0

I have a fairly basic, local, wireless network. I have an Ubuntu media server/file share, a desktop PC, a laptop, mobiles and a TV. The issue I am facing since I got the server (for 2-3 months now) is that the it gets unreachable 1-2 twice a week. I can't ping them from any of the machines and I can't access the resources (e.g. file share) either.

I've been troubleshooting this for a while and I made sure that the ports are open and the services are running, etc. Also, it usually works for 3-4 days in a row perfectly, so I doubt that it's any "static" configuration (e.g. port 22 is not open for ssh)

I finally figured out a repro and a "fix". The server usually gets unreachable for e.g. the laptop if laptop leaves the network. (e.g. goes to sleep or wifi is off on a mobile) If I login to the server and ping the laptop, then the laptop will start to see the server again.

This, and the fact that some machines see the server and some doesn't at the same time, gave me the idea that it could be ARP related. I tried to print the ARP table on the laptop at a time when the laptop couldn't reach the server and the server wasn't in the table. When I pinged the laptop from the server, the laptop's local ARP cache got updated and the IP of the server appeared and stuff started to work (until the next sleep).

Now, I started looking at the network traffic. I installed WireShark on the laptop and I can see that the laptop is sending ARP requests to the server constantly (probably because of the mapped file shares) but there is no reply. I used tcpdump on the server to see what ARP requests are coming in, and I can see it gets a few requests from the router and from my desktop machine, but none from the laptop. (I disabled the firewall for the sake of the test)

So essentially, the laptop sends ARP requests and doesn't get any response and the server can't see any requests from the laptop.

I mentioned the laptop in these examples, but it works the same way for a mobile or other devices on the network.

Further info:

  • Single LAN domain, no bridge, nothing complex.
  • The router is, unfortunately, a simple one given by the ISP. I didn't do any NAT or any "advanced" stuff. I think the only router setting I changed was longer DHCP lease during the troubleshooting.
  • The server has two network adapters, an ethernet and a wireless, but I only use the wireless. (Router is in a closet due to some limitations, so there is no cable connection for any of the devices.)
  • The router has both 2.4GHz and 5GHz and I use both with few devices, but there is no correlation between who is seeing the server and who is on the same frequency.
  • Server hardware is my old desktop PC that I turned into a server 2-3 months ago. I didn't have any issues before, when it was a PC (Windows 7)

These are fairly uncharted waters for me with the whole networking, I never done anything like this before and at this point I have no clue how I could progress or what should I check or change.

Do you have any idea how to further troubleshoot this or what could be the problem?

Improve this question
1

On Wi-Fi, broadcasts are considered a special case of multicasts, and all multicasts are handled differently from unicasts. This extra complexity is easy to implement wrong, so buggy implementations often break multicast handling. Since ARPs are broadcast, these bugs can break ARP. They can also break multicast-based discovery protocols such as IETF ZeroConf (a.k.a. Apple Bonjour, mDNS) and Microsoft's now-deprecated LLMNR.

The most common bug is mishandling the case when multicasts have to use a different cipher than unicasts. This happens when more than one cipher suite is enabled. For example, many APs foolishly default to using "WPA2 mixed mode", which means that both WPA2 (AES-CCMP) and original WPA (TKIP) are both enabled. Original WPA was only useful for a tiny segment of users back around 2003-2004, and has only been causing problems ever since. So if you have original WPA (TKIP) enabled in any way on the AP (wireless router), disable it. You want to use WPA2-only (AES-CCMP only).

A second problem is mishandling of multicast key rotation (a.k.a. group key rotation). Group key rotation isn't needed with AES-CCMP like it was with TKIP, so if your AP lets you set an automatic group key rotation interval, either disable it or set it as high (long) as you can.

A third issue is multicast data rates. Multicasts are not Ack'd at the 802.11 layer, so they must be transmitted from the AP at data rates that all clients can receive reliably. If your AP lets you set your multicast rate and you've set it too high, some of your clients may not receive multicasts reliably, meaning they won't receive ARP requests reliably. So make sure you haven't set your multicast rate too high.

Improve this answer
6
  • I've seen some APs have an option to convert multicasts into (multiple copies of) unicasts, so that they could be sent at highest possible rate and properly ACKed... And for some reason I thought that all packets from a client – including "broadcast" (ARP etc.) – must go through the AP and are therefore sent as unicast to the AP. Is that not the case? – user1686 Mar 9 '20 at 19:23
  • @user1686 Very few APs have the "convert multicasts to unicasts" feature you speak of. That feature is not part of the standard. So without knowing his AP model, it's pretty safe to assume his multicasts are being sent the traditional way. You are correct that "To DS" multicasts are sent like unicasts. Since his server is on Wi-Fi and his "From DS" multicasts are most likely being sent the traditional way, he could quite likely be seeing any of the usual causes of multicast breakage on Wi-Fi. – Spiff Mar 9 '20 at 19:40
  • Ah right, I missed the part about the server having no Ethernet. – user1686 Mar 9 '20 at 19:44
  • @Spiff Thanks for the help! I have two mixed options+WPA2+WPA2-PSK. Would you use WPA2 or WPA2-PSK? About the second option, I have "WPA Group Rekey Interval", can that be the "Group key rotation interval"? (Sounds similar :) – Robert F. Mar 9 '20 at 20:48
  • 1
    @RobertF. WPA2-PSK, also known as WPA2-Personal, is where you have one password for all users of the network. WPA2-Enterprise is where you have separate usernames and passwords for each user, and usually requires setting up a RADIUS authentication server. It sounds like your router uses plain "WPA2" to mean "WPA2-Enterprise", so you probably want WPA2-PSK unless you like the hassle of setting up user accounts and RADIUS servers. And yes, the "WPA Group Rekey Interval" is the "group key rotation interval". – Spiff Mar 9 '20 at 21:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.