Frequent internet 'hangs' or becomes unresponsive

[dr.stevil]

The title is pretty self explanatory... Everything will be 100% good to go one minute, and the next, all internet traffic sort of just hangs (Internal network still works fine when this happens btw). When I click a URL, for example, nothing times out and nothing loads... the progress icon just spins forever. It will usually load if I give it enough time along with clicking reload a few times, but not every time.

This has been happening for as long as I can remember on one particular machine on my LAN and I'm not sure why it's happening or how to fix it permanently, but I did managed to figure out a fix by bringing up the command prompt and flushing the DNS cache but I'd like to find a real solution.

Like I said, this happens only on one machine and it's happened across multiple OS installs. I've tried changing the DNS servers to see if it was something related to that, but the problem persists. I'm hoping someone can help

 

[toast0]

This kind of thing could be a lot of different problems, but my personal bet is MTU issues.

I've written a test page you could try to diagnose http://pmtud.enslaves.us/ click the 'test' button, and it'll try some stuff and show a summary table and a log. If the 'notes' column shows OK for both directions, then it's not MTU issues (or it's not MTU issues on IPv4 anyway), and you'll need to find some other issue. But if it doesn't show OK, paste the table and I'll help you fix it.

 

[funkydmunky]

Are you wifi or cable? MB driver update?

 

[dr.stevil]

This kind of thing could be a lot of different problems, but my personal bet is MTU issues.

I've written a test page you could try to diagnose http://pmtud.enslaves.us/ click the 'test' button, and it'll try some stuff and show a summary table and a log. If the 'notes' column shows OK for both directions, then it's not MTU issues (or it's not MTU issues on IPv4 anyway), and you'll need to find some other issue. But if it doesn't show OK, paste the table and I'll help you fix it.

Beautiful! thanks so much for the help. I'll give that a shot later this evening and will post my findings.

Are you wifi or cable? MB driver update?

I'm connected via LAN and IIRC the system is 100% up to date. I actually just did a fresh install of windows 10 within the past month or so.

 

[dr.stevil]

This kind of thing could be a lot of different problems, but my personal bet is MTU issues.

I've written a test page you could try to diagnose http://pmtud.enslaves.us/ click the 'test' button, and it'll try some stuff and show a summary table and a log. If the 'notes' column shows OK for both directions, then it's not MTU issues (or it's not MTU issues on IPv4 anyway), and you'll need to find some other issue. But if it doesn't show OK, paste the table and I'll help you fix it.

So I gave your page a try and it shows OK for both tests. Good to know it’s something I can rule out I guess. Thanks again

If anyone else has any ideas I’m all ears

 

[toast0]

Might be worth swapping your ethernet cable?

Oh, and disable IPv6 on the affected machine to see if it makes a difference?

 

[SamirD]

Since you've been through multiple OSes, I would think the problem is in the network. What does the network diagram between this system and the IOTs look like? That will give me an idea of what to recommend to try.

 

[SamirD]

I've written a test page you could try to diagnose http://pmtud.enslaves.us/ click the 'test' button, and it'll try some stuff and show a summary table and a log. If the 'notes' column shows OK for both directions, then it's not MTU issues (or it's not MTU issues on IPv4 anyway), and you'll need to find some other issue. But if it doesn't show OK, paste the table and I'll help you fix it.

Not OP, but I got a an 'out probe timed out 1401 min 0 max 9000' fyi when testing one of my sites that has multiple wans.

 

[MechWarrior]

I had an issue recently with a dying or overheating access point. I use omada in-wall access points _all_ over the house, and it turned out just one of them was either on the fritz or overheating or something. I swapped it, and all my problems went way. I was able to isolate it because only machines connected to that access point (physically or wirelessly) would stall for 10-30 seconds and my phone on a different AP would still work just fine.

Not saying this is your case, but apply the principals of eliminate as much as you can to narrow down what you need to look at.

 

[toast0]

Not OP, but I got a an 'out probe timed out 1401 min 0 max 9000' fyi when testing one of my sites that has multiple wans.

Yeah, the outbound (client to server) probing is harder to do. If it shows that consistently, that may indicate your client/wan router isn't doing path MTU properly on at least one of the wan links. But if you can't send 1401 byte packets, you'd know because a lot of stuff wouldn't work. Many large internet sites (Google, Facebook, CloudFlare, etc) artifically lower their MSS, but usually by 20-50 bytes, so you (or your customer) would likely have run into issues, if your real mtu is 1400, the clients are using something larger on the lan and the router isn't fixing it for them. In the interest of not taking forever to probe, failures aren't retested, so some flakey thing could report a failure when really it's just my bad hosting or something.

I capture logs when the test finishes, did you run the test a while ago and only post yesterday or did the test not finish; I don't see any tests without timeouts since September 20th? (could be something wrong with my code)

 

[MrGuvernment]

If you are wired, do you go right to a switch / router?

Or do you connect to a jack in the wall?

Change cables
Change port it connects to on end device
run direct to ISP device even
Could be the NIC in the computer... got a space NIC to try?

 

[Zepher]

get one of these to test and to have one on hand for testing purposes.
https://www.amazon.com/Plugable-Ethernet-Adapter-Compatible-Thunderbolt/dp/B084L4JL9K

 

[MrGuvernment]

^^ yup, always handy to have around, just incase!

 

[SamirD]

Yeah, the outbound (client to server) probing is harder to do. If it shows that consistently, that may indicate your client/wan router isn't doing path MTU properly on at least one of the wan links. But if you can't send 1401 byte packets, you'd know because a lot of stuff wouldn't work. Many large internet sites (Google, Facebook, CloudFlare, etc) artifically lower their MSS, but usually by 20-50 bytes, so you (or your customer) would likely have run into issues, if your real mtu is 1400, the clients are using something larger on the lan and the router isn't fixing it for them. In the interest of not taking forever to probe, failures aren't retested, so some flakey thing could report a failure when really it's just my bad hosting or something.

I capture logs when the test finishes, did you run the test a while ago and only post yesterday or did the test not finish; I don't see any tests without timeouts since September 20th? (could be something wrong with my code)

Sorry for the late reply--I posted right after I ran the test. I can try again if you want me to.

 

[toast0]

Sorry for the late reply--I posted right after I ran the test. I can try again if you want me to.

Yeah, that'd be cool. Let me know what it says. I've got tcpdump capturing all the packets right now, and I can look at whatever I get in wireshark this evening.

 

[SamirD]

Yeah, that'd be cool. Let me know what it says. I've got tcpdump capturing all the packets right now, and I can look at whatever I get in wireshark this evening.

Done.

got in probe for mss 536 (max seg 1380)
got in probe for mss 1380 (max seg 1380)
got in probe for mss 1380 (max seg 1380)
finished in probing, maximum mss 1380 peer mss 1380 initial peer mss 1380
out probe timed out 1381 min 0 max 9000

 

[toast0]

Done.

got in probe for mss 536 (max seg 1380)
got in probe for mss 1380 (max seg 1380)
got in probe for mss 1380 (max seg 1380)
finished in probing, maximum mss 1380 peer mss 1380 initial peer mss 1380
out probe timed out 1381 min 0 max 9000

Ok, well I'm stumped. What's supposed to happen is when you click the button, the browser/javascript opens a websocket connection and the server sends some packets down, which works, that's why you get the 'finished in probing', which all looks good. Then the javascript is supposed to send a request to http://pmtud.enslaves.us/size? to see what size packets it's sending, and then add X's to the end to make things bigger. But around the time of your test, I don't see the size requests, and I don't think I even see a connection request.

I'm guessing I messed something up real good in the javascript, and maybe there's an error in the developer console? I'm going to PM you to confirm I'm looking at the right IP.

 

[SamirD]

Ok, well I'm stumped. What's supposed to happen is when you click the button, the browser/javascript opens a websocket connection and the server sends some packets down, which works, that's why you get the 'finished in probing', which all looks good. Then the javascript is supposed to send a request to http://pmtud.enslaves.us/size? to see what size packets it's sending, and then add X's to the end to make things bigger. But around the time of your test, I don't see the size requests, and I don't think I even see a connection request.

I'm guessing I messed something up real good in the javascript, and maybe there's an error in the developer console? I'm going to PM you to confirm I'm looking at the right IP.

It could be just my browser--ff52esr, but usually on simple (and lovely) sites like yours, it works fine.

 

[Dopamin3]

What NIC is this occurring on? Shot in the dark here, but if it's an Intel i225-V (earlier than the B3 stepping) just don't use it.

 

[dr.stevil]

Ok boys, I think I figured out the problem, but I’m still baffled WHY it’s happening in the first place. Hopefully one of you network nerds can identify the issue because my dumb ass doesn’t have a chance. It doesn’t make logical sense to me.

Turns out that it’s not the computer, but Mozilla Firefox, that’s at fault. I had my suspicions in the past but completely disregarded it since it seemed so insane to consider, given this has happened across multiple OS installations on the same box.

So a few observations…

I have Firefox installed on multiple machines on the same network and ONLY this machine has given me problems that I’ve noticed. As a matter of fact, I run some virtual machines on this box, that have FF installed on them, and they don’t give me a problem either.

As I mentioned previously, this has happened across multiple OS installation’s and I DONT use Firefox sync, so it’s not bringing junk over from another install or anything. It’s always a clean and fresh install.

Long story short, I upgraded said machine to windows 11 very recently (clean install) and it was working perfectly until I installed Firefox. The hangs started occurring again and I decided to just try brave instead. Anytime Firefox would just hang and fail to load a page, I would open brave and attempt to load the same URL and it works 100% of the time. I’m glad to have finally figured out a fix for it, but why in the world is this happening and only with Firefox?

 

[SamirD]

Ok boys, I think I figured out the problem, but I’m still baffled WHY it’s happening in the first place. Hopefully one of you network nerds can identify the issue because my dumb ass doesn’t have a chance. It doesn’t make logical sense to me.

Turns out that it’s not the computer, but Mozilla Firefox, that’s at fault. I had my suspicions in the past but completely disregarded it since it seemed so insane to consider, given this has happened across multiple OS installations on the same box.

So a few observations…

I have Firefox installed on multiple machines on the same network and ONLY this machine has given me problems that I’ve noticed. As a matter of fact, I run some virtual machines on this box, that have FF installed on them, and they don’t give me a problem either.

As I mentioned previously, this has happened across multiple OS installation’s and I DONT use Firefox sync, so it’s not bringing junk over from another install or anything. It’s always a clean and fresh install.

Long story short, I upgraded said machine to windows 11 very recently (clean install) and it was working perfectly until I installed Firefox. The hangs started occurring again and I decided to just try brave instead. Anytime Firefox would just hang and fail to load a page, I would open brave and attempt to load the same URL and it works 100% of the time. I’m glad to have finally figured out a fix for it, but why in the world is this happening and only with Firefox?

FF does some stuff in the background like mining that it doesn't explicitly tell you about and because of stuff like this, I don't use any of the newer versions unless I'm forced to. Probably something like this is messing with the system kinda like how malware would. One thing you could try is a portable version of ff after a clean install and see if you have the same problem or not.

 

[dr.stevil]

FF does some stuff in the background like mining that it doesn't explicitly tell you about and because of stuff like this, I don't use any of the newer versions unless I'm forced to. Probably something like this is messing with the system kinda like how malware would. One thing you could try is a portable version of ff after a clean install and see if you have the same problem or not.

That’s really messed up. I recall seeing some controversy about Firefox somewhat recently but I didn’t know it was mining on people machines. Sounds like it’s time to go to water fox or pale moon.

Thanks for the heads up!

 

[philb2]

That’s really messed up. I recall seeing some controversy about Firefox somewhat recently but I didn’t know it was mining on people machines. Sounds like it’s time to go to water fox or pale moon.

Thanks for the heads up!

What kind of mining? Could they actually conceal such activities from the public?

 

[Eulogy]

FF does some stuff in the background like mining that it doesn't explicitly tell you about and because of stuff like this

What? You got a link or proof that this happens? I haven't heard that and did some searching for it, and the only thing that pops up are all the mining _blockers_ that FF has built in.

 

[toast0]

I’m glad to have finally figured out a fix for it, but why in the world is this happening and only with Firefox?

I haven't gotten around to debugging it, because it's not super consistent, but it's pretty obvious Firefox is doing something dumb. I see occasional issues on desktop where it just kind of sits around, and then all of a sudden several tabs load at once. Most often when I start the browser after I've had it closed for a while. My network is not that bad, usually. It's worse on Android, but then it's harder to debug stuff on Android too.

If you've given up on Firefox at this point, I wouldn't blame you. If not, maybe try popping open the developer tools, and see if anything obvious shows up. If you can get a consistent sequence of events, that triggers the behavior, let me know (or file a bug in bugzilla)... Last time I filed a networking bug with specifics, it got triaged, asigned and fixed pretty qyick (but then took two months-ish to go through their release cycle). But it's got to really piss me off to get a good report, because TLS makes everything a giant pain to debug.

 

[dr.stevil]

I haven't gotten around to debugging it, because it's not super consistent, but it's pretty obvious Firefox is doing something dumb. I see occasional issues on desktop where it just kind of sits around, and then all of a sudden several tabs load at once. Most often when I start the browser after I've had it closed for a while. My network is not that bad, usually. It's worse on Android, but then it's harder to debug stuff on Android too.

If you've given up on Firefox at this point, I wouldn't blame you. If not, maybe try popping open the developer tools, and see if anything obvious shows up. If you can get a consistent sequence of events, that triggers the behavior, let me know (or file a bug in bugzilla)... Last time I filed a networking bug with specifics, it got triaged, asigned and fixed pretty qyick (but then took two months-ish to go through their release cycle). But it's got to really piss me off to get a good report, because TLS makes everything a giant pain to debug.

Thanks for the information! It’s good to know it’s not just me… I may look into it further if I can find some free time. Thanks again to everyone for all the help and suggestions

 

[SamirD]

What? You got a link or proof that this happens? I haven't heard that and did some searching for it, and the only thing that pops up are all the mining _blockers_ that FF has built in.

It's actually in the settings--that's how I found out about it. You have to choose advanced and then read through a lot of the ity bity options as they bury it.

 

[SamirD]

What kind of mining? Could they actually conceal such activities from the public?

If I recall correctly it's some sort of mining to help support them financially. It's not supposed to take a big toll from what I remember the blurb saying, but it was a huge turn off and something I switched off immediately.

 

[SamirD]

That’s really messed up. I recall seeing some controversy about Firefox somewhat recently but I didn’t know it was mining on people machines. Sounds like it’s time to go to water fox or pale moon.

Thanks for the heads up!

It's actually there in the options. You have to select advanced and you have to go through every little one to find it. That's how I did anyways.

 

[Eulogy]

It's actually in the settings--that's how I found out about it. You have to choose advanced and then read through a lot of the ity bity options as they bury it.

I cannot find anything in normal settings or About:Config. If you can post a screenshot or at least an article where to find it, that'd be helpful so I can ensure it's disabled.

 

[SamirD]

I cannot find anything in normal settings or About:Config. If you can post a screenshot or at least an article where to find it, that'd be helpful so I can ensure it's disabled.

Let me check through mine again--who knows if the option or even the 'feature' has been removed since the original version that I saw this on.

 

[elavanis]

Thanks for the informative read.

I've been having the same issue for a while now and have been troubleshooting mtu sizes on my router thinking it was something with my 5g Internet. I'll try using chrome for a while to see if that is the the issue. Hate to move away from Firefox as I've been a long time user but the issue of multiple pages not loading and then suddenly working has been an on going for a while now.

 

[xx0xx]

Firefox is my main browser on all PCs across multiple OSes, all on latest versions, and I've never had this issue, nor have I had any "mining" going on. I have periodically on Windows, in particular, had weird issues with Firefox and Chrome in the past, but those turned out to be a corrupted profile, wayward extension, or something else. There are websites, extensions, and other sketchy things that CAN attempt to do mining through your browser, but those are not the browser's fault.

Another thing to check is your FF settings and see if DNS-over-HTTPs is turned on and what servers it is going through, and if so, maybe try changing it to different DNS or turn it off and see if it has any effect. Maybe for whatever reason the DNS it is using isn't routing well or something, not sure, but no idea why that would only isolate to a single PC

Also, I've *very commonly* had extensions randomly break stuff they shouldn't even be touching. The "dark reader" extension (used to force dark mode on any sites you choose) actually breaks one of my bank/financial sites, even when the site is whitelisted in the extension- have to disable the extension for the site to work. So, while this isn't your issue- sometimes extensions can be to blame, whether it's by accident or whether an extension has gone malicious/etc. Some anti-virus products do sketchy proxy stuff too which can sometimes cause problems. AVG did this for a long time (as an IT support person I've had to fix many PCs with these types of issues)

While Mozilla has had a few missteps in the past (Pocket, Mr. Robot tie-in), I don't recall them ever doing actual mining in the background to make money or anything like that. Unless one of their "studies" was something mining-related but I don't recall if that was ever the case- those can be disabled in settings too, it's what the Mr. Robot install came through. Though they got enough backlash for that that they've been way less intrusive since.

Also- strange that it's happening only on this specific PC and not any of your VMs or other PCs with Firefox. Makes me wonder if there's something specific to this PC that is having a problem and in particular whatever the issue is causes the symptoms show up in Firefox more obviously than anywhere else. Does the PC have multiple NICs - wired vs. wireless - etc? Definitely all sorts of combinations of trial and error might help narrow it down.

I assume you're getting FF from the same place every time (clean fresh installer from Mozilla, nothing third-party or sketch?). If it's the same exact clean FF install that other PCs have no issue with, then I doubt it's necessarily FF as I would expect all of your FF installs to have the same problem.... so even if other browsers seem fine- maybe it's a red herring where the symptoms appear in FF but the issue lies elsewhere. It all seems isolated to the same PC, across multiple OS installs, so I'm thinking there's some quirky problem with this PC in particular, whether that's some NIC instability that other browsers just don't show symptoms of, or otherwise

Sorry for the novel