how-to block ads
|
biker45
join:2003-10-18
Erie, CO
| reply to dellsweig
Re: Looking for the Common Thread in router problems
For the second day in a row, my router (BEFW11S4 v4 with firmware 1.50) did not hang overnight. Last change I made was to disable logging. However, my router did hang while I was using my PC during the day. So I cannot conclude that disabling logging has solved the router hang problem.
As others have mentioned, the Linksys routers do not have much power nor resources, and they could be getting overwhelmed by traffic (and hang). Or, there could be some kind of bug in Linksys' firmware such that a specific set of events (even under low load) causes the router to hang. The fact that other vendor's routers (including older Linksys models) seem to be more solid (see pooter's recent post about his DLINK box) implies that it is possible to make cheap SOHO routers that do the job (even under load) without hanging multiple times per day.
Dellsweig: I can leave my PCs on overnight to see the effect, but since (during the last two days) my router has not hung overnight, but did hang while my PCs were in use during the day, I'm not sure that leaving my PCs on overnight will shed any additional information on the problem. You mentioned that your setup has been solid. Which version of BEFW11S4 do you have? I have v4. I am just wondering if the router hang problem may (in part) be due to Linksys using more inferior components in their newer models (many people with older BEFW11S4s report that their routers do not experince the hang problem).
George Kidd: regarding your concern about the security of financial transactions on a cable connection which is a shared media where all packets on the LAN can be sniffed ... be sure to enter sensitive data (in your browser) only when you have an SSL (HTTPS) session. That will help to protect your data from easily being observed. | |
dellsweig
Extreme Aerobatics
Premium,MVM
join:2003-12-10
Campbell Hall, NY
 ·Time Warner VOIP
·Vonage
 ·RoadRunner Cable
| Hey
I have both a version 1 and version 4. My Version 1 had been working fine for years, a couple months ago started with the 'hangs'. I figured it was just an old design and bought a V4 back in November. It did the hang thing. I upgraded to 1.50 - same. Information I culled together from Linksys, the network engineers at work and from this group made me try changing some of my settings (MTU, logging, UPnP, lease - you know the drill). The device has been rock solid now for weeks. I did the same drill on my V1 and it works fine too.
I assume my ISP - Road Runner made changes - the obvious one was a speed increase (2.8/366) - basically double the speed. Who knows what other under the cover changes were made by the ISP as well.
It is likely that firmware is a contributing factor - programmers are known to be greedy when it comes to runtime. I would hope future releases will optimize code to perform better with the available hardware (mem, cpu). For now - it 'appears' that turning these new features OFF saves processing resources on an already taxed device.
Other vendors are plagued by the same type issues - without knowing how much memory or CPU speed a vendors device has - well we a shooting in the dark I guess.. Just like our PC's - memory can make or break a system.
I would doubt that components are inferior in the linksys boxes as compared to anything else in the same price class. A component failure would generally not be recoverable (ie: a re-boot might not fix it). What we are seeing is more likely due to internal buffer overflows - running out of memory. Program bugs are alot easier to find by the vendor (and fix).
Have fun
Dan | |
ChrisDAT
Google Keyword Compsysnyc
join:2002-02-26
Hollis, NY
| reply to dellsweig
I just want to mention that HEAT was mentioned in another thread here the other day -- a user opened up his totally dead box that exhibited the "symptoms" mentioned here for some time just before it went kaput, and found a roasted capacitor... [jpalmer]
Most CPU boxes have cooling fans, LinkSys "BEF" series "blue" boxes have no fans (typical of modems) -- they have cooling holes above and below... in my house dust tends to settle on any horizontal surface over time, I dust my hardware often to clear the holes in the top because if they become filled with dust the internal case temp will kill the electronics inside... The bottom holes are of no use at this point since heat rises.
Electronics are extremely heat sensitive -- electrical resistance increases with temperature, most electronics are designed to operate within a temp. range [that should also appear in "specifications"] -- "cheaper" electronics have a smaller range than top-shelf electronics. It's not do-or-die, but when the temperature goes out the high end of the temp range strange things happen... too far out of range and... well, we all know the smell.
Some things are certain... over time, dust settles -- a brand new router will have less restriction to airflow than an older one -- a WIRELESS router, with RF modulators, will generate more heat than one that does not have the wireless stuff...
I was thinking also about how to address this -- mounting the unit vertically may not help because placing the holes to the side may only allow heat to accumulate in the new "top" [get out the drill?] -- place CPU Fans on top? -- run the LS with the cover off? I'll try some of these myself - and maybe present a case-mod LinkSys for y'all.
What does YOUR physical location look like? Is the router sandwiched between alot of other stuff? Is there anything stacked on top of it [like another "Blue" box"]... Put your hand above the unit [about an inch or so], you should feel a LOT of heat, more than you can feel below -- if it is hotter below the unit than above, it's likely that the upper holes are restricted -- I use a soft paint brush [without paint  ] to clear them... Without built-in fans, the unit NEEDS free airflow around it. The LS seems to rely on convection, the hot air must escape the top of the case to draw cooler air in the bottom.
This is not THE answer to the LS "issue," but it is a piece of the puzzle.
"When the only tool you have is a HAMMER, the whole world looks like a NAIL" | |
dellsweig
Extreme Aerobatics
Premium,MVM
join:2003-12-10
Campbell Hall, NY
·Time Warner VOIP
·Vonage
·RoadRunner Cable
2 edits | ChrisDAT
All of my stuff is on a shelf I built in the top of a hall closet. No special ventilation, door is always closed. The router (BEFW11S4 V4) sits with no cooling restrictions, next to 2 Cisco ATA 186 boxes (stacked), next to the cable modem. Power supplies are on a lower shelf near the power strip.
This setup runs 24x7x365.
I just climbed up a chair to check out the location - No dirt or dust on the unit, the case is not warm to the touch nor does the air feel any warmer above the unit..... | |
George Kidd
join:2001-08-09
Vancouver, BC
| reply to dellsweig
Hi folks, ah yes HEAT. I have had a few encounters with this issue as well. A couple of years ago Linksys made a BEFSR41 V2 design that had a chip which ran hot enough to Fry Eggs....The unit kept crashing too, so I cemented a big aluminum heat sink to the chip and left the cover off. The unit never crashed since and has worked well. Recently I purchased another BEFSR41 V3 this time. The V3 unit runs off the same model of wall wart but is hardly warm at all. Guess the chip makers have made some real progress in the past couple of years.
Linksys is still using the same Plastic Box enclosure design that they started with. Frankly I much prefer the Box design that D-Link is using now. Their box can be placed on end, which I always do, so there is good airflow across the circuit board inside. The Box has vent holes in each end so it can be installed flat if necessary and still not get too hot. I found in that case the units run much cooler though if they are placed on end....More grit for the gears to grind..... | |
ChrisDAT
Google Keyword Compsysnyc
join:2002-02-26
Hollis, NY
| reply to dellsweig
I did a little check too: BEFW11S4 above a BEFSR41 -- the BEFSR41 supports the WAN and has two active clients... the "11S4" has no active clients and is only attached to the "41", its wan port is not connected.
Like yours, MY "11S4" was cool as can be ABOVE, below was a different story -- I used a baby thermo in the space between the two boxes ... it maxed out [went off scale high] at >107.6 deg.F.! Beneath the "41" it was warm too, but not as hot, I would assume "room temp" since the baby-t went offscale low [89.6 deg.F.] just like it would do in the open air.
Activity must contribute to heat production, as my "41" is always busy because I have two systems that constantly talk to each other and the WAN 24/7 [ShoutCAST/WinAMP DSP and ShoutCast DNAS]...
Anyone else "see/feel anything?" | |
ChrisDAT
Google Keyword Compsysnyc
join:2002-02-26
Hollis, NY
| reply to dellsweig
Let's all hope the Cisco team can bring something to the table here and not pull a "Microsoft" by buying out a competitor and then droppping the ball. When you buy a Cisco product you expect nothing less than bulletproof software... Now the Cisco name is at stake.
Yep, George, my "41" is a v2... Works great though. It's in free air too. I just stacked the boxes for "research purposes" Maybe different hardware?
Did anyone notice, I got my first STAR!!! | |
George Kidd
join:2001-08-09
Vancouver, BC
| reply to dellsweig
Hey a 1 star General. Actually Linksys made several different V2 models that were all called V2. Some had one kind of problem and others had something different. Several different chipsets were used inside, you had to peek into the box to find out. Would not be a surprise to me if they are still doing this. That spreadsheet just keeps on getting bigger and bigger...... | |
manross
join:2003-09-05
Colorado Springs, CO
| reply to ChrisDAT
ChrisDat,
In regards to the bottom vent holes in conjuction with the design of the case. It's a cheap way to offer cooling without fans. The cooler air below the router will be sucked up throught the router as the warm air rises out of the top vent holes, I think it's called convection currents. It does work somewhat....
Marty | |
George Kidd
join:2001-08-09
Vancouver, BC
| reply to dellsweig
Hey Marty, have a look inside the box. You will find that there is a large circuit board (about the size of the footprint) inside. It completely covers all the holes in the bottom so hardly anything "Convects" to the top holes. Remove the circuit board and the airflow would be great, however......you figure it out..... | |
someoneyoudonotknow
| reply to dellsweig
dellswieg,
Fact:
In a lab envirnonment you can crash any router no matter how well you tune its config. Very simple, use pageant, smartbits, or agilent route injectors and apply and withdraw thousands of BGP or OSPF or even RIP routes per second and in a few minutes you expensive powerful router is toast! You don't even need a traffic load.(Usually not even that long. But boy is it kinda fun!)
Do not forget that even though these routers are small they have fairly respectable specs for the processor speeds, and memory and flash sizes. Do not forget that a Cisco 2600 router has a 50Mhz 486/Pentium class CPU with between 8-16 MB of RAM, and 4 - 32MB of Flash. And that router costs much more. I have pounded on all sorts of routers. And with its processor memory specs the Linksys should eat up the 2600 but it doesnt. For comparison the BEFSX41 has a 162Mhz ARM 9 processor, 16MB of RAM and 4MB of Flash! Linksys has a problem with its firmware developement,optimzation, source code versioning, and physical quality control. All symptoms of the sub $50 prices for a lot of their gear.
That was it for you.
Regarding cable internet architecture.
Cable Internet services piggyback off of traditional cable by being Frequency Division Multiplexed into a higher carrier that is filtered out of traditional devices. Only devices that listen for that carrier can pick it up. The data signal is encoded with 16-64 QAM and can be upwards of 30Mhz of spectral width. Because of the nature of legacy cable for each neighborhood or collection of neighborhoods there is a cable "node". A cable node is a router with a tie in into the neighborhood cable run. That same cable run phsically and electricaly connects to EVERY home that recieves cable, even if they do not subscribe to cable internet service. Thus cable is a hubbed architecture. If the cable were switched every home would not be electircally connected to the other. (This is what ethernet switches do, they segment the physical ethernet collision domain into a collision domain per port instead of per switch.) But the cable companies would have to replicate the analog and/or digital baseband video signal to many different physical segments. Not only would signal quality suffer due to increased load impedance, but costs would skyrocket due to the vastly increased cost of balancing out the impedance load, and building so many different physically seperate cable segments would simply not be pratical. Remember, why does cable get slower as more users use it? Because it is a shared architecture. Switches do not have this penalty.
Do not confuse the cost of little home switches and hubs with the costs of gear that ISP's have to pay. Their gear has to be reliable and the firmware needs to be bulletproof, not to mention that the basic technology of cable service just described, at this time mitigates against using cable "switches".
Cable modems are indeed the bridges between the cable wire and the ethernet wire. But only newer cable modems have the built in MAC-Filtering (L2 Bridging) capabilities. The data is still there on the wire for all to see.
Regarding heat, this certainly could not hurt any devices. Go buy some small aluminum heatsinks and glue them to the switch chip and the CPU chip in the linksys routers. It will help pull the heat out of the silicon mutch better.
James | |
manross
join:2003-09-05
Colorado Springs, CO
3 edits | reply to George Kidd
My mistake...I have a WRT54G and there is a good 1/2" clearance from case to board. Nether-the-less not much venting is needed to create a negative pressure at the bottom of the case. Of course you can do what I did and never worry about heat.......:D
PS... Disregard the zip file. I was trying to post a picture. I'll repost when I figure it out
 | |
biker45
join:2003-10-18
Erie, CO
| reply to dellsweig
When I first encountered the "router hang" problem (October), I read one post on DSLReports that mentioned heat. For optimal signal strength to upstairs room where wireless PC sits, I had to place my BEFW11S4 on top of a 6 foot bookcase.
It gets hot up there on the bookcase near the ceiling. So, after reading the post on heat, I set my router on top of four 35mm film containers. This provides an inch or so of extra clearance under the box, but is certainly not as effective as the fan pictured in manross' post !!!
Up until a few days ago (when I disabled logging), my router was hanging every night (while I was asleep, lights were out, and thermostat set back .... i.e., less heat around the router than during the day). The router rarely crashed during the day. Heat could be the catalyst in the router hang problem, but I'm not sure that's the case (at least for my setup). If it were heat, I would expect to see my problem repeat itself more than once or twice a day.
Here's a new fact for everyone's consideration ...
While on www.pcflank.com running tests against my setup, I found that with older BEFW11S4 v4 firmware versions, the TARGA3 exploit would consistently hang my router. I opened a case with Linksys and they told me that the firmware I was running at the time (1.45.7) was known to be affected by this exploit and suggested that I backlevel to 1.45.3.
I waited til firmware 1.50 came out and again tried the TARGA3 exploit. This time, my router did not hang (although I have read posts by others who state that TARGA3 did hang their router running 1.50).
The TARGA3 exploit is a malformed packet. So, I am wondering if firmware 1.50 could have a weakness, and as a result, when a specific packet (malformed or otherwise) is received it causes the firmware to crash. That could happen under either high or low load.
Prior to turning off logging, I observed that my router was often hit by various probes. I wonder if some script kiddie's probe is causing the "router hang" problem. Unfortunately, the BEFW11S4 buffers its logs, so when it hangs, it takes the most recent log entries down with it. I was never able to correlate anything in the log (as it appeared on my PC's client app) with the router's hang.
Any thoughts? | |
George Kidd
join:2001-08-09
Vancouver, BC
| reply to dellsweig
Ok another issue that I ran into some time ago. A W11S4 V1 that I opened up had all the components on the circuit board inside a Tin Box. If you wanted to add some heat sinks in that case you had to unsolder the Tin Box first. Guess the tin box was a good RFI shield, but in the process it would have been a good Heat Shield as well (trapping the heat inside). Adding a fan in that case would likely have little effect. Can be useful in some of the other designs though..... | |
ChrisDAT
Google Keyword Compsysnyc
join:2002-02-26
Hollis, NY
1 edit |  reply to dellsweig
ManRoss, I like your setup... That's the path I will take too. Is that two fans? How do you power them? I was thinking to make a "splitter" on the power cable to power them -- What is it, 5vDC?... You know, once that masking tape glue dries, you'll NEVER be able to get it off The idea to shroud the other upper holes says you know what you're doing. Even if heat is not the problem, it certainly cannot hurt, and will certainly extend the useful life of the unit -- electronics can never be "too cool."
biker, Do you use the LinkSys logviewer app? I ask because it seems to respond immediately to router activity. I think the router will send the SNMPtrap message as soon as the log "event" occurs. What this would do for you [and anyone whose router chokes overnight] is give you a good indication of exactly WHEN things stopped working because you would see the last communications with the router before the hang. I have a DNS update client, a public SHOUTcast, and a few other services that talk to the internet at fixed intervals, so I can tell when communications stop by looking at the remote log. The resolution works out to about every three minutes or so. You would have to set something like this up if you don't have such an app, and it has to be at TCP app, not a ping or other ICMP or UDP low-level service. The log option only specifies a fixed address [I have not been able to get a broadcast address to work [ends in .255], actually I wouldn't want to do that anyway, so the PC that runs the logviewer app should [must] have a static IP [I shouldn't have to say this, but do not assign static addresses that are within the DHCP range].
Using the LogViewer app. has also alerted me to spyware, adware, hijacks and other parasite [background] activity because they produce outbound log entries when the browser is running (they're sneaky like that) but nothing is really going on.
If you need an app to use to "work" the log you could use a webpage that refreshes frequently. I have some you could use, they are around 1K in size so you won't exceed any quotas by using them. They utilize a META http-refresh tag in the html so you need to have that enabled in your browser. They also change so that your browser shouldn't try to cache them [the HTTPd will send an "expires" header].
»cjw.servehttp.com:11423/cgi-fx/u···2?s=DSLR
[1Kb, 2 min. refresh]
or, if you prefer a non-secular one
»cjw.servehttp.com:11423/ShoutcastStatus.html
[2Kb, 2 min. refresh]
note: my dynamic DNS prov. is having a bad hair day today... so if you get a "could not find..." message, be assured that it is only temporary. There go my stats 4 today  . [I tried to hold the post until it came back... oh well, here they are IP style:
[:) cjw edit: dns is back, yaaaay! ]
...just an example of getting what you pay (or in this case don't pay) for.]
note2: I got a new IP address last night from Verizon sometime between 10:30p and 11:30p EST... the logviewer shows this in the incoming log [for non-forwarded port requests, the destination IP will be the public IP], and the DNS update client also realized it [it checks every hour], and the router didn't hang. | |
dellsweig
Extreme Aerobatics
Premium,MVM
join:2003-12-10
Campbell Hall, NY
·Time Warner VOIP
·Vonage
·RoadRunner Cable
| Chris
You are missing the point here..... The SNMP Trap/logging function (in the firmware) may be a contributer to the problem. By the time the router cries for help - its too late. That is assuming there are traps included in the code which would indicate buffer problems. | |
ChrisDAT
Google Keyword Compsysnyc
join:2002-02-26
Hollis, NY
| reply to dellsweig
Not really, dells... The trap will not indicate the problem directly, but it could show a pattern or stream of incoming worm attacks and the ports they were directed at; it could show a port scan in progress, just before...; it may even be able to send the "killah" request to the logviewer before it locks up.
I am assuming that the log is working properly, I am also "reading" the log -- patterns emerge, the logging will stop while the router is hung, it will also stop at a particular time [the logviewer will not]... You cannot view the router-based log at this time, but your PC will not be hung. That is the reason for sending the log away from the router.
Anyone who uses the log [the incoming log is the most important], should realize that you will get seemingly random "hits" on port 137 (NETBIOS name) 445, and 8080 (the default remote LS admin address), and many other ports all the time -- many of those are worms... If my router fails after a port 8080 request despite having remote admin disabled, I would think that the "feature" [to disable the remote admin] may not work, and the request is handled by the router when it should just ignore it. Moreover, if I found that out, before I tell LinkSys about the issue, I would set a port forward rule to send all 8080 requests to an unused internal ip address [not 127.0.0.1] that is neither in my DHCP range nor my [assigned] static address range. That's a workaround --- people who write these worms know the weaknesses of the firmware, heck, they probably find out by reading these boards.
What's important here is that I work the problem in small steps, one piece of the puzzle at a time... If you change too many things at a time (like flashing a new firmware) you will never discover which one thing fixes your one problem... The fact that many posters get bombed overnight, indicates that maybe there is a worm that is exploiting a specific, common LinkSys weakness. It is not lost on me that when it is nighttime here, it is daytime in the asian pacific world... worms come from infected, or otherwise compromised PCs that will be more active there while we sleep... In electronics, who is the major competitor for the USA? Think about it, you're talking big bucks here.
I'm not implying anything, but I don't take anything for granted either. If this offends anyone, TOUGH. | |
Johkal
Cool Cat
Premium,MVM
join:2002-11-13
Happy Valley
clubs: | Re: Looking for the Common Thread in router proble
And now for something completely different: "THE LARCH"
STOP THAT! Thats completely rediculous!
Eggs - Spam & Eggs But I don't like Spam!
--
Never wrestle a pig. You both get dirty and the pig likes it. | |
biker45
join:2003-10-18
Erie, CO
| reply to dellsweig
Re: Looking for the Common Thread in router problems
Just to summarize: My BEFW11S4 v4 (firmware 1.50) has been hanging once or twice per day (requiring a power cycle). One possible cause discussed in this Topic was that the router did not have enough processing power or resources to handle the load. In order to reduce the load, I recently disabled logging, have also set my DHCP lease renewal value to 32767, and disabled UPnP.
Prior to disabling logging (but after setting DHCP lease time to 32767 and disabling UPnP), my router was still hanging every night (between the time I shut my PCs down for the night and the time I booted the next morning).
After disabling logging, my router did not hang overnight for two nights in a row (router did hang during the day).
However, last night, my router hung.
So, I am beginning to think that the router hang problem may be caused by something other than load (or perhaps there are multiple causes). In my case I have done everything I can (configuration wise) to reduce overhead, with the exception of disabling WEP. If I must disable WEP to make this router stable, then I'm ready to jump ship and try another vendor's box. I know that I can (and do) use MAC filtering, but a dedicated hacker can sniff the MAC address and then spoof it. I also know that WEP is hackable. I really want to use WPA, but that's a issue for a different Topic (Linksys claims that the WUSB11 v2.8 supports WPA, but is does not).
ChrisDAT: I am using WallWatcher for my client logging app. Now that I've seen the case where my router hung overnight (with logging disabled), I think I can remove logging from the list of usual suspects. I'll enable logging and leave my PC on overnight (to try and capture status at the time of the hang). If the hang is a result of load, then I should see the load (in the log) leading up to the crash. However, if the crash is the result of a single event (such as a malformed packet similar to the TARGA3 exploit), then this event may not be in the log. Thanks for the offer to use your web pages that will "work the log".
Also, as dellsweig mentions, the SNMP Trap/logging function may be a contributor to this problem.
I am using the broadcast address (.255) to specify my log client, and WallWatcher (on my PC) is not having any problems receiving the logs from my router. My DHCP range, defined in the router's config, stops at .200 (well below the broadcast address). I have not had the need to go to a static address for the PC running WallWatcher (if so, I'd use an address above .200 but below .255)
In addition to scanning my logs for nasty stuff like spyware, adware, viruses, etc, I also use a combination of Zonealarm, Ad-aware, and Spybot. | |
|
