Need help with flaky performance

I have a new Toshiba L35-S2171 laptop running XP Home. The built-in
wireless shows up in Device Manager as an Atheros AR5005G. the
driver version is 4.1.2.146. The router is a new Buffalo
WHR-HP-G54, with firmware 1.40, using WPA TKIP encryption. The
desktop is wired to the router, and that seems to work fine.

The problem I have is with the laptop. I may be following a chat
room with no problem, but when I go to open a new instance of IE and
go to, say, Google, or Yahoo, I get no repsonse. No response even
to a ping. Meanwhile, the chat room traffic continues to come in
normally. Then, I may try Google again a few minutes later, and it
works. But then after a while it becomes non-responsive again.
Meanwhile, chat back and forth continues normally.

Of course this may even be a modem or Cox problem, but since I'm new
to wireless and routers and laptops, and since I've never seen this
behavior before, I would like to try to rule out some things if I
can.

I would appreciate any ideas anyone may have. I would also like to
know if changing any of these settings might help firm things up a
bit:

Router:

Channel select - Auto (maybe change to 11 fixed - nobody else using)
Multicast rate - Auto (maybe change to 54)
Frame bursting - 125 (125 not supported on client - maybe change to
normal or off)
802.11g Protection - On (Off?)
Output power - 100% (25, 50, 75)
Anything else?

Client:

Power saver mode - On (Off? - what does this do?)

From what I can see, the signal strength is quite strong when these
problems come up. It's the HP router, and I'm just in the next
room, so I don't think that's the problem. Also, there's only one
other wireless detected, and it's low signal, and using channel 6.
I'm the only one on channel 11.

Could this be some strange NAT problem, where the routing table gets
filled up and the router won't let the repsonse back in? Would a
router power-cycle fix that?

Peabody <(E-Mail Removed)> hath wroth:

>I have a new Toshiba L35-S2171 laptop running XP Home. The built-in
>wireless shows up in Device Manager as an Atheros AR5005G. the
>driver version is 4.1.2.146. The router is a new Buffalo
>WHR-HP-G54, with firmware 1.40, using WPA TKIP encryption. The
>desktop is wired to the router, and that seems to work fine.

Good set of hardware. Thanks for the exact description. I'm not sure
if the Atheros driver is the latest but it's worth checking the
Toshiblah web pile to be sure.

>The problem I have is with the laptop. I may be following a chat
>room with no problem, but when I go to open a new instance of IE and
>go to, say, Google, or Yahoo, I get no repsonse. No response even
>to a ping. Meanwhile, the chat room traffic continues to come in
>normally. Then, I may try Google again a few minutes later, and it
>works. But then after a while it becomes non-responsive again.
>Meanwhile, chat back and forth continues normally.

Is it just Google or does it go flaky with other web sites?
If just Google, is it just the home page (no advertising), or is it
the search results page (with advertising)? Sometimes the advertising
server gets slow, causing the page to paint slowly.

Chat rooms use very little bandwidth, while web pages with graphics
tend to be large. However, the Google home and search pages are
fairly small.

>Of course this may even be a modem or Cox problem, but since I'm new
>to wireless and routers and laptops, and since I've never seen this
>behavior before, I would like to try to rule out some things if I
>can.

Try it with a non-wireless, CAT5 ethernet connection to the laptop.
Make sure the wireless is disabled or turned off. If that works, it's
*NOT* the modem or router section.

>Channel select - Auto (maybe change to 11 fixed - nobody else using)

I've had no luck with auto. I suggest picking a clear channel (1, 6,
and 11) and not using auto.

>Multicast rate - Auto (maybe change to 54)

Leave at auto. That's for the multimedia wireless stuff, which you
generally want to go as fast as possible.

>Frame bursting - 125 (125 not supported on client - maybe change to
>normal or off)

Change to OFF if you're not using it at the client. It will "poll"
for the 125Mbit/sec modulation and slow down thruput. Also, if you
don't have any 802.11b clients that need to connect, you might try
turning off "802.11b compatibility mode". However, these will not
cause flaky performance, just a slow down, so I don't think this is
the problem.

>802.11g Protection - On (Off?)

I have no idea what this actually does. Toss a coin.

>Output power - 100% (25, 50, 75)

100% can't hurt.

>Anything else?

Yep. Turn off "intrusion detection" in the firewall for now. I'm
suspicious of this feature (but currently have no proof).

>Power saver mode - On (Off? - what does this do?)

Off. It shuts down the wireless client when the client is NOT
expected to receive data. The DTIM interval in the access point
determines when it should wake up. If the driver is screwy on the
client, it may not wake up and you end up losing packets. It also
turns off the wireless card if the laptop goes idle. Turn it off.

>From what I can see, the signal strength is quite strong when these
>problems come up. It's the HP router, and I'm just in the next
>room, so I don't think that's the problem. Also, there's only one
>other wireless detected, and it's low signal, and using channel 6.
>I'm the only one on channel 11.

You won't see access points that are intentionally set to not
broadcast their SSID. In order to detect these, you'll need a Linux
based (Kismet) passive sniffer. It might be a good idea to try one to
insure that you have an empty channel. However, the easiest way is to
just try 1, 6, and 11 in succession and see if any one channel works
better than the others.

>Could this be some strange NAT problem, where the routing table gets
>filled up and the router won't let the repsonse back in?

No. Let's not get into probable causes at this point.

>Would a
>router power-cycle fix that?

You should be power cycling the router during tests anyway to clear
out any junk or accidental setting changes.

So much for guesswork. On to getting some numbers and doing some
testing.

1. Ping the router via wireless.
Start -> run -> cmd <enter>
ping -t 192.168.11.1 (IP address of the router).
It should be almost the same value for each line with no timeout
errors and no erratic latency changes. If you see those, it means
packet loss caused by interference, flaky hardware, or propagation
issues (unlikely).

2. Do you have a 2nd wired computer handy? If so, it's time to try
IPerf:
<http://dast.nlanr.net/Projects/Iperf/>
Grab the DOS version and copy IPerf to both machines. The one
connected via wired CAT5 will be the "server". Run:
iperf -s
on the server. The Toshiba laptop will play client. First, connect
via a CAT5 cable to the WHR-HP-G54 and run:
iperf -c 192.168.11.xxx (IP address of server)
You should get about 80-90Mbits/sec with a wired connection.

Now, unplug the CAT5 from the laptop and try it via wireless. With a
54Mbit/sec connection, you should get between 22 and 25Mbits/sec. If
it's much lower, then there's some packet loss happening and we need
to isolate it.

That's enough testing for now. There's plenty more options to IPerf
available (read the docs) and more testing to isolate the cause
depending on the results you get.

--
Jeff Liebermann (E-Mail Removed)
150 Felker St #D http://www.LearnByDestroying.com
Santa Cruz CA 95060 http://802.11junk.com
Skype: JeffLiebermann AE6KS 831-336-2558

Jeff Liebermann says...

>> The problem I have is with the laptop. I may be
>> following a chat room with no problem, but when I go to
>> open a new instance of IE and go to, say, Google, or
>> Yahoo, I get no repsonse. No response even to a ping.
>> Meanwhile, the chat room traffic continues to come in
>> normally. Then, I may try Google again a few minutes
>> later, and it works. But then after a while it becomes
>> non-responsive again. Meanwhile, chat back and forth
>> continues normally.

> Is it just Google or does it go flaky with other web
> sites? If just Google, is it just the home page (no
> advertising), or is it the search results page (with
> advertising)? Sometimes the advertising server gets
> slow, causing the page to paint slowly.

It goes flaky on everything, including the Google home page.
After a while I get the IE error "Unable to locate server or
DNS error" and as I said, I can't even ping Google. Well,
it did do the Google DNS lookup on the ping, but gave me
three no-responses in a row. Same on Yahoo.com. You know,
that seems awfully strange - that the DNS works, but not
the subsequent ping. Does the Buffalo maintain its own DNS
table?

Well, I changed the router from Auto channel select to
channel 11, and changed the frame bursting setting to "frame
bursting", which is different from the default 125. There's
no setting re frame bursting in the client, but I guess
there is some kind of standard frame bursting that's part of
G but not as fast as 125. And I turned off power saving
mode in the client. Everything else was already as you
suggested. And, I power-cycled the router.

And after that, it seemed to work just fine, and I was
doing multiple things on and off for several hours. I'll
continue to test it, and will do the iperf test too, but I
think if it is good sometimes and flaky sometimes, I need to
look at the interference situation. Except:

>> Could this be some strange NAT problem, where the
>> routing table gets filled up and the router won't let
>> the repsonse back in?

> No. Let's not get into probable causes at this point.

Well, I don't know. When these problems occurred, if was
after I had done a good bit of uTorrent stuff on the desktop
computer earlier in the day, but had not power-cycled the
router. This time I did power cycle. Well, I'll have to
watch for that. If it goes flaky again, I think the first
thing is to reboot everything and see what that does.

There's something in the uTorrent FAQ about a table-filling
problem with Linksys routers, which keep the entries for
five days. I just hadn't seen anything like that concerning
Buffalo.

> You won't see access points that are intentionally set
> to not broadcast their SSID. In order to detect these,
> you'll need a Linux based (Kismet) passive sniffer. It
> might be a good idea to try one to insure that you have
> an empty channel.

I don't have a Linux machine. You're saying that Windows
sniffers don't see non-broadcast APs? There must be some
way to see them in Windows. Otherwise, how would a client
find its own router if not broadcasting? Won't Netstumbler
discover these APs?

Thanks very much for your help on this. I will do the iperf
tests and let you know what they say, but I'm hoping the
changes made have fixed it.

Peabody <(E-Mail Removed)> hath wroth:

>It goes flaky on everything, including the Google home page.
>After a while I get the IE error "Unable to locate server or
>DNS error" and as I said, I can't even ping Google. Well,
>it did do the Google DNS lookup on the ping, but gave me
>three no-responses in a row. Same on Yahoo.com. You know,
>that seems awfully strange - that the DNS works, but not
>the subsequent ping.

Ok, you've got LOTS of packet loss. Ping should show the problem.
Fire up the wireless connection and run:
start -> run -> cmd <enter>
ping -t 192.168.11.1 (ip address of router)
You should get consistant and stable numbers for latency with no
packet loss or huge variations in delays.

>Does the Buffalo maintain its own DNS
>table?

Yes.

>Well, I changed the router from Auto channel select to
>channel 11, and changed the frame bursting setting to "frame
>bursting", which is different from the default 125.

Turn OFF both 125, frame burst, and any other speed enhance acronyms.

>There's
>no setting re frame bursting in the client, but I guess
>there is some kind of standard frame bursting that's part of
>G but not as fast as 125.

No. Frame burst is the one that gets the speed up to 108Mbits/sec and
the other stuff squeaks it up to 125Mbits/sec. Neigher is very useful
except with compatible client hardware and at very short ranges.

>And I turned off power saving
>mode in the client. Everything else was already as you
>suggested. And, I power-cycled the router.

Ummmm.... What were you expecting here? That the router runs at 100%
efficiency and reliability forever? You're not going to get that with
a cheapo product. Plan on doing a reboot when things screw up.

>Well, I don't know. When these problems occurred, if was
>after I had done a good bit of uTorrent stuff on the desktop
>computer earlier in the day, but had not power-cycled the
>router.

File sharing peer to peer programs are a problem for most cheap
routers. They cannot handle the large number of open sockets and
buffers that the program tries to open. Usually it's the ARP cache
that overflows first, although other buffers will overflow even if the
ARP cache survives. The required RAM in the router simply is not
there. The best solution is to configure your file sharing program to
NOT open so many simultaneous ports and sessions. I'll leave it to
you to read the P2P program docs and make the appropriate adjustments.

>This time I did power cycle. Well, I'll have to
>watch for that. If it goes flaky again, I think the first
>thing is to reboot everything and see what that does.

That usually works for perhaps an hour. Limiting the number of
simultaneous P2P sessions will help even more.

>There's something in the uTorrent FAQ about a table-filling
>problem with Linksys routers, which keep the entries for
>five days. I just hadn't seen anything like that concerning
>Buffalo.

Linksys WRT54G and Buffalo use the same Broadcom chipset and probably
have quite a bit in common. I suggest you consider alternative
firmware such as DD-WRT which handles P2P programs somewhat more
gracefully.

>I don't have a Linux machine.

You don't need a Linux machine. What you need is a Linux LiveCD or
bootable CDROM that runs Linux and Kismet without affecting your
Windoze hard disk. See:
<http://www.remote-exploit.org/backtrack.html>

>You're saying that Windows
>sniffers don't see non-broadcast APs?

In general, they do not. Active probes such as Netstumbler and the
typical wireless client software will not show a hidden or blank SSID.
Well, the Netgear client that came with my WG511 will show a blank
SSID indicating that something is there, but not identify it. In
order to do a passive sniff that shows everything, the Windoze driver
will need to support the promiscuous or monitor modes. The stock
NDIS5.1 drivers do not do this. There are 3rd party drivers that do
allow promiscous mode. You should have minimal difficulties finding
them with Google. Have your credit card ready. Meanwhile, all Linux
wireless drivers do support the promiscuous mode, which is why I
suggest using Linux for sniffing.

>There must be some
>way to see them in Windows.

There's always a way.

>Otherwise, how would a client
>find its own router if not broadcasting?

If the AP is not broadcasting the SSID or responding to probe
requests, then all the user has to do is create a profile for the
connection, inscribe the proper SSID, and the connection will proceed
normally.

>Won't Netstumbler discover these APs?

No.

>Thanks very much for your help on this. I will do the iperf
>tests and let you know what they say, but I'm hoping the
>changes made have fixed it.

I don't think that IPerf will show much. My guess(tm) is that your
P2P habit has hosed the router and that a simple reboot will inspire a
miraculous recovery. What had me confused is that you stated that it
worked with a wired connection. Try the test anyway as you can tell
how well your wireless is working from the results.

--
Jeff Liebermann (E-Mail Removed)
150 Felker St #D http://www.LearnByDestroying.com
Santa Cruz CA 95060 http://802.11junk.com
Skype: JeffLiebermann AE6KS 831-336-2558

Jeff Liebermann says...

> Ok, you've got LOTS of packet loss. Ping should show
> the problem. Fire up the wireless connection and run:
> start -> run -> cmd <enter>
> ping -t 192.168.11.1 (ip address of router)

> You should get consistant and stable numbers for latency
> with no packet loss or huge variations in delays.

Now it works fine. I have a list of things to try next time
this happens, if it ever does. I think a little more
inciteful troubleshooting will narrow it down.

>> Does the Buffalo maintain its own DNS table?

> Yes.

I just wish it wouldn't do that. I have that turned off in
XP because I have a large Hosts file. Oh well.

>> Well, I changed the router from Auto channel select to
>> channel 11, and changed the frame bursting setting to
>> "frame bursting", which is different from the default
>> 125.

> Turn OFF both 125, frame burst, and any other speed
> enhance acronyms.

Ok.

> Ummmm.... What were you expecting here? That the router
> runs at 100% efficiency and reliability forever? You're
> not going to get that with a cheapo product. Plan on
> doing a reboot when things screw up.

Hey, this is a *genuine* $45 Buffalo router, not some cheap
imitation.

> File sharing peer to peer programs are a problem for
> most cheap routers. They cannot handle the large number
> of open sockets and buffers that the program tries to
> open.

Yes, I just expected those problems would turn up during the
uTorrent operation, but they didn't. I cut the number of
connections way back when I got the router, but I'll cut
some more. I don't try to use the laptop when the desktop
is doing file sharing. But I think it may also be good to
reset the router after the P2P is done.

> Linksys WRT54G and Buffalo use the same Broadcom chipset
> and probably have quite a bit in common. I suggest you
> consider alternative firmware such as DD-WRT which
> handles P2P programs somewhat more gracefully.

I've thought about that a lot, but I see people in the
DD-WRT forum having LOTS of problems flashing, as well as
disagreement on which versions actually work on the HP. So
I'm gonna hold off on that for a while.

> You don't need a Linux machine. What you need is a
> Linux LiveCD or bootable CDROM that runs Linux and
> Kismet without affecting your Windoze hard disk. See:
> <http://www.remote-exploit.org/backtrack.html>

> In order to do a passive sniff that shows everything,
> the Windoze driver will need to support the promiscuous
> or monitor modes. The stock NDIS5.1 drivers do not do
> this. There are 3rd party drivers that do allow
> promiscous mode. You should have minimal difficulties
> finding them with Google. Have your credit card ready.
> Meanwhile, all Linux wireless drivers do support the
> promiscuous mode, which is why I suggest using Linux for
> sniffing.

Ok, but do I also need a Linux driver for my specific
Atheros client? That might be difficult to find.

> I don't think that IPerf will show much. My guess(tm)
> is that your P2P habit has hosed the router and that a
> simple reboot will inspire a miraculous recovery.

Yeah, I think that's the most likely explanation.

> http://www.LearnByDestroying.com

That's how I learned electronics. Commodore stuff came in
handy for this too.

Peabody <(E-Mail Removed)> hath wroth:

>Now it works fine. I have a list of things to try next time
>this happens, if it ever does. I think a little more
>inciteful troubleshooting will narrow it down.

Good. I just sorta assume that people do a power cycle (reboot) when
something goes insane. It seems obvious but I just noticed that its
not in any of the official knowledgebase troubleshooting procedures.
Assumption, the mother of all screwups.

> >> Does the Buffalo maintain its own DNS table?
> > Yes.
>I just wish it wouldn't do that. I have that turned off in
>XP because I have a large Hosts file. Oh well.

Not a problem.
1. If you have a hosts file, your DNS resolver looks *FIRST* in the
hosts file for the IP address. If finds a match, it doesn't look any
furthur.
2. If you want to bypass the routers DNS buffer, just setup Windoze
TCP/IP properties to have the DNS servers point to the actual ISP's
DNS servers instead of the router.

> > Ummmm.... What were you expecting here? That the router
> > runs at 100% efficiency and reliability forever? You're
> > not going to get that with a cheapo product. Plan on
> > doing a reboot when things screw up.
>
>Hey, this is a *genuine* $45 Buffalo router, not some cheap
>imitation.

If you install DD-WRT, you have have it reboot ocassionally to
unscramble the buffers.
<http://www.informatione.gmxhome.de/DDWRT/Standard/V23final/Alive.html>
Another way, that I had to use on my former BEFW11S4v4, was to cycle
the AC power using an AC lamp timer. Crude, but effective.

>I've thought about that a lot, but I see people in the
>DD-WRT forum having LOTS of problems flashing, as well as
>disagreement on which versions actually work on the HP. So
>I'm gonna hold off on that for a while.

Flashing is not much of a problem if you follow instructions exactly.
See:
<http://www.dd-wrt.com/wiki/index.php/Installation#Buffalo_WHR-G54S.2C_WHR-HP-G54.2C_WZR-HP-G54.2C_and_WZR-RS-G54>

>Ok, but do I also need a Linux driver for my specific
>Atheros client? That might be difficult to find.

Yes, but since this particular LiveCD was made for wireless hacking,
it should contain most of the current drivers. As I recall, you have
a card with an Atheros AR5005G chipset. Atheros is usually very well
supported, but I have no easy way to check at this time. In general,
if it's supported by Knoppix and MadWiFi, it will work.
<http://madwifi.org/wiki/MadWifi>
<http://madwifi.org/wiki/Compatibility>
Looks like it's supported, but no guarantees (from me).

--
Jeff Liebermann (E-Mail Removed)
150 Felker St #D http://www.LearnByDestroying.com
Santa Cruz CA 95060 http://802.11junk.com
Skype: JeffLiebermann AE6KS 831-336-2558

On Mon, 05 Feb 2007 10:17:25 -0800, Jeff Liebermann
<(E-Mail Removed)> wrote in
<(E-Mail Removed)>:

>1. If you have a hosts file, your DNS resolver looks *FIRST* in the
>hosts file for the IP address. If finds a match, it doesn't look any
>furthur.

By default, but that priority order can be changed. I find that useful
because it allows me to use HOSTS as a fallback for critical DNS names
when DNS lookup fails.

>If you install DD-WRT, you have have it reboot ocassionally to
>unscramble the buffers.

Yikes! I consider that a near-fatal flaw.

Unfortunately, I've now seen that in stock Buffalo firmware, where DHCP
can get screwed up enough not to hand out an address unless the hardware
is rebooted. [sigh]

--
Best regards, FAQ for Wireless Internet: <http://Wireless.wikia.com>
John Navas FAQ for Wi-Fi: <http://wireless.wikia.com/wiki/Wi-Fi>
Wi-Fi How To: <http://wireless.wikia.com/wiki/Wi-Fi_HowTo>
Fixes to Wi-Fi Problems: <http://wireless.wikia.com/wiki/Wi-Fi_Fixes>

Jeff Liebermann says...

> 1. If you have a hosts file, your DNS resolver looks
> *FIRST* in the hosts file for the IP address. If finds
> a match, it doesn't look any furthur.

Yes, but my experience with 98SE was that leaving DNS
running in the computer, alongside the huge hosts file,
slowed everything down quite a bit, particularly on the
first run of IE after boot. It appeared Windows was trying
to set up each hosts entry in the local DNS table. Indeed,
after just disabling the DNS service, everything speeded up
again. I just haven't ever bothered to test this in XP.

> 2. If you want to bypass the routers DNS buffer, just
> setup Windoze TCP/IP properties to have the DNS servers
> point to the actual ISP's DNS servers instead of the
> router.

Yes, but those addresses change from time to time. I would
need a way to get those addresses from the router.

>> I've thought about that a lot, but I see people in the
>> DD-WRT forum having LOTS of problems flashing, as well
>> as disagreement on which versions actually work on the
>> HP.

> Flashing is not much of a problem if you follow
> instructions exactly.

Well, I've been following the DD-WRT forum for some time
now, and it's just not clear that that's the case.
Moreover, re-flashing the original firmware is also
problematical, from what I read. I'm just not comfortable
trying it yet, and frankly, would rather avoid it if I can
get by on the stock firmware.

John Navas says...

> Unfortunately, I've now seen that in stock Buffalo
> firmware, where DHCP can get screwed up enough not to
> hand out an address unless the hardware is rebooted.
> [sigh]

I've also noticed on my HP that it doesn't handle lease
renewal well at all. It appears to knock you off the net
and reboot for each renewal. I finally went to assigned IPs
on the LAN, and that problem went away. But I would have
thought that a normal DHCP lease renewal would occur pretty
much in the background.

On Mon, 05 Feb 2007 20:12:27 -0600, Peabody
<(E-Mail Removed)> wrote in
<fuRxh.170482$(E-Mail Removed)>:

>Jeff Liebermann says...
>
> > 1. If you have a hosts file, your DNS resolver looks
> > *FIRST* in the hosts file for the IP address. If finds
> > a match, it doesn't look any furthur.
>
>Yes, but my experience with 98SE was that leaving DNS
>running in the computer, alongside the huge hosts file,
>slowed everything down quite a bit, particularly on the
>first run of IE after boot. It appeared Windows was trying
>to set up each hosts entry in the local DNS table. Indeed,
>after just disabling the DNS service, everything speeded up
>again. I just haven't ever bothered to test this in XP.

It's not that, but it does parse the HOSTS file each time it's accessed,
which is a relatively slow process. Best not to have a large HOSTS
file.

--
Best regards, FAQ for Wireless Internet: <http://Wireless.wikia.com>
John Navas FAQ for Wi-Fi: <http://wireless.wikia.com/wiki/Wi-Fi>
Wi-Fi How To: <http://wireless.wikia.com/wiki/Wi-Fi_HowTo>
Fixes to Wi-Fi Problems: <http://wireless.wikia.com/wiki/Wi-Fi_Fixes>