Question Latency/Ping Spikes Randomly throghout the day

[Nighteyes2000]

Before I start here are the stats of my internet connection:

ISP is Cox High Speed Internet- Our plan is 100 mbps which we get 100+ when its not spiking
Modem is a Cisco Model DPQ3212
Router - Apple Airport - roughly 15 device connected via wifi and 4 ethernet
My computer is currently wired directly into the router
For my computer I built it about 3 years ago some specs are
i5 intel Processor
Asus z170 Motherboard
I can't remember power supply but It's definitely got enough power
Windows 10 OS


As the title says I have been having high ping spikes randomly throughout the day. My internet was always able to handle anything I threw at it until roughly 10 months ago when I first started experience any kind of regular spikes. At first it seemed to be just a small spike every once in awhile that would cause my game (Usually League of Legends on the computer or COD on Xbox One) to freeze for a second then get right back to where I was. This was OK, it was annoying but definitely still playable. Around 5-6 months ago things seemed to get progressively worse with the spikes happening quite frequently. Within the last 3 months it's pretty much a daily encounter. My internet can be fine for hours at a time, sometimes a day or two, then randomly my ping with start to jump erratically. Typically the ping on LOL is around 70-80 but when I get spikes it goes all over from 90-300. I also play COD on the XBOX One with my brother in the same house and when experience the same issue with super random spike in latency when playing. It stays relatively unstable for any length of time. Sometime lasting 5 mins and others going for a few hours. This happens at any time of the day as well 2am, 2pm, 11 am, literally all times of the day. And it will happen when there's everyone in my family using the internet or when I am the only one up at 4 am it can start to spike, even if I have changed nothing at all.

Here is a list of everything I've tried or tried to monitor until now:

-I first tried restarting the whole network by unplugging the router, modem and shutting down my computer then plugging the modem in and letting it boot, then the router and finally my computer. Sometimes this might make the internet better but just as often the internet is still spiking.
-I've monitored my task manager and made sure my CPU/RAM or any other stats aren't being maxed out, which they do something if I have Microsoft Edge open while gaming.
-We've called Cox numerous times, and since the internet only spikes randomly I've never been able to get them to see this issue since they only monitor it through speed test.net (which in my opinion is awful at capturing my connection since it never seems to capture the spikes when they're happening). They've sent out technicians 2 times now. The first time they changed a setting on the router and told me the apple airport might be the issue and I should to replace it before calling again. The second guy went and checked all of the wires in our house which he said they all seemed fine.
-We then replaced our router and modem with a nighthawk x6s router and a good modem we were told, I forget which one(Arris Surfboard I think), but the internet didn't get better and even seemed to feel worse no matter what combination of old and new equipment I used.
-I have plugged my computer directly into the modem and tested it and he issue seems to persist or even get worse.
-I've tried changing firewall settings, updating computer drivers and router/modem settings
-After some researching I then began testing my ping first using the command "ping -t 8.8.8.8" to ping google.com on a loop and started monitoring the ping. I took those pings and plotted them in excel to get a graph over time of my ping at certain times of the day. I included some screenshots of them at the end. After studying the ping a bit I noted a few things 1) my ping when not spiking was usually 20-30ms with the occasional 50 or 60 so not bad 2) when I started to lag in game the ping would reflect that and pretty much go haywire 3) after a while sometimes the pings go back to 20-60 but every 10-20 seconds I will still get to 100-200ms 4) when it gets bad I will start to get a bunch of "Request times out" messages in a row.
-As stated earlier I experience this on my PC and also my Xbox one. I also tried to test the ping on two other separate computers, all of which show similar results so I've concluded not my computer.
-I have also tried a tracert to google.com to see if there was a specific hop that seemed to be the issue. The first hop(which I believe is my router) is always consistently at 1-2 ms but after that its random which hop comes up with high ms. I run the tracert command a few times to see if there is a consistent hop that is the problem but each time I run it usually a different hop then before is spiking which I believe means there isn't a problem with any one of those hops and it just spikes as my connection does. This also mad me thing it could possibly be my modem/ISP company even though they say everything is working. I'm inluding screenshots of just the pings to google for some of my tracerts at the end as well.

At this point I've tried almost everything I can think of to try and fix my internet and I am extremely frustrated. I've read a lot of the other threads on here but all the other issues seem to be either related to a PC/Wifi or completely lacking in any evidence that they are indeed having an issue. I'm throwing this thread out in desperation that there is a trick out there I haven't tried or something that I missed to fix my internet. If there's any additional information needed I'll do my best to provide it.

Here are the pictures of my ping tests:

https://imgur.com/a/NtXVJ0Q

View: https://imgur.com/a/NtXVJ0Q

 

[BringerOfTea]

http://www.dslreports.com/speedtest

bufferbloat mayhaps... your router is probably the culprit here. I am not familiar with the apple airport.

Edit: Didnt see that you where connected to the modem directly.
Anyways update network drivers? tried that?

 

[digitalgriffin]

I'm assuming you have a cable modem. Some cable companies reboot the cable modem once a day. Mine is around 5 am in the morning. Open your cable modem (usually 192.168.100.1) and see if you can access your logs and look for the time date stamp similar to where you see spikes.

The other thing you can do is install wireshark to inspect what's happening over your network. It will log everything.

How to Use Wireshark to Capture, Filter and Inspect Packets

Wireshark, a network analysis tool formerly known as Ethereal, captures packets in real time and display them in human-readable format.

www.howtogeek.com

 

[Nighteyes2000]

I'm assuming you have a cable modem. Some cable companies reboot the cable modem once a day. Mine is around 5 am in the morning. Open your cable modem (usually 192.168.100.1) and see if you can access your logs and look for the time date stamp similar to where you see spikes.

The other thing you can do is install wireshark to inspect what's happening over your network. It will log everything.

How to Use Wireshark to Capture, Filter and Inspect Packets

Wireshark, a network analysis tool formerly known as Ethereal, captures packets in real time and display them in human-readable format.

www.howtogeek.com

Yes I believe it is a cable modem. Even if they did reset the modem why would I not have a total disconnect and experience the spikes sometimes for a number of hours? I did open up what appears to be the modems page but it has a username and password that I don't know. I already tried a few defaults like admin/ password and those didn't seem to work. I doubt anyone in my family has ever set a password for it.

I'm also going to download wireshark and see how that goes.

update actually just "logged in" I just had to press login with empty login information. There doesn't appear to be any kind of logs for me to view. Mostly just modem information, modem state, downstream channel, and upstream channels.

 

[Nighteyes2000]

http://www.dslreports.com/speedtest

bufferbloat mayhaps... your router is probably the culprit here. I am not familiar with the apple airport.

Edit: Didnt see that you where connected to the modem directly.
Anyways update network drivers? tried that?

Ya one of those ping charts I displayed is when I was connected directly to the modem. I just logged into modem and don't see any place for updates there.

As for the router. Apple routers, in my opinion seem to make troubleshooting ten times harder, especially as my computer is a windows... so I've attempted to use the family computer (which is a mac) and airport utility to find update but I don't seem to see any place to conduct an update. I also wasn't sure if that would make a difference since plugging directly into the modem didn't seem to change things.

 

[BringerOfTea]

did you try the dslreports when plugged directly into your modem?

 

[Nighteyes2000]

did you try the dslreports when plugged directly into your modem?

So my internet was fine this morning when I checked and I’m busy until this evening and I can check when I get home but I’m going to have to wait until the internet gets bad again until I can check it.

 

[HEXiT]

if your getting random spikes and done everything you can to diagnose it your end then its likely your branch connection to your area may be over subscribed.
reason i think this is your getting more than your paying for when it works which means they are having to compensate for some degradation somewhere on your line.

so yeah im thinking its your line rather than your system/setup.
if you can ask your neighbors if they have a similar issue if they use the same isp...

 

[BringerOfTea]

if your getting random spikes and done everything you can to diagnose it your end then its likely your branch connection to your area may be over subscribed.
reason i think this is your getting more than your paying for when it works which means they are having to compensate for some degradation somewhere on your line.

so yeah im thinking its your line rather than your system/setup.
if you can ask your neighbors if they have a similar issue if they use the same isp...

was my second thought as well, it may be that your ISP is struggelig to provide you with your "target" speed. You could try to lower it to 50 and see if it helps.

 

[Nighteyes2000]

if your getting random spikes and done everything you can to diagnose it your end then its likely your branch connection to your area may be over subscribed.
reason i think this is your getting more than your paying for when it works which means they are having to compensate for some degradation somewhere on your line.

so yeah im thinking its your line rather than your system/setup.
if you can ask your neighbors if they have a similar issue if they use the same isp...

So I've been wondering that myself too. So my question then if that's true is what can I do to improve my service. Or how could I prove that is the case and file a complaint?

 

[digitalgriffin]

So I've been wondering that myself too. So my question then if that's true is what can I do to improve my service. Or how could I prove that is the case and file a complaint?

I remember a fellow who ran speedtest.net and recorded the results every couple minutes. If it came is too far below what he paid for, he would auto post the result to Twitter saying "Hey Comcast, why am I not getting the speed I paid for?"

Angry Comcast customer set up Raspberry Pi to auto-tweet speed test results

Raspberry Pi does hourly speed tests, tweets if speed is lower than advertised.

arstechnica.com

 

[bill001g]

ISP do not guarantee anything....at least on non business grade contracts. They have all kinds of language that says things like UPTO and other terms that let them not provide service. ISP almost never admit they oversold a network. A ping spike is very different that packet loss or low speed. Ping spikes are caused by bufferbloat but unlike the bufferbloat that is caused by your traffic this is caused by everyone else you share a router port with. There is no way to fix this because you have no control over other users traffic.

Now a extremely unlikely possibility is you have a modem that has the intel puma bug that has not been patches. Random ping spikes was a symptom that problem. You should be able to check the firmware levels on your modem. I have not totally read this thread but if you are still using the cisco it does not have that issue. SOME models of arris did. Still that is a old problem and most modems have been patch. The ISP pushes patches to modems which is part of the reason they only support certain models

 

[Nighteyes2000]

was my second thought as well, it may be that your ISP is struggelig to provide you with your "target" speed. You could try to lower it to 50 and see if it helps.

I feel like if they can't provide 50 in bad times how would that improve my service if I lowered my plan? also I did the DSL report while in the modem and it came out fine like 170 down 9 up.

 

[Nighteyes2000]

I remember a fellow who ran speedtest.net and recorded the results every couple minutes. If it came is too far below what he paid for, he would auto post the result to Twitter saying "Hey Comcast, why am I not getting the speed I paid for?"

Angry Comcast customer set up Raspberry Pi to auto-tweet speed test results

Raspberry Pi does hourly speed tests, tweets if speed is lower than advertised.

arstechnica.com

Haha I like it. While I think in that guys case he was excessive I think that might be what Imma need to fix this.

 

[Nighteyes2000]

ISP do not guarantee anything....at least on non business grade contracts. They have all kinds of language that says things like UPTO and other terms that let them not provide service. ISP almost never admit they oversold a network. A ping spike is very different that packet loss or low speed. Ping spikes are caused by bufferbloat but unlike the bufferbloat that is caused by your traffic this is caused by everyone else you share a router port with. There is no way to fix this because you have no control over other users traffic.

Now a extremely unlikely possibility is you have a modem that has the intel puma bug that has not been patches. Random ping spikes was a symptom that problem. You should be able to check the firmware levels on your modem. I have not totally read this thread but if you are still using the cisco it does not have that issue. SOME models of arris did. Still that is a old problem and most modems have been patch. The ISP pushes patches to modems which is part of the reason they only support certain models

Well they don't have to grantee my speed but can I get at least some semblance of consistent speed. I am using the Cisco still. So basically your telling me if it is my ISP's inability to provide the service they agreed because they over promised and now are under delivering is impossible to prove or fix? If so I find that complete BS.

Also as I said before I have gotten into my modems "website" or whatever their settings and information is called when I put the IPnto my web browser. I just don't see an option to update the firmware or to do anything for that matter besides look at the Wifi section(I think that's what it was which regardless I couldn't edit anything there.

 

[bill001g]

Pretty much the ISP can do what they want they have lawyers to make sure they get away with everything. Your only option is to find another ISP if they refuse to work with you. The problem is most people are lucky if they have 1 ISP that can provide high speed internet.

You can only look at the firmware levels on devices that have cable modems. The ISP must update any firmware. In general they keep all the devices on the same firmware level in their network so it would be uncommon for it not to be patches but some they miss especially when you swap them after the initial install.

 

[Nighteyes2000]

Pretty much the ISP can do what they want they have lawyers to make sure they get away with everything. Your only option is to find another ISP if they refuse to work with you. The problem is most people are lucky if they have 1 ISP that can provide high speed internet.

You can only look at the firmware levels on devices that have cable modems. The ISP must update any firmware. In general they keep all the devices on the same firmware level in their network so it would be uncommon for it not to be patches but some they miss especially when you swap them after the initial install.

So I have one final question if it seems that its on my ISP's end and you said my community is oversubscribed. I have a few friends all within a square mile area. Would they be close enough to be on my same "line" or by neighbors/ line would it have to be someone on my street?

 

[HEXiT]

preferably some 1 using the same exchange so as close as possible.

 

[digitalgriffin]

So I have one final question if it seems that its on my ISP's end and you said my community is oversubscribed. I have a few friends all within a square mile area. Would they be close enough to be on my same "line" or by neighbors/ line would it have to be someone on my street?

How cable companies divy out switches and network nodes is a closely guarded secret (like cell tower reception). So its near impossible to determine. The techs know because they need to.

That said if you have a combined eouyer and modem inside one box then you will see the router side of things (192.168.0.1 or 192.168.1.1) by default. If you type 192.168.100.1 and it brings up the modem page you got lucky. Its for diagnostics mostly and the ROM is controlled by the ISP to make sure there is no monkey business on your side (changing mac to hide your ident or data usage caps). But cable modem pages contain a log and note if there is a signal strength problem or remote reset being invoked. Mine contains a page with the bonded channels used and signal strength as well as error rate.

 

[Nighteyes2000]

How cable companies divy out switches and network nodes is a closely guarded secret (like cell tower reception). So its near impossible to determine. The techs know because they need to.

That said if you have a combined eouyer and modem inside one box then you will see the router side of things (192.168.0.1 or 192.168.1.1) by default. If you type 192.168.100.1 and it brings up the modem page you got lucky. Its for diagnostics mostly and the ROM is controlled by the ISP to make sure there is no monkey business on your side (changing mac to hide your ident or data usage caps). But cable modem pages contain a log and note if there is a signal strength problem or remote reset being invoked. Mine contains a page with the bonded channels used and signal strength as well as error rate.

After you said this I looked back into the modem settings just to double check. So I do see the settings and details of my modem like serial number model all that stuff and something called the cable modem state, which may be the logs your talking about? They all seem to look fine to me anyways. I then talk another look at the downstream and upstream channels because I really didn't know what they were. I googled them to see what they were and if they were good or not. I found an article on speedguide.net about cable signal modem levels and after reading the article and some of the comments there it seems that my upstream channels power level might be lower then it should. The article says 37-50 dB is good though below 40 might start some packet loss. All of my channels are almost linearly 32-35 from channels 1-4. Now I don't know if this is something your familiar with or if it is a problem since they did say it can vary based on your settings but I figured I'd see what you guys think about this.

 

[bill001g]

Generally issue with a cable modem you see packet loss not packet delays. On many modems they show how many error packets you get on each channel. uncorrectable errors means the packet was discarded.

Packet delays mean that the data is being held in a memory buffer because there is some bottleneck that is preventing it from being sent immediately. Something like wifi the previous packet may have errors and is being retransmitted but that is only done in wireless connections other platforms send the data and if it is damaged it is discarded. The buffer likely is in the ISP network someplace. Some piece of equipment can not send the data to the next piece of equipment.

This is similar but different than the problem you see called bufferbloat. In the case you see discussed someone at your house is requesting more data than will fit in the allocated plan you pay for. The ISP rather than discard data that does not fit allows you to buffer some. For every application except games this is a good thing. Of course if you exceed the rate by a lot the ISP will start to discard data that will not fit rather than buffer it.

In that case it is a artificial delay related to how much you pay for it does not have impact on other users traffic because the buffers are separate.

The case you describe does not appear to be related to your traffic so it must be a buffer in the ISP network.

 

[digitalgriffin]

Generally issue with a cable modem you see packet loss not packet delays. On many modems they show how many error packets you get on each channel. uncorrectable errors means the packet was discarded.

Packet delays mean that the data is being held in a memory buffer because there is some bottleneck that is preventing it from being sent immediately. Something like wifi the previous packet may have errors and is being retransmitted but that is only done in wireless connections other platforms send the data and if it is damaged it is discarded. The buffer likely is in the ISP network someplace. Some piece of equipment can not send the data to the next piece of equipment.

This is similar but different than the problem you see called bufferbloat. In the case you see discussed someone at your house is requesting more data than will fit in the allocated plan you pay for. The ISP rather than discard data that does not fit allows you to buffer some. For every application except games this is a good thing. Of course if you exceed the rate by a lot the ISP will start to discard data that will not fit rather than buffer it.

In that case it is a artificial delay related to how much you pay for it does not have impact on other users traffic because the buffers are separate.

The case you describe does not appear to be related to your traffic so it must be a buffer in the ISP network.

Packet loss = delay. If there's a NAK on a packet, then that packet must be retransmitted which leads to ping delays.

Nighteyes, your signal strength is indeed low. Are you running your cable through a surge suppressor? Most of them use simple diode arrangements, and are quite frankly, junk. They work, but it's sticking a FRAM oil filter on a Ferrari. It lowers signal strength.

If this does not fix your issue, please contact your cable company. They can access your cable modem signal strength and verify your issue over the phone. They will then send a tech out to measure your signal strength. He may want to enter your home. But he should start by impedance matching the signal to 75Ohm at the signal box.

This is trivia of how this all works btw:
TCP/IP packets are numbered. They have an IP and a port number. The port number determines to which app/device on your home network it gets transmitted to. Now there is a maximum size of packet for TCP/IP (software) and a maximum size for an ethernet packet (hardware). So sometimes if one exceeds the other, there needs to be some repackaging to break it into smaller chunks.

That said, packets are broken into chunks. So lets say you have 64K of data you need to receive, and this needs to be broken down into 3 packets of ~21K each. (Packet 1 and Packet 2 and Packet 3). So the TCP/IP sits there and waits for all the packets to arrive in order before it sends them off to you. This means you have to have packet 1 and packet 2 and packet 3.

Now due to the nature of the internet, sometimes these packets arrive out of order. If Packet 3 arrives before packet 2, then the router is going to sit there and wait for packet 2 to arrive before sending your computer packet 3. Again, it packet 3, or 2 arrive before packet 1, then those two pieces of data will wait till packet 1 arrives. (After all data has to be complete and in order.) So all this data hangs around in memory till all packets arrive. This can create "memory" issues and every router is different on how they handle delayed TCP/IP packets. Some dump the packets sooner than later or send a NAK (Not acknowledged) automatically for the missing packet. This will force a retransmit on said packet.

Now UDP on the other hand (Universal Datagram Protocol) keeps things simple. "My data is small and contained to 1 packet, and I don't care what order it arrives, just hand it to me, even if out of order" This is useful for things like video streaming, or in your case video games. It doesn't matter if player position at 5 seconds arrives before player position at 4.2 seconds. Because the 5 second position is the most recent. The game might not be as smooth, but contains the most accurate data of the current situation.

Some DNS's will get pinged RELENTLESSLY for UDP DNS services. And because they aren't local and traffic can get quite heavy, the ping time MIGHT actually be higher than TCP/IP. Overall the average might be lower (Cloudflare) but every once in a while you might see a spike. That's why I was asking. Also, my personal firewall when using UPlay (UbiSoft) downloader, was using UDP. And it would crash because it's UDP DNS was timing out due to DPI and causing buffer bloat as the commands built up in the buffer on the firewall.

 

[bill001g]

Packet loss = delay. If there's a NAK on a packet, then that packet must be retransmitted which leads to ping delays.

Nighteyes, your signal strength is indeed low. Are you running your cable through a surge suppressor? Most of them use simple diode arrangements, and are quite frankly, junk. They work, but it's sticking a FRAM oil filter on a Ferrari. It lowers signal strength.

If this does not fix your issue, please contact your cable company. They can access your cable modem signal strength and verify your issue over the phone. They will then send a tech out to measure your signal strength. He may want to enter your home. But he should start by impedance matching the signal to 75Ohm at the signal box.

There is no concept on NAK in ICMP it is used in thing like USB or maybe token ring. I have not seen NAK in any TCP or UDP either so I don't know where you get that.

There is also no concept of retranmissioin in ICMP of any kind.

 

[digitalgriffin]

There is no concept on NAK in ICMP it is used in thing like USB or maybe token ring. I have not seen NAK in any TCP or UDP either so I don't know where you get that.

There is also no concept of retranmissioin in ICMP of any kind.

Services and Segment structure in TCP - GeeksforGeeks

A Computer Science portal for geeks. It contains well written, well thought and well explained computer science and programming articles, quizzes and practice/competitive programming/company interview Questions.

www.geeksforgeeks.org

There are multiple levels of error recovery. I generically used NAK to describe a condition in which the datapacket is bad. This is why we have a "data symbol errors" "data symbols recovered" and "data symbols not fixable" on cable modem pages. I get non-recoverable data symbols a couple dozen times a day. TCP data packets contain a checksum to validate if the data is good or not. If there were not a recovery mechanism, then a lot of my apps would just crash. A lot of this stuff happens transparently. It happens point to point on a local level on the backbone.

Understand that these error correction protocols in no way guarantee your connection will not crap out. TCP/IP is not a guaranteed communication protocol. So in a sense you are correct. There's no guarantee that you will get a re-transmission of said data packet. This is handled by the hardware as the data is reformed. But this is getting down into the weeds of it.

 

[failboat]

So I have one final question if it seems that its on my ISP's end and you said my community is oversubscribed. I have a few friends all within a square mile area. Would they be close enough to be on my same "line" or by neighbors/ line would it have to be someone on my street?

If the ISP had congestion on their side then other people would have the same issues. Most of the time they don't have bottlenecks in the last mile. They might oversell really high speed plans and then a bunch of people start downloading + a ton of people watching videos. If they fully utilize their contracts to outside networks then everyone on that ISP would get bufferbloat on that line.

For testing have you tried multiple computers and also are you monitoring your network traffic while you test? You need to rule out your computer as the issue. Using a live boot ubuntu would rule out software side of your pc if you can't test from another pc. If you had malware it could be on all your windows machines.