Question Chronic Wired Connection Issues

[cmill78]

For the last 3 years I have had connection issues ONLY on my wired connection. All wireless devices do not experience ANY issues. These issues do not happen if I have a VPN turned on, but that isn't always practical for speed reasons. It isn't permanent. A simple reload or three immediately brings me to where I was going. However, it becomes frustrating when logging into games, staying connected to certain streaming services, or making any purchases online. Basically, not life altering but annoying. Here are the things I have tried to resolve the issue:

- Uninstalled the VPN via REVO (twice), deleted all files associated with it, and reinstalled a different VPN and had some issues so I repeated the uninstall.

- Updated all relevant devices, drivers, programs (i.e.; Ethernet, GPU, BIOS, router firmware, etc...).

- Restarted modem and router (several times).

- Confirmed through ISP that their modem is working properly.

- Changed ethernet cables.

- Ran network commands (netsh winsock reset, netsh int ip reset, ipconfig /release, ipconfig /renew, ipconfig /flushdns).

- Uninstalled Ethernet Network Adapter driver and restarted Windows.

- Tinkered with 'Speed/Duplex' settings on Windows and router.

- Disabled 'Dynamic QoS' within router.

My router is a Nighthawk X6 R8000 and it seems to be working fine otherwise, though it is a little over 4 years old. My motherboard is an MSI B450 Tomahawk Max and I am using the Ethernet port on that motherboard.

The only thing I haven't done yet is a complete Network Reset. I was told it should be a "last resort" so I came here to see if I missed anything before taking that step. Any help would be greatly appreciated.

 

[cmill78]

Both of my PC's are only able to connect via wired connections. I only have one connected because the other is simply used as a media center for our small child. Neither is capable of connecting wireless. The other PC is likely way behind on updates so I opted not to use it for the test. I know, probably not helpful. My apologies. Also, I didn't have to wait 24 hours for the issues to crop up this time when switching routers. Here is the "ipconfig/all" results for the main PC:

Windows IP Configuration

Host Name . . . . . . . . . . . . : DESKTOP-8R29ABS
Primary Dns Suffix . . . . . . . :
Node Type . . . . . . . . . . . . : Hybrid
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No

Ethernet adapter Ethernet 3:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Realtek PCIe 2.5GbE Family Controller
Physical Address. . . . . . . . . : 74-FE-CE-0E-F9-4A
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes

Ethernet adapter Ethernet 2:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Realtek PCIe GbE Family Controller #2
Physical Address. . . . . . . . . : 00-D8-61-AB-1B-F6
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
Link-local IPv6 Address . . . . . : fe80::a2e6:78c6:f0e9:3e97%8(Preferred)
IPv4 Address. . . . . . . . . . . : 192.168.1.3(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Lease Obtained. . . . . . . . . . : Wednesday, June 12, 2024 10:57:37 PM
Lease Expires . . . . . . . . . . : Monday, June 24, 2024 8:43:53 AM
Default Gateway . . . . . . . . . : 192.168.1.1
DHCP Server . . . . . . . . . . . : 192.168.1.1
DHCPv6 IAID . . . . . . . . . . . : 369154145
DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-25-AE-02-BE-00-D8-61-AB-1B-F6
DNS Servers . . . . . . . . . . . : 192.168.1.1
NetBIOS over Tcpip. . . . . . . . : Enabled

As far as the "Reliability History/Monitor": All 'Informational Events' were simply successful Windows updates during the period between 06/04/24 to today. There were a few 'Windows failures' and 'Application failures' over that course.
- Six instance of agt.exe "stopped working" (3 times on the 8th of June which was when I was doing the Safe Mode testing).
- An instance of 'PWA Proxy Host Stopped Working and was Closed' on the 4th of June.
- An instance of 'Windows Hardware Error' on the 12th with no explanation as to what hardware had the error.
- Two 'Warnings' of failed Windows Updates, likely due to the dropped connection issue.

'Event Viewer=' was far more active but it seems to always have been on any PC I have had. I wouldn't know where to start since there are several every day. There are always 'Errors' for metadata staging failures and 'Warnings' for certificates about to expire. Sometimes I get 'Warnings' that happened when I was logged off and asleep.

'Task Scheduler' didn't show any apps that weren't necessary or wanted other than the google updater (I don't think I use any google apps on my machine). Everything there seemed fine.

'Router Logs' were short as it only seems to log the last 48 hours. Here is something I noticed:
- A series of [WLAN Access rejected: Incorrect security] from MAC 9C : E^ : 35 : 31 : 5F : E8, Saturday, June 22, 2024.
That seires occured from 3:57:03 p.m. until 4:35:55 p.m. with over 30 instances logged. Other than that string, everything else seemd to be normal. This PC was on but not actively used. We were watching a streaming service at the time with no issues.

 

[bill001g]

So this is a longer thread that I may have missed things.

Can you tell if it is disconnecting completely from the network or only from internet servers. If you were to lose the ethernet port or cable physically it should cause a error but I assume you did not see that in the event logs.

Maybe some very basic stuff.

Leave a constant ping run to the router IP and to some common IP like 8.8.8.8

Loss to the router IP most times is some issue on the PC. Not likely the router since you have the issue on multiple routers.

If you get no loss to the router but to internet IP then it is more complex. This most times indicates some issue with your internet connection. If you were to run pings on another device it should also see loss to 8.8.8.8.

If it is only your machine it can still be vpn even when you uninstall it. I had a problem similar to yours when I was trying out a number of vpn and it seems one did not uninstall correctly and the only way I fixed it was to reinstall windows. I have never loaded a vpn client on the machine since..I use my router. The only vpn client I would consider is one of the open source vpn that you then manually configure using the vpn sites setting rather than blinding running executables.

Although it likely is not the case if you get disconnects after a session is open I would change the DNS in the IPv4 settings to 8.8.8.8 or 1.1.1.1 DNS issues tend to be more slowness and sites not opening. These public DNS servers work better than the default which is to use your router a proxy to the ISP dns both which tend to have more issue than google or cloudfare dns servers.

 

[cmill78]

Pinging returned no issues. I did quick pings and let it go for upwards of two hours. Both my IP address and 8.8.8.8. I also changed my DNS in IPv4. Still the same issues. The Cable Company is supposed to come out sometime after the 4th. Fingers crossed.

 

[Ralston18]

Reference:

"A series of [WLAN Access rejected: Incorrect security] from MAC 9C : E^ : 35 : 31 : 5F : E8, Saturday, June 22, 2024."

Are you able to identify that device?

Here is a link that can help with identifying devices:

https://macvendors.com/

It would be helpful to get a sense of how your network is setup.

Likely something similar to the following line diagram:

ISP === (coax, DSL, fiber) ===> Modem ---->[WAN Port] Router [LAN Port] ----> [LAN Port] Office Wifi Access Point (if used) ~~~~> Wireless network devices.

With other Router LAN ports -----> Wired network devices.

Feel free to edit and correct my line diagram to show how your network layout (topology).

 

[bill001g]

Your ISP is not likely to find any problem. Now this might be a intermittent issue....which makes is a huge pain for both your and the ISP to find.

If the ping to the router is fine it generally means you have good network in your house. If the ping to 8.8.8.8 is fine it means the data is traveling over the line coming to your house, though the ISP network, and then to google and maybe even passing other isp on the way. This basically means there is no network issue with any of your equipment and with your ISP equipment.

There is the rare chance it is another ISP but you can do nothing about that so it does little good to consider that possibility.

What this could be though is something other than a true network issue. For example ping does not use the web browser and it could be a web browser issue. BUT games also do not tend to use web browsers so it is not going to be that simple.

These are the type I really hate. You need to find something consistently breaks and try to determine what is different about that traffic and the ping command. It can be other software loaded on the machine. Common things are so called game accelerators that come bundled with the bloatware on motherboards and video cards. That though is just one example there are many other things that you might have installed.


Although it is a extreme things to try it might actually take less time in total. Maybe reinstall windows telling it leave all your data. You unfortunately will still have to reinstall all the apps but any data used by those apps will still be on your disk.

 

[cmill78]

Reference:

"A series of [WLAN Access rejected: Incorrect security] from MAC 9C : E^ : 35 : 31 : 5F : E8, Saturday, June 22, 2024."

Are you able to identify that device?

Here is a link that can help with identifying devices:

https://macvendors.com/

It would be helpful to get a sense of how your network is setup.

Likely something similar to the following line diagram:

ISP === (coax, DSL, fiber) ===> Modem ---->[WAN Port] Router [LAN Port] ----> [LAN Port] Office Wifi Access Point (if used) ~~~~> Wireless network devices.

With other Router LAN ports -----> Wired network devices.

Feel free to edit and correct my line diagram to show how your network layout (topology).

The MAC address comes from my sons Nintendo Switch, which is wireless. I have tested his device (like all the others) several times with no issues with connection at all. On that date listed were we out of the house, he had it with him and then we returned home so maybe that was the machine reconnecting but having trouble?

Here is the diagram for my home (hope I did this right):

ISP === (coax) ===> Modem ---->[WAN Port] Router ----> [LAN Ports] Home PC, XBox One ~~~~> [Wireless network devices] Nintendo Switch, 2 Samsung Cell Phones, 3 Roku Devices, 1 Cannon Printer, .

 

[cmill78]

What this could be though is something other than a true network issue. For example ping does not use the web browser and it could be a web browser issue. BUT games also do not tend to use web browsers so it is not going to be that simple.

These are the type I really hate. You need to find something consistently breaks and try to determine what is different about that traffic and the ping command. It can be other software loaded on the machine. Common things are so called game accelerators that come bundled with the bloatware on motherboards and video cards. That though is just one example there are many other things that you might have installed.


Although it is a extreme things to try it might actually take less time in total. Maybe reinstall windows telling it leave all your data. You unfortunately will still have to reinstall all the apps but any data used by those apps will still be on your disk.

I have already tried a complete Windows reinstall exactly as you described. After a 24 hour, or so, period the issue started again.

I have also tinkered with Chrome (I hate Google stuff on my PC, if I can avoid it I do), Opera, Edge, Vivaldi, and Tor (briefly). It happened on all of them as well.

I limit the amount of 3rd party software on my machine. MSI Afterburner, Discord, ProcessExplorer, and Revo Uninstaller are all that I use. I have used all of these a lot longer than the problem has been around.

 

[Ralston18]

Diagram is fine. Just to be sure that I understand it correctly:

There are two wired network devices (Home PC and Xbox One) that are physically connected to the router.

There are seven wireless network devices (Nintendo Switch, 2 Samsung Cell Phones, 3 Roku Devices, 1 Cannon Printer) that are served by the network router.

The second PC (media center) is not connected via a wired connection. Any chance that it has a wireless adapter that could be enabled and trying to join the network?

 

[bill001g]

I have already tried a complete Windows reinstall exactly as you described. After a 24 hour, or so, period the issue started again.

I have also tinkered with Chrome (I hate Google stuff on my PC, if I can avoid it I do), Opera, Edge, Vivaldi, and Tor (briefly). It happened on all of them as well.

I limit the amount of 3rd party software on my machine. MSI Afterburner, Discord, ProcessExplorer, and Revo Uninstaller are all that I use. I have used all of these a lot longer than the problem has been around.

Now you really have me stumped.

In theory at least it is not your router or your ISP network. No other device has the issue and even your pc does not have issues when testing with ping. This means it is also not likely a hardware issue.

You have reinstalled windows and the problem still happens. This means you have eliminated software as the cause.

Although I am unsure in a thread this long I think you are also using a static DNS like 8.8.8.8 and have turned off IPv6 support.

This pretty much eliminates everything so something got missed in the testing.

The best case would be if you were to get pin failures to your router IP. Then it tends to be a cable or the ethernet port.

 

[Ralston18]

What I find intriguing is that 24 hour "grace period" where, after a Windows reinstall, all seems to be well.

Is it correct that wired connectivity does indeed work without issues (all other things being equal) for at least some number of hours?

 

[cmill78]

Diagram is fine. Just to be sure that I understand it correctly:

There are two wired network devices (Home PC and Xbox One) that are physically connected to the router.

There are seven wireless network devices (Nintendo Switch, 2 Samsung Cell Phones, 3 Roku Devices, 1 Cannon Printer) that are served by the network router.

The second PC (media center) is not connected via a wired connection. Any chance that it has a wireless adapter that could be enabled and trying to join the network?

You are correct in the interpretation of my diagram.

The Second PC is not connected in any way nor does it have a wireless adapter. It is a slightly older machine used only for media.

Yes, wired connectivity does indeed work without issues (all other things being equal) for at least some number of hours, but only in the instance listed below. All other times the connectivity issues exist. The 24 hours is a rough estimate. But usually in a 12-24 hour window. Specifically (that I have noticed):
- After the Windows reinstall (roughly 24ish hours).
- After a complete system shutdown (12-24 hour window).
- After the installation of the PCIe Ethernet adapter (the following evening so between 16-24 hours).
- Switching/testing the other two routers (24ish hours), though, when swapping routers for the ping tests it took less than an hour.
- When turning off any of the 3 VPN's I've used over the span of this issue (between 4-12 hours).

 

[cmill78]

The best case would be if you were to get pin failures to your router IP. Then it tends to be a cable or the ethernet port.

So far I have tested at least 8 different CAT cables. 2 CAT5 and the rest CAT6. I now have all CAT cables of the same brand/make. As far as ethernet ports go; I have tried all 5 ports on my router and the onboard ethernet from the mobo and am currently using the new ethernet adapter. Not to mention all the ports on the two test routers. It is very strange.

 

[Ralston18]

Have you ever run "arp /a" via the Command Prompt?

The circumstances you describe brought to mind the Address Resolution Table.

FYI:

https://www.auvik.com/franklyit/blog/what-is-an-arp-table/

And you can google for similar links and explanations.

Going out on a limb here a bit but my thought is that things work until some point when the table gets corrupted. No idea as to how that may be occuring. If at all.....

Objective simply being to determine if there is some such issue.

Most of the things you have done, I believe, clear the table.

My thought is to flush/clear the table and see if that helps.

More information:

https://www.thewindowsclub.com/how-to-clear-arp-cache-in-windows

https://toptecmag.com/flush-arp-cache-on-windows-11/

If clearing the cache makes things work for another 12-24 hours then the next step would be to figure out what is causing the problem.

If clearing the cache does not make any difference then more ideas will be needed.

 

[cmill78]

Have you ever run "arp /a" via the Command Prompt?

I started with a flush and so far it's been roughly 30 hours without a hiccup. If it returns then I will do the clear. The article on how to do the clear mentions that it can cause issues that throw errors upon rebuilding so I am hesitant, but I guess if any errors occur I can return here. Thanks to everyone for helping so far. Hopefully this is the last post I need to make.

 

[cmill78]

***UPDATE***

It lasted almost 42 hours but it started again. I will be doing the ARP clear later today.

 

[Ralston18]

Look in Reliability History/Monitor and Event Viewer for any error codes, warnings, or even informational event that were captured just before at the time the problem returned.

If it is not too late already, run "arp -a" agin and then do a screenshot of the results.

Print for future reference.

Once you have cleared the table and restarted run "arp -a" again.

The objective being to continue monitoring the table and looking for some change that precedes the problem.

Start keeping very close track of devices: device names, IP address, MAC, when they join the network.

Hopefully you will be able to recognize or otherwise know every device that shows up on the network.

Remember to use the router's logs as well.

 

[cmill78]

Apologies for the late response, wife had the flu and I was working double shifts to cover vacations.

About 24 (or so) hours after the clear (arp -d), and a system reboot, the same issues returned. I ran arp -a to check for addresses and everything was the same again.

I checked with arp -a after the arp clear, after reboot, and after the issue appeared again. No new changes or entries.

I checked the router logs and everything was the same as it was before with the only issue being my sons Switch not connecting but that was several days ago. I checked the logs after the arp clear, after reboot, and after the issue appeared again. No new changes or entries.

I checked the Event Viewer immediately after the issue began again and there were no new entries during that time. Earliest entry to the issue re-started happened nearly 1 hour prior. That error read: 'Session "Microsoft.Windows.WindowsUpdate.RUXIMLog" failed to start with the following error: 0xC0000035'.

To summarize: No new IP/MAC addresses that differ from the usual were connected or connecting, no new router log issues/errors, and no new events logged during the time of the issue re-starting.

 

[bill001g]

Although it appears clear the arp table has a affect what does not make sense is why a VPN would make any difference.

Things like MAC addresses and the ARP entries are only used for LAN stuff. For most people the only device they talk to on their lan is the router. The mac and the IP of the router are all the same even when you run VPN.

Seems this example is going to be a bit long but I want to keep the detail so you see why it doesn't seem to make any sense.

So if we look at the data pattern with and without a vpn. Lets for example say you are going to ping 8.8.8.8 and you are using a vpn server that has a IP of 1.2.3.4. Lets say your mac address is 44:55:66 and the router is 66:77:88. The router IP is 192.168.1.1 and your address is 192.168.1.200

So without vpn your machine builds a packet...note I am over simplifying the actual packet structure.

Source mac address, destination mac address, source IP, destination ip.

You get a packet
445566,667788,192.168.1.200,8.8.8.8,data-----

The only thing slightly tricky here is destination mac address and how it is determined. Your pc looks at the destination ip of 8.8.8.8. It determines this is not on your LAN..the subnet mask is what does this. So it then looks up the gateway IP of 192.168.1.1. You will notice that you do not see that IP anyplace in the packet. What it now does is look the 192.168.1.1 in the arp table and finds the mac. Traffic on the lan is actually passed between device with mac address..even though the packets also contain IP you techincally don't need to use IP on lan.

SO now we look at a VPN packet. To avoid even more complexity I will look at the simple example.

So the first step is basically the same. You end up with a packet
192.168.1.200,8.8.8.8, data.

Now instead of placing mac addresses in the packet the VPN client intercepts the packet.

What you now get is a packet that has

192.168.1.200,1.2.3.4,data.....but the data part of the packet contains 192.168.1.200,8.8.8.8,data but is encrypted.

What the vpn client did was add a second set of IP addresses and place the orginal packet in the data part of the new packet.

After this the mac address part is the same. You would see a packet with

445566,667788,192.168.1.200,1.2.3.4....data

The only real difference is what is in the data part of the packet and what the destination IP is. The packet is always sent to the router mac address which is always the same.

If there was any true network issue both the vpn and the non vpn should be the same. The only real difference is the manupulation of the packets before it is sent eveything else is identical. Even worse there should be no difference between wifi and ethernet.

Although you have elimianted it by all the OS reisntalls this is acting like there is some kind of interception software on the machine and when you load the vpn client it somehow is breaking the software. Not even malware there are so called "gamer" network accelerators that try to mess with the data stream. From all your pevious debugging it is unlike it is just some simple software you accedently installed.

So maybe the next step is to actually intercept the traffic yourself. You might look at a program called wireshark. This will capture and decode every packet. This tool will let you look at the data packets in detail. Unfortantly when you first start to do this it is like drinking from a fire hose. There is a massive amount of data collected and it takes time to learn what it means and how to filter to obtain what is really useful.

Wireshark intercept just above the device driver which is below where a vpn intercepts. The only gotcha is there are features in the etherent chipsets that ofload the check sum calculations so the packet you see with wireshark is not exactly the same as the packet send on the cable. You can try to disable that feature..it tend to be in bios..but again this is such a low level thing that a VPN would also have issues.

 

[Ralston18]

Check Update History for any failed or problem updates.

And to be sure: the problem still disappears for about 24 hours after clearing the cache and then returns - correct?

Run "dism" and "sfc /scannow".

https://www.windowscentral.com/how-use-dism-command-line-utility-repair-windows-10-image

https://www.lifewire.com/how-to-use-sfc-scannow-to-repair-windows-system-files-2626161

 

[cmill78]

Check Update History for any failed or problem updates.

And to be sure: the problem still disappears for about 24 hours after clearing the cache and then returns - correct?

Run "dism" and "sfc /scannow".

Update History showed nothing that failed or had any issues.

DISM returned no issues with Check Health, Scan Health, and Restore Health. However...

SFC /Scannow did find corrupted files, though, after reading through the CBS logs it appears only one was repaired (CSI 000001e2 [SR]), though I have not the technical knowledge to know what or where it was. Gonna restart the machine and keep my fingers crossed that this was issue.

As far as the '24 hours' period; This is a rough estimate (usually) as I only turn my PC off once a week but am logged out when I am not home or actively using the PC. So any time-frame I have put in these replies is usually the time between the attempted fix offered by you guys here, and the first time I notice the issue again, though there could be 8 to 12 hours where the PC is not used in between.

 

[cmill78]

Although it appears clear the arp table has a affect what does not make sense is why a VPN would make any ......

Your reply was a lot to digest and I will be combing over it again while I wait to see if the SFC SCAN worked. I appreciate the information.