Need help with flaky performance

I have a new Toshiba L35-S2171 laptop running XP Home. The built-in wireless shows up in Device Manager as an Atheros AR5005G. the driver version is The router is a new Buffalo WHR-HP-G54, with firmware 1.40, using WPA TKIP encryption. The desktop is wired to the router, and that seems to work fine.

The problem I have is with the laptop. I may be following a chat room with no problem, but when I go to open a new instance of IE and go to, say, Google, or Yahoo, I get no repsonse. No response even to a ping. Meanwhile, the chat room traffic continues to come in normally. Then, I may try Google again a few minutes later, and it works. But then after a while it becomes non-responsive again. Meanwhile, chat back and forth continues normally.

Of course this may even be a modem or Cox problem, but since I'm new to wireless and routers and laptops, and since I've never seen this behavior before, I would like to try to rule out some things if I can.

I would appreciate any ideas anyone may have. I would also like to know if changing any of these settings might help firm things up a bit:


Channel select - Auto (maybe change to 11 fixed - nobody else using) Multicast rate - Auto (maybe change to 54) Frame bursting - 125 (125 not supported on client - maybe change to normal or off)

802.11g Protection - On (Off?) Output power - 100% (25, 50, 75) Anything else?


Power saver mode - On (Off? - what does this do?)

From what I can see, the signal strength is quite strong when these problems come up. It's the HP router, and I'm just in the next room, so I don't think that's the problem. Also, there's only one other wireless detected, and it's low signal, and using channel 6. I'm the only one on channel 11.

Could this be some strange NAT problem, where the routing table gets filled up and the router won't let the repsonse back in? Would a router power-cycle fix that?

Reply to
Loading thread data ...

Peabody hath wroth:

Good set of hardware. Thanks for the exact description. I'm not sure if the Atheros driver is the latest but it's worth checking the Toshiblah web pile to be sure.

Is it just Google or does it go flaky with other web sites? If just Google, is it just the home page (no advertising), or is it the search results page (with advertising)? Sometimes the advertising server gets slow, causing the page to paint slowly.

Chat rooms use very little bandwidth, while web pages with graphics tend to be large. However, the Google home and search pages are fairly small.

Try it with a non-wireless, CAT5 ethernet connection to the laptop. Make sure the wireless is disabled or turned off. If that works, it's

*NOT* the modem or router section.

I've had no luck with auto. I suggest picking a clear channel (1, 6, and 11) and not using auto.

Leave at auto. That's for the multimedia wireless stuff, which you generally want to go as fast as possible.

Change to OFF if you're not using it at the client. It will "poll" for the 125Mbit/sec modulation and slow down thruput. Also, if you don't have any 802.11b clients that need to connect, you might try turning off "802.11b compatibility mode". However, these will not cause flaky performance, just a slow down, so I don't think this is the problem.

I have no idea what this actually does. Toss a coin.

100% can't hurt.

Yep. Turn off "intrusion detection" in the firewall for now. I'm suspicious of this feature (but currently have no proof).

Off. It shuts down the wireless client when the client is NOT expected to receive data. The DTIM interval in the access point determines when it should wake up. If the driver is screwy on the client, it may not wake up and you end up losing packets. It also turns off the wireless card if the laptop goes idle. Turn it off.

You won't see access points that are intentionally set to not broadcast their SSID. In order to detect these, you'll need a Linux based (Kismet) passive sniffer. It might be a good idea to try one to insure that you have an empty channel. However, the easiest way is to just try 1, 6, and 11 in succession and see if any one channel works better than the others.

No. Let's not get into probable causes at this point.

You should be power cycling the router during tests anyway to clear out any junk or accidental setting changes.

So much for guesswork. On to getting some numbers and doing some testing.

  1. Ping the router via wireless. Start -> run -> cmd ping -t (IP address of the router). It should be almost the same value for each line with no timeout errors and no erratic latency changes. If you see those, it means packet loss caused by interference, flaky hardware, or propagation issues (unlikely).
  2. Do you have a 2nd wired computer handy? If so, it's time to try IPerf:

Grab the DOS version and copy IPerf to both machines. The one connected via wired CAT5 will be the "server". Run: iperf -s on the server. The Toshiba laptop will play client. First, connect via a CAT5 cable to the WHR-HP-G54 and run: iperf -c (IP address of server) You should get about 80-90Mbits/sec with a wired connection.

Now, unplug the CAT5 from the laptop and try it via wireless. With a

54Mbit/sec connection, you should get between 22 and 25Mbits/sec. If it's much lower, then there's some packet loss happening and we need to isolate it.

That's enough testing for now. There's plenty more options to IPerf available (read the docs) and more testing to isolate the cause depending on the results you get.

Reply to
Jeff Liebermann

It goes flaky on everything, including the Google home page. After a while I get the IE error "Unable to locate server or DNS error" and as I said, I can't even ping Google. Well, it did do the Google DNS lookup on the ping, but gave me three no-responses in a row. Same on You know, that seems awfully strange - that the DNS works, but not the subsequent ping. Does the Buffalo maintain its own DNS table?

Well, I changed the router from Auto channel select to channel 11, and changed the frame bursting setting to "frame bursting", which is different from the default 125. There's no setting re frame bursting in the client, but I guess there is some kind of standard frame bursting that's part of G but not as fast as 125. And I turned off power saving mode in the client. Everything else was already as you suggested. And, I power-cycled the router.

And after that, it seemed to work just fine, and I was doing multiple things on and off for several hours. I'll continue to test it, and will do the iperf test too, but I think if it is good sometimes and flaky sometimes, I need to look at the interference situation. Except:

Well, I don't know. When these problems occurred, if was after I had done a good bit of uTorrent stuff on the desktop computer earlier in the day, but had not power-cycled the router. This time I did power cycle. Well, I'll have to watch for that. If it goes flaky again, I think the first thing is to reboot everything and see what that does.

There's something in the uTorrent FAQ about a table-filling problem with Linksys routers, which keep the entries for five days. I just hadn't seen anything like that concerning Buffalo.

I don't have a Linux machine. You're saying that Windows sniffers don't see non-broadcast APs? There must be some way to see them in Windows. Otherwise, how would a client find its own router if not broadcasting? Won't Netstumbler discover these APs?

Thanks very much for your help on this. I will do the iperf tests and let you know what they say, but I'm hoping the changes made have fixed it.

Reply to

Peabody hath wroth:

Ok, you've got LOTS of packet loss. Ping should show the problem. Fire up the wireless connection and run: start -> run -> cmd ping -t (ip address of router) You should get consistant and stable numbers for latency with no packet loss or huge variations in delays.


Turn OFF both 125, frame burst, and any other speed enhance acronyms.

No. Frame burst is the one that gets the speed up to 108Mbits/sec and the other stuff squeaks it up to 125Mbits/sec. Neigher is very useful except with compatible client hardware and at very short ranges.

Ummmm.... What were you expecting here? That the router runs at 100% efficiency and reliability forever? You're not going to get that with a cheapo product. Plan on doing a reboot when things screw up.

File sharing peer to peer programs are a problem for most cheap routers. They cannot handle the large number of open sockets and buffers that the program tries to open. Usually it's the ARP cache that overflows first, although other buffers will overflow even if the ARP cache survives. The required RAM in the router simply is not there. The best solution is to configure your file sharing program to NOT open so many simultaneous ports and sessions. I'll leave it to you to read the P2P program docs and make the appropriate adjustments.

That usually works for perhaps an hour. Limiting the number of simultaneous P2P sessions will help even more.

Linksys WRT54G and Buffalo use the same Broadcom chipset and probably have quite a bit in common. I suggest you consider alternative firmware such as DD-WRT which handles P2P programs somewhat more gracefully.

You don't need a Linux machine. What you need is a Linux LiveCD or bootable CDROM that runs Linux and Kismet without affecting your Windoze hard disk. See:

In general, they do not. Active probes such as Netstumbler and the typical wireless client software will not show a hidden or blank SSID. Well, the Netgear client that came with my WG511 will show a blank SSID indicating that something is there, but not identify it. In order to do a passive sniff that shows everything, the Windoze driver will need to support the promiscuous or monitor modes. The stock NDIS5.1 drivers do not do this. There are 3rd party drivers that do allow promiscous mode. You should have minimal difficulties finding them with Google. Have your credit card ready. Meanwhile, all Linux wireless drivers do support the promiscuous mode, which is why I suggest using Linux for sniffing.

There's always a way.

If the AP is not broadcasting the SSID or responding to probe requests, then all the user has to do is create a profile for the connection, inscribe the proper SSID, and the connection will proceed normally.


I don't think that IPerf will show much. My guess(tm) is that your P2P habit has hosed the router and that a simple reboot will inspire a miraculous recovery. What had me confused is that you stated that it worked with a wired connection. Try the test anyway as you can tell how well your wireless is working from the results.

Reply to
Jeff Liebermann

Now it works fine. I have a list of things to try next time this happens, if it ever does. I think a little more inciteful troubleshooting will narrow it down.

I just wish it wouldn't do that. I have that turned off in XP because I have a large Hosts file. Oh well.


Hey, this is a *genuine* $45 Buffalo router, not some cheap imitation.

Yes, I just expected those problems would turn up during the uTorrent operation, but they didn't. I cut the number of connections way back when I got the router, but I'll cut some more. I don't try to use the laptop when the desktop is doing file sharing. But I think it may also be good to reset the router after the P2P is done.

I've thought about that a lot, but I see people in the DD-WRT forum having LOTS of problems flashing, as well as disagreement on which versions actually work on the HP. So I'm gonna hold off on that for a while.

Ok, but do I also need a Linux driver for my specific Atheros client? That might be difficult to find.

Yeah, I think that's the most likely explanation.

Reply to

Peabody hath wroth:

Good. I just sorta assume that people do a power cycle (reboot) when something goes insane. It seems obvious but I just noticed that its not in any of the official knowledgebase troubleshooting procedures. Assumption, the mother of all screwups.

Not a problem.

  1. If you have a hosts file, your DNS resolver looks *FIRST* in the hosts file for the IP address. If finds a match, it doesn't look any furthur.
  2. If you want to bypass the routers DNS buffer, just setup Windoze TCP/IP properties to have the DNS servers point to the actual ISP's DNS servers instead of the router.

If you install DD-WRT, you have have it reboot ocassionally to unscramble the buffers.

Another way, that I had to use on my former BEFW11S4v4, was to cycle the AC power using an AC lamp timer. Crude, but effective.

Flashing is not much of a problem if you follow instructions exactly. See:

Yes, but since this particular LiveCD was made for wireless hacking, it should contain most of the current drivers. As I recall, you have a card with an Atheros AR5005G chipset. Atheros is usually very well supported, but I have no easy way to check at this time. In general, if it's supported by Knoppix and MadWiFi, it will work.

Looks like it's supported, but no guarantees (from me).

Reply to
Jeff Liebermann

On Mon, 05 Feb 2007 10:17:25 -0800, Jeff Liebermann wrote in :

By default, but that priority order can be changed. I find that useful because it allows me to use HOSTS as a fallback for critical DNS names when DNS lookup fails.

Yikes! I consider that a near-fatal flaw.

Unfortunately, I've now seen that in stock Buffalo firmware, where DHCP can get screwed up enough not to hand out an address unless the hardware is rebooted. [sigh]

Reply to
John Navas

Yes, but my experience with 98SE was that leaving DNS running in the computer, alongside the huge hosts file, slowed everything down quite a bit, particularly on the first run of IE after boot. It appeared Windows was trying to set up each hosts entry in the local DNS table. Indeed, after just disabling the DNS service, everything speeded up again. I just haven't ever bothered to test this in XP.

Yes, but those addresses change from time to time. I would need a way to get those addresses from the router.

Well, I've been following the DD-WRT forum for some time now, and it's just not clear that that's the case. Moreover, re-flashing the original firmware is also problematical, from what I read. I'm just not comfortable trying it yet, and frankly, would rather avoid it if I can get by on the stock firmware.

Reply to

I've also noticed on my HP that it doesn't handle lease renewal well at all. It appears to knock you off the net and reboot for each renewal. I finally went to assigned IPs on the LAN, and that problem went away. But I would have thought that a normal DHCP lease renewal would occur pretty much in the background.

Reply to

On Mon, 05 Feb 2007 20:12:27 -0600, Peabody wrote in :

It's not that, but it does parse the HOSTS file each time it's accessed, which is a relatively slow process. Best not to have a large HOSTS file.

Reply to
John Navas

Peabody hath wroth:

Testing is easy. Just run: ipconfig /displaydns and see if any of the entries from the hosts file appear in the Windoze DNS cache. You can make it easier to read by first running: ipconfig /flushdns

Oh, lets see what happens. I added the line: junk to my w2k \\winnt\\system32\\drivers\\etc\\hosts file.

C:\\>ipconfig /flushdns

Windows 2000 IP Configuration Successfully flushed the DNS Resolver Cache.

C:\\>ping junk

Pinging junk [] with 32 bytes of data: Request timed out. Request timed out. blah....

c:\\>ipconfig /displaydns

(bunch of assorted localhost lookups...)

junk. ------------------------------------ Record Name . . . . . : junk Record Type . . . . . : 1 Time To Live . . . . : 31534209 Data Length . . . . . : 4 Section . . . . . . . : Answer A (Host) Record . . . : ------------------------------------------------------ Record Name . . . . . : Record Type . . . . . : 12 Time To Live . . . . : 31534209 Data Length . . . . . : 4 Section . . . . . . . : Answer PTR Record . . . . . : junk

Well, you're right. The resolver does try to populate the DNS cache with both the forward and reverse DNS entries from the hosts file. I'm too lazy to find out if it populates the entire list, or just the current lookup. I'll leave that to someone else to test. However, it does suggest that a huge hosts file will create a rather bloated resolver cache.

If they change, they shouldn't be in the hosts file. Hosts is strictly for static IP's. If they change, you need a DNS lookup to get the right IP address. Kinda sounds like some type of scheme to speed up DNS lookups. That's fine but there's a point where the size of the hosts file makes this exercise counter productive.

The only people complaining about flashing problems in the forums are those that are having problems. There are plenty of users that have had no problems and don't need to post complaints in the forums.

Not really. I've only done it once and had no problems. I used the TFTP server method, not the menu driven firmware upgrade, which does tend to be a problem. TFTP always works.

Reply to
Jeff Liebermann

... snip ...

I think it does do the whole thing. I use a large hosts file that I get from, and they recommend turning off the DNS service. But my memory was bad - this was not a problem on 98. It started when I upgraded to XP. Also affects NT2000. Anyway, we may be drifting a bit off topic here, but just to complete the thought, I also use eDexter to keep the blocked hosts URLs out of the Back button queue, and to help prevent delays when the calling app waits for something that's been blocked. I think eDexter just "fails" calls to hosts items. Or something like that.

formatting link

Reply to

I have the Buffalo Router and it is Flashed with DD-WRT. I had no problems what-so-ever flashing it or after flashing it. I will not buy another low end router that DD-WRT does not support.

My two cents worth,

Danny Kile,

Reply to
Danny Kile

Thanks for the info. Is your router the WHR-HP-G54? Which version of DD-WRT did you flash it with?

Reply to

Peabody hath wroth:

Ok, so you're using the hosts file to block sites you do *NOT* want to view. That can also be done in W2K and XP using the security settings or Zonemaps. Control Panel -> Internet Options -> Security -> Restricted Sites -> Sites Just populate the list with sites you do NOT want to see. That's the way most anti-spyware and anti-phishing protection software works. The same site offers instructions:

I have no idea which of these two methods is the more efficient for large block lists.

Also, if you have a large number of machines to deal with and keep the block lists updated, you might find it expedient to setup a proxy server with a single large block list. There are also online web proxy services (i.e. safe surfing services) that will do it for you, but I don't think that's what you want or need.

Incidentally, I will confess to have had problems flashing DD-WRT and OpenWRT on various devices when I was getting started. I also managed to "brick" a few routers in the process. The first time I did the recovery exercise, using TFTP, I also had problems. Eventually, I read the instructions carefully and recovered. The only catch I've found with the TFTP method is that the instructions say to "immediately" start the TFTP client upload after powering up the router. This is incorrect. You have to wait about 3 seconds for the router to start its initial boot, or it will fail.

Good luck.

Reply to
Jeff Liebermann

Peabody :

I've got the same HP router, but running DD-WRT v24sp2 VOIP

I've been seeing something similar occasionally over the last couple of days. Sometimes, while doing email in one IE6 window, I cannot get the other window to go to a page, not even google, even though I'm "connected" and can get thru the router to the modem fine. If I repeatedly try to go to the page, it WILL go through. At that point, I forget about the problem and move on. But you reminded me.

In my case I recently enabled QOS and we have up to 8 users (four wireless) and up to two running Skype at times. I figured it was that. Maybe it is, or maybe the mem is maxed. Maybe it's all one. I see that it has little memory to spare now.

MemoryTotal Available13.8 MB / 16.0 MB Free0.5 MB / 13.8 MB Used13.3 MB / 13.8 MB Buffers1.2 MB / 13.3 MB Cached5.7 MB / 13.3 MB Active5.2 MB / 13.3 MB Inactive

Same here. Not about sigal strength.

I think that this will do it for me, but I have not tried yet, new behavior, only a few instances so far. Not a serious problem yet.

Jeff says: "File sharing peer to peer programs are a problem for most cheap routers. They cannot handle the large number of open sockets and buffers that the program tries to open. Usually it's the ARP cache that overflows first, although other buffers will overflow even if the ARP cache survives. The required RAM in the router simply is not there. The best solution is to configure your file sharing program to NOT open so many simultaneous ports and sessions. I'll leave it to you to read the P2P program docs and make the appropriate adjustments. "

Somehow, without understanding, I wonder if this is similar to what is happening to us.

Jeff says: "If you install DD-WRT, you have have it reboot ocassionally to unscramble the buffers. "

This link shows reboot "off". But that's just to show us where the control is right? You are suggesting that we want to turn reboot "On" and set an interval or time, right?

If this is about RAM or ARP caches, buffers, then, again, without understanding, might turning QOS back off help? Also, perhaps for no good reason, I have the "VOIP" version installed. Probably going to standard or mini would free up RAM?

I know, I should be on the DD-WRT forum with many of these questions....just say so....


Reply to

Redirecting these site names to is inefficient, because every lookup results in an http timeout as it tries to contact the http server o your local machine.

It's better to redirect it to some fast http server where, presumably, the page won't be found. My favorite example used to be which was full of and double-click references that I found by watching the status bar, or I could check my router logs.

I would get little portions of the "sorry, page not found" page where various advertising icons should appear. If I changed my redirect to, the page took noticeably longer to come up, with stock 404 pages painted in the little advertising spots.

But NYTimes is too clever for that now. They have the servers redirected internally, so they can't be filtered so easily.

Reply to

My router is the Buffalo WHR-G54S which uses the same software as your WHR-HP-G54, which can be found at this location.

formatting link
or if you prefer here as well

formatting link
and then go into the Standard Folder and then download the dd-wrt.v23_generic.bin version.

As Jeff, pointed out and I quote "You have to wait about 3 seconds for the router to start its initial boot, or it will fail."

I found that if I waited about 4 seconds I was more successful. In any case just play with the time it will go, it went on the third try for me. I would not hesitate to tell anyone to upgrade to the DD-WRT firmware.

It will work, no luck needed,

Danny Kile

Reply to
Danny Kile

I'm running an Apache web server on my local machine.

I get a grinning pink and purple Cheshire cat. :-)

Reply to

That's what eDexter is for. I won't pretend to understand it all, but I think it acts as a kind of pretend proxy server, and intercepts all those calls that match a hosts file entry, and returns immediately with a "fail" result. This prevents the delay, and also prevents the failed call from showing up in the "Back" list. All I can say is in my experience it works quite well, and I don't see any slowdown at all.

Reply to
Peabody Forums website is not affiliated with any of the manufacturers or service providers discussed here. All logos and trade names are the property of their respective owners.