Issue since starting over - 386.1_2

[CaptnDanLKW]

At random, multiple times each day my log shows what appears to be a WAN bounce. Because of the randomness I'm not able to watch and see if the WAN LED goes Red.

I have no speed or latency performance issues, I don't see my work VPN connections reestablished, no streaming is ever interrupted.

Yet I suspect there is a couple second bounce that is transparently accommodated by the services I'm using, so I don't see it - but its happening.

I checked the Cable Modem logs, they are clean.

Anyone have any idea what could be happening or any other place to look?

I only have scribe and conmon addons. It's a clean, simple setup. Static IP from my ISP.


Mar 22 14:29:18 RT-AC86U WAN_Connection: WAN was exceptionally disconnected.
Mar 22 14:29:18 RT-AC86U DualWAN: skip single wan wan_led_control - WANRED off
Mar 22 14:29:23 RT-AC86U WAN_Connection: WAN was restored.
Mar 22 14:29:23 RT-AC86U dnsmasq[1158]: read / etc/hosts - 6 addresses
Mar 22 14:29:23 RT-AC86U dnsmasq[1158]: read / etc/hosts.dnsmasq - 48 addresses
Mar 22 14:29:23 RT-AC86U dnsmasq[1158]: using nameserver 8.8.8.8#53
Mar 22 14:29:23 RT-AC86U dnsmasq[1158]: using nameserver 8.8.4.4#53
Mar 22 14:29:23 RT-AC86U rc_service: wanduck 1054:notify_rc stop_ntpd
Mar 22 14:29:23 RT-AC86U custom_script: Running /jffs/scripts/service-event (args: stop ntpd)
Mar 22 14:29:23 RT-AC86U rc_service: wanduck 1054:notify_rc start_ntpd
Mar 22 14:29:23 RT-AC86U rc_service: waitting "stop_ntpd" via wanduck ...
Mar 22 14:29:23 RT-AC86U ntpd: Stopped ntpd
Mar 22 14:29:24 RT-AC86U custom_script: Running /jffs/scripts/service-event (args: start ntpd)
Mar 22 14:29:24 RT-AC86U ntpd: Started ntpd

 

[OzarkEdge]

Anyone have any idea what could be happening or any other place to look?

Perhaps you could bounce it off your ISP tech support to see if they can see something odd on their end?

OE

 

[CaptnDanLKW]

Only started seeing this after I did a clean M&M.

With all the logging and tools we have at our disposal, there has to be something about WHY it thinks the WAN went down. What method does the router use to determine WAN is up?

What does "WAN was exceptionally disconnected" mean?

I don't THINK it uses the 'Network Monitoring' from the system page, but am I wrong? I thought that just had to do with webUI redirecting, etc... however I just disabled it to see.

 

[dave14305]

You’d have to delve deep into the pit of wanduck to understand the why.

asuswrt-merlin.ng/wanduck.c at f0b75788872a2e05c40a7fd086caf9aedb8cf43b · RMerl/asuswrt-merlin.ng

Third party firmware for Asus routers (newer codebase) - asuswrt-merlin.ng/wanduck.c at f0b75788872a2e05c40a7fd086caf9aedb8cf43b · RMerl/asuswrt-merlin.ng

github.com

Everybody hates wanduck.

 

[EmeraldDeer]

I don't know how to distinguish between an actual ISP problem and a WAN test problem. My understanding is that the default WAN test is a DNS lookup of a Microsoft site. Alternatively you can choose ping instead. My ISP allows traceroutes to show the ISP's hops. I configure the WAN test to be a ping of the first hop IP address. This minimizes the chances of a false alert.

 

[EmeraldDeer]

Only started seeing this after I did a clean M&M.

With all the logging and tools we have at our disposal, there has to be something about WHY it thinks the WAN went down. What method does the router use to determine WAN is up?

What does "WAN was exceptionally disconnected" mean?

I don't THINK it uses the 'Network Monitoring' from the system page, but am I wrong? I thought that just had to do with webUI redirecting, etc... however I just disabled it to see.

I think it does use 'Network Monitoring'.

 

[CaptnDanLKW]

You’d have to delve deep into the pit of wanduck to understand the why.

asuswrt-merlin.ng/wanduck.c at f0b75788872a2e05c40a7fd086caf9aedb8cf43b · RMerl/asuswrt-merlin.ng

Third party firmware for Asus routers (newer codebase) - asuswrt-merlin.ng/wanduck.c at f0b75788872a2e05c40a7fd086caf9aedb8cf43b · RMerl/asuswrt-merlin.ng

github.com

Everybody hates wanduck.

Thanks. I just scanned through it. Seems like the 'exceptionally disconnected' is the catch-all (CASE_OTHERS) for Static IP disconnected scenarios.

 

[CaptnDanLKW]

I think it does use 'Network Monitoring'.

You are correct, sir. After disabling it, the issue has stopped. I'm still not sure if that 5 second span (as the logs show) is an actual disconnect or assumed down/up event which kicks off the subsequent scripts.

Interestingly, we had a 20 minute outage on the CM side when a line tech was working on my distro-box by the street but my CM never rebooted or lost its physical (Layer1) connection, so no WAN down events were logged.

Take the good with the bad I guess.

Though I'm still puzzled why it started with the config re-do, but doing some additional testing I experienced something odd.

an nslookup using the router's DNS resolver (dnsmasq)

DNS request timed out.
timeout was 2 seconds.
Name: dns.msftncsi.com
Address: fd3e:4f5a:5b81::1

Tried many time in a row, all timed out. Then a few minutes later...

> dns.msftncsi.com
Server: RT-AC86U
Address: 192.168.1.1

Non-authoritative answer:
Name: dns.msftncsi.com
Addresses: fd3e:4f5a:5b81::1
131.107.255.255

It seems maybe my upstream ISPs DNS servers are having sporadic issues.

I usually don't believe in coincidences but the assumptions and analysis seem to point that way.

Thanks all.