Dropped packets on Zen + Fritzbox BQM

Hi I'm new to VDSL (and this forum) but not new to BQM graphs as I was previously the owner of a severely over-utilised Virgin line. Been on Zen for a month now and seen these dropped packets occasionally but for the last few days they have been much worse.

Ignore the downtime, that is me changing things around and waiting 30 minutes.
Zen BQM 20/01/21

Is this bad news and what could be causing it?

Things I've tried to no avail:
1) resetting the Fritzbox 7530 to factory settings
2) removing the MK3 faceplate and using the supplied dangly filter from the test socket (although I have no phone and no extensions anyway)
3) putting the Fritz into router-only mode and using an Openreach Huawei HG612 with a short cable at the socket (my cabinet is Huawei)

Is the problem between me and the cabinet or further along?

I've only had the line provisioned for a month (always been on VM since I lived here) and there were a few little bits of red all along but now it's much worse.

Any thoughts/advice?
Cheers,
Glenn

Hmmm... OK it's the router part of the Fritzbox 7530. I stuck an old router on and it went away. What I don't understand is why it's so bad for the last week only, and why a factory reset of the Fritzbox didn't clear it either.

Probably not normal, I would guess it has something to do with the line (statistics might help others diagnose though I don't delve into them).

Here's a sample of a friend's Zen line from November (can't post anything recent since Google Wi-Fi doesn't support ICMP).

Zen using FritzBox in router mode

In reply to a post by Glenn2:

I stuck an old router on and it went away. What I don't understand is why it's so bad for the last week only, and why a factory reset of the Fritzbox didn't clear it either.

Perhaps the Fritzbox thought the high volume of ping (ICMP ECHO) from the BQM is an attack, and is throttling responses. You may have to check very detailed firewall logs to see (if that is possible). I don't know the Fritz hardware.

The Fritzbox is known to drop many of the pings, especially if Zen are running their own monitoring and are also pinging the Fritzbox every single second.

The pings on the BQM come from the internet to your router.
To rule out the packet loss being caused by the router dropping ping packets you can try pinging from your connection to the internet.
If there's no packet loss then it's just a quirk of the Fritzbox.

Edited by j0hn83 (Thu 21-Jan-21 12:17:13)

Edit - this is a reply not to the previous post but the one before it.

I wondered about that but it's only been bad for just under a week. And a factory reset didn't change it. Just before midnight (you can see on my linked BQM from yesterday) I stuck an old Zyxel router on and that doesn't show the problem. The Zyxel in modem mode feeding the Fritz does show the problem however. If it is indeed a problem. It's a very peculiar device, the Fritzbox. Feature rich but lacking some controls such as blocking/allowing of ICMP on WAN (which I had to change on the Zyxel for that to work with BQM).

Edited by Glenn2 (Thu 21-Jan-21 12:22:59)

In reply to a post by Glenn2:

The Zyxel in modem mode feeding the Fritz does show the problem however. If it is indeed a problem.

Yes, because the Fritz is still creating the PPP connection, so the IP that the BQM is pinging is on the Fritz. No different to the BQM pinging than using the Fritz itself as the modem.

t's a very peculiar device, the Fritzbox. Feature rich but lacking some controls such a blocking/allowing of ICMP on WAN (which I had to change on the Zyxel for that to work with BQM).

If the Zyxel is in modem mode, it won't make a difference, if you have the PPP logon credentials into the Zyxel, then its doing something different.

The Fritz devices are designed for Germany, and how the German ISPs operate.

I don't understand why router vendors copied Netgear (and US paranoia) in defaulting to not responding to ICMP echo.

I'm on Zen. My Fritzbox is lurking behind a HG612 and I'm not seeing large numbers of dropped packets.

https://www.thinkbroadband.com/broadband/monitoring/...

I do agree that it's a strange box. I have only put it in place a few days ago instead of an old but reliable Billion. As the Billion hasn't had any firmware updates for years I decided it might be a good idea to swap it out.

The Fritzbox modem really doesn't handle my line very well so it was relegated to the back of a cupboard for about a year.

John

I wonder if it's configurable but not exposed on the WebUI (Or hidden somewhere)

Do the ftriz boxes have a CLI based config as well?

I know of at least one router that exposed additional firewall parameters in TR69 that weren't anywhere in the WEB-UI.

Thanks yes I realise the router not the modem is responding to pings but changing modems was to see if it was related to line quality to the cabinet. The cabinet is Huawei (Broadcom) and the HG612 and Zyxel VMG1312-B10A I have are Broadcom, whereas the Fritzbox is Lantiq.

Letting the Zyxel do it all at the moment, today:
Zen Zyxel 21/01/21

Some dropped packets but maybe some is normal. This is very much like I was getting on the Fritz until this week,

In reply to a post by dragon2611:

I wonder if it's configurable but not exposed on the WebUI (Or hidden somewhere)
Do the ftriz boxes have a CLI based config as well?
I know of at least one router that exposed additional firewall parameters in TR69 that weren't anywhere in the WEB-UI.

All good questions, apologies, I'm not a Frizbox expert. I gather the manufacturer (AVM) has good support for their products.

I believe there is no telnet access

The Fritz!Box 7530 supports OpenWRT I see.
The DSL (and VoIP) functions aren't supported, but I could use it with the Zyzel in modem brodge mode (or the HG612) so no problem there/

Are you noticing any other issues, other than the BQM graphs? I'd be inclined to think it's merely the Frtitzbox throttling its response to ICMP packets.

In other words, you're not really loosing packets, it's just the Frtizbox being overly eger to rate limit ping responses.

I used Zen's supplied Fritzbox for a while, but I replaced it. Maybe it's stable, but it's a bit of a toy when it comes to being able to actually configure how it works. I don't have the same model, but on mine, you couldn't even change the internal domain name it used. So every machine on the LAN had to be [hostname].fritz.box.

I replaced it with an EdgeRouter X. Little bit harder to get it configured, but once it's set up, I haven't had to touch it.

Yes I think it's just what the Fritzbox does. It's strange that some days it's small and other days it shows up 40% loss (even overnight when no traffic). Switching the Zyxel out of brdge mode (without even resyncing) so that it is replying to the BQM always cures it.

See this one:
BQM 29-01-2021
The period with no loss is where I switched the Zyxel's router in, then shortly after I switched the Fritz back in again, the loss came back but not as bad.

A couple of days ago I flashed OpenWRT onto the Fritz and obviously the 'problem' has gone. I realise I don't really gain anything as this packet loss on the BQM does not seem to affect my internet experience, but I'd still like a router that allows me to monitor my connection properly, which I now seem to have.

I can always flash back if I find any negatives with OpenWRT.

Edited by Glenn2 (Wed 03-Feb-21 13:40:21)

In reply to a post by Glenn2:

but I'd still like a router that allows me to monitor my connection properly, which I now seem to have.

That was always my thoughts about the Fritz hardware. I want to be in charge, not the router. If there is a configuration option for throttling ICMP on/off that would change my opinion. It seems to be memory of pre-router home internet that being "pingable" was a problem. Seemingly invented by Netgear, and the likes of ZoneAlarm and Steve Gibson raising hysteria. Patch the TCP/IP stack if it has a security vulnerability, otherwise why not reply to ICMP ECHO as normally ??!

Yes - many protocols / service ports could be the subject of a flood or fragment-reassembly bug, and the focus on PING was something came to prominence because of a high profile bug in the network stack of Windows 98 as I recall.

Rate-limiting is ok as long as it is adjustable, and can be source-specific or in response to authentication failures (e.g. like fail2ban).

Unfortunately blanket blocking of ICMP is often embedded in enterprise thinking too, which creates obstacles for troubleshooting as well as rolling out IPv6.

In reply to a post by prlzx:

Rate-limiting is ok as long as it is adjustable, and can be source-specific or in response to authentication failures (e.g. like fail2ban).

Completely agree, and with the enterprise thinking.