As was foretold, we've added advertisements to the forums! If you have questions, or if you encounter any bugs, please visit this thread: https://forums.penny-arcade.com/discussion/240191/forum-advertisement-faq-and-reports-thread/
Options

High Ping to Router, Only One Box Affected

BoomShakeBoomShake The EngineerColumbia, MDRegistered User regular
edited May 2008 in Help / Advice Forum
Network:
I have a Buffalo WHR-HP-g54 wireless router running the Tomato 1.13 firmware.
On my network I have a wired XP Pro SP2 desktop, a wired FreeNAS box, wireless XP Pro SP2 desktop with Netgear WG311v1 using Windows wireless management (the problem box), wireless Vista Basic laptop, wireless Mac OSX 10.5, wireless Xbox360, and wireless Nintendo Wii.

Issue:
Everything works flawlessly EXCEPT for the wireless XP Pro SP2 desktop. Console gaming is as lag free as possible, the wired stuff is fine, and pinging my router (ping -t 192.168.1.1) from either of the wireless laptops gives a consistant time of <1 or = 1, 2 ms. Pinging the router from the wireless desktop, however, yeilds pings in the hundreds of milliseconds, with a range of 2ms (every once in a while) to 1050ms. Most of the pings are crazy high, but for a minute or two it might show pings of 1-2ms, with every 5-7 jumping to 50 or so, then maybe a timeout, and more fluctuations. Most of the time it's just bouncing round in the atrocious range. The desktop had been working, no configuration changes or new software corresponding with this recent crap-out. Such a terrible connection is causing TF2 to lag, downloads to go painfully slow, etc. It happens whether it's freshly booted up or after being on for a while.I can't figure out what it is.

It should also be noted that the desktop in question is literally right next to the laptop and maybe a yard from the xbox360. All have line of sight to router when the room doom door is open, with the router not even 2 yards from the door. If it were interference or some such thing, it should at least make the laptop and xbox hiccup, which they don't. How likely could it be the wireless card finally crapping out?

What I have Tried:
Interference Check (no microwave, no 2.4GHz phones, only one other network on channel 1 w/ crap signal)
Reboot
Reinstall drivers for WG311v1 card
Exit Firewall
Disable AntiVirus
Systematically go through process list, ending non-critical ones and rerunning the ping
Scanned with A/V
Scanned with Ad-Aware
Checked hardware (antenna connection, card seated properly on mobo, etc.)
Tried the Netgear wireless manager utility instead of windows'

BoomShake on

Posts

  • Options
    SarcastroSarcastro Registered User regular
    edited May 2008
    I find better luck with the Windows wireless management than with third party fanchise software. but you have the same issue either way, yah?

    Are there a handful of wireless networks already up in the area? You may find changing the broadcast channel to something more obscure than the default of '6' (I like 9 and 11) can clear outside broadcast interference.

    Sarcastro on
  • Options
    BoomShakeBoomShake The Engineer Columbia, MDRegistered User regular
    edited May 2008
    I normally use the Windows wireless configuration tool (it's far more polished than the crap the card manufacturers usually put out). When I reinstalled the driver package for the card, I tried using Netgear's utility instead, but the results were the same, so I went back to the Windows one.

    My network is currently operating on channel 1 (2.412GHz). There's only one other network on channel 1 in the area, with a 25% signal quality, four on channel 6 with signal quality between 24 and 29, and three on channel 11 with signal quality between 23 and 38. Logically, channel 1 should be the best, as it is both the least crowded and the weakest maximum outside signal. I had read a while back that the three best were 1,6,11 as they don't overlap at all.

    BoomShake on
  • Options
    DeShadowCDeShadowC Registered User regular
    edited May 2008
    Well if the other wireless devices aren't having issues you can pretty much count out a router issue, or outside interference, based on the situation you described here. Which narrows it down to either a software or hardware issue with the desktop. That being said you can try reinstalling the network card, and running ping tests in safe mode. Most of the time if the issue still occurs, its a hardware issue.

    DeShadowC on
  • Options
    BoomShakeBoomShake The Engineer Columbia, MDRegistered User regular
    edited May 2008
    DeShadowC wrote: »
    Well if the other wireless devices aren't having issues you can pretty much count out a router issue, or outside interference, based on the situation you described here. Which narrows it down to either a software or hardware issue with the desktop. That being said you can try reinstalling the network card, and running ping tests in safe mode. Most of the time if the issue still occurs, its a hardware issue.

    I have reinstalled the drivers, which didn't help. I had forgotten about safemode, so I'll give that a go and see what's up.

    BoomShake on
  • Options
    DeShadowCDeShadowC Registered User regular
    edited May 2008
    If not I'm gonna be honest you're probably looking at an issue with the NIC.

    DeShadowC on
  • Options
    SarcastroSarcastro Registered User regular
    edited May 2008
    It does sound very NIC'y, which could be either hardware or just the software included with that NIC.

    Switching out to another brand may solve the problem, and if not you can just return it to the store for a refund. If two different branded NIC's share the same latency issues then you are looking at OS issues.

    Also, Ad-Aware is not all that awesome for spyware, which may also be affecting traffic. The packets might be getting lost at your routers firewall, be they may still be being broadcast. Maybe doubling up with Windows Defender (just shooting from the hip, its decent and won't conflict) would find something Ad-Aware isn't picking up.

    I haven't used Ad-Aware in ages, but the seething hatred which forms at the name makes me think that it is in fact a type of spyware? I can't remember exactly, but my gut says bad-bad.

    Sarcastro on
  • Options
    BoomShakeBoomShake The Engineer Columbia, MDRegistered User regular
    edited May 2008
    Well, things of interestingness have occurred!
    Booted into safemode with networking. Started running pings. For the most part, <=1ms, with a single ping jump every once in a while to 50ms or so (still not nearly as bad as the hundreds from before). Ran for a while, looking good. This would indicate to me that it's not hardware, but software that's fubaring.

    Back into normal mode. Looking a touch better, but still all over the place. I run another scan with NOD32, Ad-Aware, and TrendMicro's Housecall. The first two were clean, Housecall picked up some negligible thing. I haven't installed much on this system since last reinstall; I basically use it as a gaming platform and for the occasional Win-only program for school, so it shouldn't be hard to track down what's evil. I decided to take a closer look at the processes again. I've always been running on the order of 24-28 processes. I noticed one that I either missed or didn't think much about before: svehost.exe. It must have blended in with the common svchost.exe processes. A quick google showed that this is likely evil, but why wouldn't it be picked up? I kill the process and go look for it in the system32 folder, but it's not there. Online, one place mentioned rootkit-esque concealing. IceSword revealed that there was in fact svehost.exe in system32 and I deleted it through that, along with registry entries for running it, restart.

    Now, there's a bit of a jump every so often, but after 251 sent, 250 recieved, min=0ms, max=94ms, average=5ms, it's looking considerably better. Another 254, no lost packets, avg of 5ms.

    The odd thing I find now is that running with the -t flag again, it stayed at <1 for a while, and now is in a pattern:
    <=1 for 6 packets, the 7th is 49/50ms (once in a while higher, once in a while lower). Over and over and over again. Taskmanager shows no periodic quick cpu or memory jumps. I've turned off realtime antivirus stuff as that sometimes might spike cpu. If it were random, then it could be random interference or other crap. But such regularity would indicate something still going on in the box. I just ran another one that went 49 packets at <1 before going into the cycle, which it's now in.

    BoomShake on
  • Options
    DeShadowCDeShadowC Registered User regular
    edited May 2008
    On a plus note its a software issue. Its possible the virus might have multiple components other then just the one exe. You're sure theres no other background processes? Also did you only remove the exe file or did you also remove the registry keys it adds. Also reading up on that virus, it acts as a keylogger as well. So you might want to change your passwords on a clean box.

    click here for more info

    DeShadowC on
  • Options
    BoomShakeBoomShake The Engineer Columbia, MDRegistered User regular
    edited May 2008
    I had followed a thing where it had me delete entries in the HKLM/Software/Windows/Run and RunServices, and then the exe file. Another site said it may be listed under another name as well, in the TEMP folder, but checking with both explorer and IceSword, it's not there. There is a ShellExt folder, but nothing is in it. I haven't used Kazaa in many many years.

    After a restart, ping times are now back into the hundreds, which is weird :( CPU usage is looking wonky in taskmanager, but nothing is showing as using it. I downloaded Process Explorer, and I noticed that Hardware Interrupts and DPCs periodically jump in CPU usage, DPCs more so. I'm not entirely sure what these things are.

    BoomShake on
  • Options
    DeShadowCDeShadowC Registered User regular
    edited May 2008
    its a self replicating virus so its probably not completely gone. It makes me wish you would of had processguard before the issue began.

    DeShadowC on
  • Options
    SarcastroSarcastro Registered User regular
    edited May 2008
    BoomShake wrote: »
    I noticed that Hardware Interrupts and DPCs periodically jump in CPU usage, DPCs more so. I'm not entirely sure what these things are.

    Hardware Interrupts are when a piece of software (i.e. virus) stops a program in play and commandeers a piece of hardware (i.e.your NIC). Generally not a huge deal, a keyboard or mouse for example, is a type of Hardware Interrupt, because it has the ability to halt the soft ware displaying stuff in order to represent what you are inputting onscreen. In this case, suspicious.

    DPC's or Direct(?) Procedure Calls, are like Hardware interrupts, but instead of Hardware to software, its software to software, so something (ie virus) is taking over a bit of software (i.e. wireless communication management service) to make it do what it thinks needs doing. Again, by itself, no biggie, they happen all the time, but in this case, with no other programs running, suspicious.

    So these are more like symptoms than causes, though the root issue seems to be clarifying itself nicely.

    Sarcastro on
Sign In or Register to comment.