Cables failing diagnostics

kmclaurincisco · ‎06-17-2010

I have a cisco rvs4000. I am having some trouble with slow internet, so as part of my troubleshooting, I ran some diagnostics on the cables. For 3 of the 4 ports, pair a and b tested OK, but pair c and d say Short. 4th port shows OK for all 4 pair. Is this test reliable? If it is, could this be cause of slow internet?

Wireshark shows minimal traffic on the network, but ISP says we are using all bandwidth.

Changing cables is problematic just because they are 50 foot plus runs through the walls and ceiling....no jacks.

I'll certainly do it if this is cause of my problem. But somehow I doubt that 3 of the 4 are bad.

Thanks for any ideas!

Steven DiStefano · ‎06-18-2010

I dont know about the cable testing on this device, and maybe someone else can help with that part.

I wanted to ask you if you have IPS enabled? That will reduce throughput drastically.

kmclaurincisco · ‎06-18-2010

Yes, I do have IPS enabled.

I'm glad you mentioned it as I looked at the log for the first time.

I have many possible DOS attacks....below is just a small snip of the total.

I only work for this client every couple of months, so it's hard to say, but I

think there is a correlation between the attacks and slow internet....I'm sure that

is self evident.

1 2010-06-18 17:37:43 Possible DoS HGOD SynKiller Flooding 61.147.107.56
2 2010-06-18 17:13:47 Possible DoS HGOD SynKiller Flooding 218.8.245.123
3 2010-06-18 15:34:58 Possible DoS HGOD SynKiller Flooding 58.53.128.113
4 2010-06-18 15:17:40 DDOS_TYPE_ICMP_FLOOD 122.224.144.203
5 2010-06-18 15:07:58 DDOS_TYPE_ICMP_FLOOD 222.168.142.130
6 2010-06-18 15:06:32 Possible DoS HGOD SynKiller Flooding 218.3.121.249
7 2010-06-18 14:59:57 Possible DoS HGOD SynKiller Flooding 210.83.80.18
8 2010-06-18 14:56:18 DDOS_TYPE_ICMP_FLOOD 211.74.113.172
9 2010-06-18 14:35:01 DDOS_TYPE_ICMP_FLOOD 220.132.178.31

So, how do I stop the DOS attacks? Is this something my ISP needs to look into?

Thanks!

bruce.hobson · ‎06-18-2010

Thier is not much you can do... However, if you would like to try... Then the first step is to find out where these IP Address's are coming from:

Do a whois with the IP Address. If you do not have a whois client you can use http://whois.domaintools.com/ from the printout from that site... Use the email address and send some email... Keep your fingers crossed...

As you can see from the information below this first IP Address is from:

inetnum:        61.147.0.0 - 61.147.255.255
netname:        CHINANET-JS
descr:          CHINANET jiangsu province network
descr:          China Telecom
descr:          A12,Xin-Jie-Kou-Wai Street
descr:          Beijing 100088
country:        CN
admin-c:        CH93-AP
tech-c:         CJ186-AP
mnt-by:         MAINT-CHINANET
mnt-lower:      MAINT-CHINANET-JS
mnt-routes:     maint-chinanet-js

Sorry the email address did not come out when I pasted.

China, so I personally would not hold my breath.

As far as your ISP... It's been my experince, that most if not all ISP have an email address where you can send a copy of your log. However, at most you will receive a form email saying thanks. With no follow-up... ever. Just like it fell off the earth.

I think if I buy another Internet Gateway/Router it will be one without any loging/reporting... Then I will be fat dumb and happy... And never know the difference.

Bruce :-|

Ganesh Hariharan · ‎06-18-2010

I have a cisco rvs4000. I am having some trouble with slow internet, so as part of my troubleshooting, I ran some diagnostics on the cables. For 3 of the 4 ports, pair a and b tested OK, but pair c and d say Short. 4th port shows OK for all 4 pair. Is this test reliable? If it is, could this be cause of slow internet?

Wireshark shows minimal traffic on the network, but ISP says we are using all bandwidth.

Changing cables is problematic just because they are 50 foot plus runs through the walls and ceiling....no jacks.

I'll certainly do it if this is cause of my problem. But somehow I doubt that 3 of the 4 are bad.

Thanks for any ideas!

To test the cable use the test cable-diagnostics and see the usage guide for the same

http://www.cisco.com/en/US/docs/ios/fundamentals/command/reference/cf_t1.html#wp1046637

Hope to Help !!

Ganesh.H

Remember to rate the helpful post

bruce.hobson · ‎06-18-2010

This command is used under IOS not in any RVS-4000's:

test cable-diagnostics

To test the condition of 10-Gigabit Ethernet links or copper cables on 48-port 10/100/1000 BASE-T modules, use the test cable-diagnostics command in privileged EXEC mode.

test cable-diagnostics tdr interface type number

Syntax Description


tdr	Activates the TDR test for copper cables on 48-port 10/100/1000 BASE-T modules.
interface type	Specifies the interface type; see the "Usage Guidelines" section for valid values.
number	Module and port number.

Bruce :-|

bruce.hobson · ‎06-18-2010

Measure the resistance of the cables...

Electrical impedance, or simply impedance, describes a measure of opposition to alternating current (AC). Electrical impedance extends the concept of resistance to AC circuits, describing not only the relative amplitudes of the voltage and current, but also the relative phases. When the circuit is driven with direct current (DC) there is no distinction between impedance and resistance; the latter can be thought of as impedance with zero phase angle.

Using the information at http://standards.ieee.org/getieee802/802.3.html lookup the cable standards for allowed resistance at 50 feet, for different types of cable... cat 5, cat 5e, cat 6, etc... What are your cables...

Bruce :-|