0

My apartment complex has a shared Wi-Fi network. There are two Cisco Meraki MR62 access points on each building, and my MacBook periodically switches between them; which is annoying because it drops all of my connections to the outside world.

One of the access points is fine; I have a stable, fast connection as long as no one else is streaming video. But there’s an issue with the other access point.

Someone’s private wireless router is constantly sending pings to the shared router. This happens almost 24/7 and my connection is slow when I’m on the same access point, even if there’s no one else on the network. I believe these pings are choking the network, making access to the outside world very slow.

Here’s what I'm seeing from Wireshark; 10.127.144.87 is the private router, 10.128.128.128 is the public router:

enter image description here

If I try and ping the private router, I get the following:

Request timeout for icmp_seq 0
Request timeout for icmp_seq 1
92 bytes from 10.128.128.128: Communication prohibited by filter
Vr HL TOS  Len   ID Flg  off TTL Pro  cks      Src      Dst
4  5  00 5400 2693   0 0000  40  01 6a59 10.155.68.76  10.127.144.87 

Request timeout for icmp_seq 2
92 bytes from 10.128.128.128: Communication prohibited by filter
Vr HL TOS  Len   ID Flg  off TTL Pro  cks      Src      Dst
4  5  00 5400 30e0   0 0000  40  01 600c 10.155.68.76  10.127.144.87 

What could be causing this? Is it indeed responsible for the slow network? Is there some way I can prevent this? I’ve tried ARP spoofing 10.127.144.87 thinking I could use ipfw to drop the pings, but it doesn’t seem to have the desired effect. Here are the rules I’m using:

00300 deny icmp from 10.127.144.87 to any in
00310 deny icmp from 10.127.144.87 to any out
00320 pipe 100 icmp from 10.127.144.87 to any in
00330 pipe 110 icmp from 10.127.144.87 to any out
00340 deny icmp from 10.128.128.128 to 10.127.144.87 in
00350 deny icmp from 10.128.128.128 to 10.127.144.87 out
00360 pipe 120 icmp from 10.128.128.128 to 10.127.144.87 in
00370 pipe 130 icmp from 10.128.128.128 to 10.127.144.87 out

Any insight on this would be greatly appreciated!

0

The reality is if pinging a server—in and of itself—would cause noticeable network degradation then there would be worldwide bans on pinging devices. This blog post explains it clearly:

A ping is 32 bytes in size, and if transmitted over the internet, is only 84 bytes (due to IP Header involved).

Servers/Computers can receive a maximum size of 65535 bytes. You divide this amount by 84 bytes, there needs to be at least 780 ping request from the Internet be for the Servers to be affected.

And yes, pings can be used maliciously—such as with the “ping of death”—but the reality is that pinging, doing a traceroute, doing a port scan, etc… Are all the basic “eyes and ears” of the invisible world of data transmission debugging. Simply using them would not cause any issues.

That said, what could most likely be happening is someone—who like you—is noticing a slow-down on that access point has decided to roll up their sleeves and play amateur network analyst. Meaning they are simply pinging that access point from their access point to attempt to debug.

What is most likely happening is that the network topology itself is borked. Meaning you should talk to your building’s management about the situation and see what is happening.

Short of that, another issue could be your connection speed. I’m going to take a wild guess and say that your MacBook is attempting to connect to the access points via 802.11n. And it could simply be the case where one of the access points is handling your connection better than the other. If you read up on a 802.11n you will see that connection speed and consistency is a fairly common problem.

So from your side the two things I would recommend seeing if you can downgrade your Wi-Fi connection speed to 802.11g or perhaps a specific 802.11n radio frequency of 2.4Ghz exclusively or 5Ghz exclusively. And when you do that just do some tests to see if network speed degrades again or stays consistent.

And looping back to the neighbor’s AP, there might be some odd issue where your neighbor is using their device to attempt to extend the Wi-Fi within their apartment. And for some reason the access point is degrading all other 802.11n connections because of this.

  • Thanks for the great answer! You're probably right about the network topology being borked. It was set up by inspirewifi.com and is "cloud managed". Perhaps the pings aren't responsible for the network slowdown, but I can't help but feel like the 10.127.144.87 router is still the cause of the issues. At the moment it's not on the same access point I am and my connection is great. – MHarrison Dec 8 '14 at 0:46
  • “…I can't help but feel like the 10.127.144.87 router is still the cause of the issues.” Don’t disagree with that. If there is any way for you to diplomatically determine who has that device and talk to them about issues, who knows. Like I said, mabye he’s as pissed off at the odd speed as you are and can share notes that you can then share with management. – JakeGould Dec 8 '14 at 5:56
  • That blog post is complete and utter nonsense. – David Schwartz Apr 13 '17 at 3:38
  • @DavidSchwartz How? And considering this post is 3+ years old, maybe you can post an answer explaining how pings are nothing to worry about? We know your networking knowledge is deep, so perhaps you can share it? – JakeGould Apr 13 '17 at 14:25
  • 1
    @JakeGould How large a packet a server is support tells us absolutely nothing about how much load a packet of a particular size will place on it. I'm not sure it's worth trying to compose an answer to such an old, vague question. But it is worth pointing out when information is incorrect or obsolete lest it mislead anyone. – David Schwartz Apr 13 '17 at 17:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.