Frequent Internet Connection Lost

[Mikey37]

I am dealing with a home network which has recently experienced excessive dropped connections. Connection to ISP is via dedicated 2.4 Gb microwave radio card mounted on house roof. The home network uses a Linksys E4200 wireless router. On the home side of the router are typically 3 wired devices and 4 wireless devices.

One of the wired connections is an HP laptop running VPN on Vista, the second wired connection is a desktop computer using normal applications (no VPN) on Windows 7. The third wired connection is an HP network printer.

Of the wireless devices, one is an HP laptop running Vista and no VPN, the others are handhelds accessing the internet.

When the connection is dropped, most devices loose internet. The wired laptop running VPN may continue without losing the VPN connection. I am initially unable to connect to an internet domain using a URL and I am initially unable to ping my ISP’s DNS server IPs. If I release the router’s IP and then renew the routers IP, the internet connections usually return immediately. The ISP support tells me my roof mounted radio card is not losing connection when these instances occur.

I have viewed the Event System log on the wired desktop. There were many log records showing Event ID 1014 and description reads, “Name resolution for the name some-domain.com timed out after none of the configured DNS servers responded”. A quick census of the log file showed great variation in the number of these warnings week to week. I plotted a histogram of these events and found the following.

Frequency
Weeks of ID 1014
01 – 04 51
05 – 08 36
09 – 13 31
14 – 17 3
18 – 22 7
23 – 26 8
27 – 31 3
32 – 35 0
36 – 40 0
41 – 44 0
45 – 49 0
50 – 53 6
54 – 58 16
59 – 62 77

I also started logging network activity using netmon.exe in hopes that I can see some change in activity preceding future occurrences.

Were my actions sufficient thus far?
Should I do something else to gather evidence to determine root cause?
Are there network changes that can be made to reduce these DNS events?

[Mikey37]

I lost formating of histogram data in previous post. The last column of numbers is the frequency of Event ID 1014.

Weeks Freq. of ID 1014
01 – 04 51
05 – 08 36
09 – 13 31
14 – 17 3
18 – 22 7
23 – 26 8
27 – 31 3
32 – 35 0
36 – 40 0
41 – 44 0
45 – 49 0
50 – 53 6
54 – 58 16
59 – 62 77

[RTFMID10T]

can you elaborate a little? is all of the wired connections staying connected and only wireless?

[Mikey37]

Hi RTFMIDIOT,

Short answer, no. The connection which stays connected the longest is that running VPN. The VPN connection would not be making DNS requests, which allows it to remain connected. The VPN connection is wired, but the other wired connection drops its internet connection almost immediately.

[RTFMID10T]

my thinking in test scenario would another computer with a connected vpn stay up? if so i wonder if the network card is going to sleep and trying to save power. one possibility since its both wired and wireless. the computer would still resolve dns if it has to ever cross your isp, just not seen on the vpn itself. wireshark does a great job at packet tracing, but have to watch as the connection drops and should tell you where. ignore any checksum erros if you do use that, not related to your problem and windows often gives those. TCP resets are the biggest bandits in drops, but if the vpn is staying up then i can't see that. i would try to solve why the one with vpn works first to compare to the others.

[RTFMID10T]

also, check third party firewalls and disable for testing purposes.

[Mikey37]

Understand that I have no formal education on networking. With that said, I thought that VPN might not use my ISP's DNS server. It would bypass the ISP, go directly to VPN server, and use its internal DNS server. Is that what you meant by, "one possibility since its both wired and wireless. the computer would still resolve dns if it has to ever cross your isp, just not seen on the vpn itself"?
Regarding your wireshark suggestion, would Wireshark be used when the internet connection had been dropped?

[RTFMID10T]

Let's say if you want to go to google.com you reach a DNS server that knows how to resolve that name to an IP address and it then goes to a router which then the router bounces to the best route or only route it knows to get there. With that being said you connect your location (site A) to another location (site B) and you want site B server to resolve your requests. Well A travels from your location to your ISP to site B, but since your using a VPN your computer does not concern its self with the details as it only cares about the private ip addresses and how it will handle and encrypt that data so the outside world can't see it. Every bit of traffic passes across your ISP network, they just can't see it and you can't see them. VPN connections are usually a persistent connection and stay active from client to host. That's why I think that connection is not dropping Internet. Your site B resolves all your requests and the VPN request is resolved by your ISP to get to site B.

As far as wireshark if you are connected and it drops your connection for any reason you will see who initiated the drop in the connection and why. Generally it will show in red to help you identify the packet and root cause. Hope that helps any

[theramatch1]

Sometime i lost my internet connetion, and i disabled the icon and then enabled it,and get my connection, is there any solution?

[Mikey37]

Thanks Dorae,

I have spoken with the ISP Tech at least twice on this matter. He reviewed the logs and found the connection did not appear affected between the ISP radio card and the radio card on my roof. He stated traffic had been regularly logged throughout the previous five days, and did not show any dropped connection. My computers and wireless router had lost internet access on each of those five days.

The one thing they wanted me to do was to bypass my router by plugging my roof-top radio card directly into a PC for a couple days. He said sometimes local network traffic can overwelm a router at times resulting in lost internet access.

I will give them a call and ask for more troubleshooting options.

Thanks

[RTFMID10T]

If a router ever gets overwhelmed then that has to be the worst router I've ever heard of. I've seen speed degrade from them but not overwhelm and disconnect random connections. It is a good idea to test directly to one computer that has been dropping though and see the results. 80% of the time the media (cable) you use is the problem. You rule out many factors plugging it in and if it doesn't drop move backwards with one computer at a time.