFi ON, the router has the same MAC Address (Physical Address) as the 192.168.0.107 IP, and that is completely impossible, so an ARP poisoning is making all the computer in the LAN to send their internet traffic to 192.168.0.107, instead to the genuine 192.168.0.1. The process is a bit longer to explain, but you can say that the poisoner is at IP 192.168.0.107. –  Sopalajo de Arrierez Apr 8 at 19:30
    
And, please, @Classified, quote my name (with @) when talking to me, or I will not be reported about your question (remember that I am not the original poster of the question in this thread). –  Sopalajo de Arrierez Apr 8 at 19:31
    
@SopalajodeArrierez and sWW, thanks for the explanation. I'm so blind I dind't see the MAC addr being the same for both. –  Classified Apr 8 at 19:45

One way to fix the issue is to turn off each device sequentially until the problem is gone. As soon as your ping rate drops to an acceptable level, you've found your culprit.

You could also turn on MAC filtering and add each device one by one as an alternative to turning the devices off. This would essentially block them one by one. Again, as soon as the levels drop to normal, you've found the resource hog.

share|improve this answer
    
Thanks for the suggestion, currently watching the wireless to see devices as they connect and pinging upon a change. –  Declan Greally Apr 7 at 20:29

Silly question, but have you ruled out interference? Are there any 2.4 Ghz devices in the area like a cordless phone or microwave?

The problem happens when wireless is on so it could be something causing radio interference. You could move the router to another outlet or another room, for example. One thing that's worked for me in the past is change channels on the router.

You could also upgrade the firmware on the router (if that's possible) to DD-WRT and see if you see any changes. You can also boost the signal strength that way.

I know this isn't as cool as arp poisoning, but it's worth looking into.

share|improve this answer
    
Agreed, @Tensigh. I suggest NirSoft WirelesNetView nirsoft.net/utils/wireless_network_view.html for channels lookup in Windows, or InSSIDer in Android metageek.net/products/inssider –  Sopalajo de Arrierez Apr 8 at 11:03
    
I'm connected through a wired connection at all times. It's when I enable the wireless signal on the router that I notice performance degrading across the entire network. –  Declan Greally Apr 8 at 12:30
    
@DeclanGreally, I see. But if your roommates are connecting wirelessly then one of those devices could have cause the interference. Even though they don't actually connect to the WLAN their iPhones could be scanning for WLANs and trying to connect. Seems odd that it would cause this big of a spike but the wireless router will share bandwidth with other devices included wired connections. –  Tensigh Apr 9 at 6:58

You could check what channels are used by yourself and your neighbors. Personally I use WiFi Analyzer on Android for this.

A WiFi channel has a bandwidth of +/-3 channels. A router configured to use channel 6 will actually affect and disturb channels 3 to 9. In practice this means that only channel 1, 6 and 11 are usable in a crowded area if you don't want to disturb each other. If the routers are configured to use the same channel there will be no disturbances since the WiFi protocol will resolve this and allow the routers to share the available bandwidth without any clashes and retransmissions.

So, if you use channel 6 and your neighbor uses channel 3,4,5,7,8 or 9 you have problems. Your neighbor will disturb your router. Since they use different channels they can not understand each other an thus can not resolve the sharing. The disturbances will result in massive retransmissions which in turn will disturb your neighbors router which in turn will retransmit.... you get the picture? It would be much better if your neighbor switched to channel 6.

Why are there channels 2,3,4,5,7,8,9,10 available if you re not supposed to use them? I don't know really but it may be a historical reason because the overcrowd of todays WiFi was not anticipated and the range of channels were there to available fine tune frequencies to avoid disturbances from microwave ovens and the like.

share|improve this answer

Like BowlesCR, I suspect you have a user who is either a bandwidth hog or has a virus infection of some kind on his device.

No easy way to diagnose unless you have a router with monitoring capabilities other than selectively blacklist/whitelist.

share|improve this answer

The problem is probably down to someone on your network uploading too much traffic as there's much less available capacity upstream (which, as mentioned, is likely to be some BitTorrent client that's been set to run minimized on startup like uTorrent etc). It's possible that it is due something being downloaded but this would probably be more obvious like people watching streamed video.

Another approach is to use something like ettercap which you can use to do controlled poison ARP on your network. This would allow you to sniff on the traffic (using Unified sniffing etc) and find out who is sending too much data. There's reasonable tutorial here. Also if you're having problems with user compliance then Ettercap allows you to selectively disable a machine's connection by poisoning their ARP table so their traffic would not get to the router.

share|improve this answer

Do you have any security settings on your router? IP filtering etc? If possible, try turning them off for a while and ping again. This can sometimes cause poor performance in routers and cause high pings.

share|improve this answer

the new iphone5 for example crashes old wlan networks when active. try disabling 5Ghz in your router and only use 2Ghz.

share|improve this answer
6  
do you have any creditable sources to prove this claim? –  Sickest Apr 8 at 19:48

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.