Can LAN traffic "lock up" a cable modem?

In another thread I've discussed with some very helpful people the problems I'm having with intermittent Comcast internet. The reason I'm posting a new question is because Comcast has basically taken their official stance, and now I'm left with some questions how to proceed.

Each morning the internet is down at my client's office. They call me, and I immediately try to access our router (a Linksys with DD-WRT firmware connected to the Comcast/Netgear cable modem/router. When I cannot, I start pinging the modem's gateway address. I get no reply. This will go on until one of two things happen: Either we power reset the modem or I call Comcast support and have them poll the modem using their access portal ("svp?"). Either way, the modem will "wake up" and things will be working again (temporarily). The strange part is that according to Comcast's "historical data" the modem never went offline! And they don't seem to believe me when I tell them I COULD NOT ping the gateway ip prior to calling them. They insist that their constant ping tests show "no or very little packet loss."

Only this morning did a level 2 tech in Denver (I'm in Memphis) really focus on the fact that I am not able to ping the gateway during these outages. He not only believed me, he stated flatly that "no matter what is going on on your LAN side, you *always* should be able to ping the gateway." My thoughts exactly. I thanked him sincerely, and told him that until our conversation I felt like I've been telling people I'd seen UFOs. Nobody would take me seriously.

At any rate, my question is this: Is there *anything* that could be going on LAN-side to cause a cable modem to "lock up" or otherwise cease to work properly, requiring a reset? The reason I ask is that Comcast's official stance - in Memphis, at least - is that while their equipment *might be* freezing up at times, it has nothing to do with them or their equipment. The problem is "something" on our network.

Giving them the benefit of the doubt, I enabled high level logging in the DD-WRT firmware, and I've been monitoring network traffic for 3 days. Things look "normal" to me: incoming port scans, spam-carrying email (we run a Netware/Groupwise server), some imap stuff. Over the weekend only the server is on (the 12 PCs are all turned off), so their is virtually no outbound traffic. I see a couple of things, which indicates a bug or two on the server calling out, but it's very infrequent and very light.

Input appreciated. Sorry for the length. I'm just completely out of ideas, and my client is literally screaming for a solution. Our only other option for service is Bellsouth DSL, which has awful uplink speeds in that area.

thank you,

jm

Reply to
JM
Loading thread data ...

An added note:

This morning while monitoring my network traffic logs, I saw a burst of output from the email server (about 30 entries) to this ip address:

82.167.66.70

which an IP lookup shows assigned to RIPE Network Coordination Center

Has my email server been attacked? Could this be part of my internet problems? Will this "lock up" a cable modem/router?

jm

Reply to
JM

whois -h whois.ripe.net 82.167.66.70 ... % This is the RIPE Whois query server #2. % The objects are in RPSL format. % % Rights restricted by copyright. % See

formatting link
% Note: This output has been filtered. % To receive output for a database update, use the "-B" flag

% Information related to '82.167.64.0 - 82.167.79.255'

inetnum: 82.167.64.0 - 82.167.79.255 netname: ORBITNET descr: ODS.ORBITNET.Perth NOC country: SA admin-c: DMO6-RIPE tech-c: AFH16-RIPE status: ASSIGNED PA mnt-by: ORBITNET-MNT mnt-lower: ORBITNET-MNT mnt-routes: ORBITNET-MNT source: RIPE # Filtered

person: Dr. Mohammed Omar address: Mawarid Electronics Co. Ltd.(OrbitNet) address: P.O. Box 63727 Riyadh 11526 address: Kingdom of Saudi Arabia phone: +966-1-4764034 fax-no: +966-1-4792449 e-mail: snipped-for-privacy@hotmail.com nic-hdl: DMO6-RIPE source: RIPE # Filtered

person: Ayman F. Hamidan address: Mawarid Electronics Co. Ltd.(OrbitNet) address: P.O. Box 63727 Riyadh 11526 address: Kingdom of Saudi Arabia phone: +966-1-4764034 fax-no: +966-1-4792449 e-mail: snipped-for-privacy@orbitsatnet.net mnt-by: ORBITNET-MNT nic-hdl: AFH16-RIPE source: RIPE # Filtered

Reply to
The Kat

A hub/router is designed to handle data on a FIFO(first in, first out) basis. So if you have a program that is backlogged in whatever it is doing, yes your router can seem "locked up". Yes a log can help track that, but you will need to talk to your ISP to figure out some of the traffic. Such as your email routing, some is normal, not every single site can handle everything. Do you have an automatic email event happenning? Such as when a server goes down, 30 emails go out to those that can fix it? Maybe even a series of events that triggered 3 emails

10 times?
Reply to
f/fgeorge

IS listed by t1.dnsbl.net.au: 127.0.0.2 Blocked - see

formatting link
IS listed by zen.spamhaus.org: 127.0.0.4
formatting link

Reply to
clifto

Cabling-Design.com Forums website is not affiliated with any of the manufacturers or service providers discussed here. All logos and trade names are the property of their respective owners.