14-08-2018 11:19 AM - edited 14-08-2018 03:33 PM
This is my first post, sorry it's a bit technical!
As per the subject, does anyone else experience a high volume of Address Resolution Protocol (ARP) traffic from their HG633 router? Of course, you might be experiencing this but not notice or it doesn't affect you. For me the symptoms are as follows:
I found that either of the following will stop this activity:
After a few hours though, it will enevitably start up again.
I used Wireshark to monitor the network and it showed that the ARP requests were coming from the HG633 and were only requesting the MAC address of Wireless clients. ARP requests are broadcast to all devices, which explains the rapid flashing lamps on the GS108 switch.
I understand that home routers typically use ARP requests occasionally to confirm if devices are still there, so that they can update the list of connected devices in the router management page. But in this case it seems to be an issue with Wi-Fi specifically.
I found the following posts that may be relevant:
HG633 Super Router WiFi Errors Known Fault Slow Throughput - the Google cached version showed that it was the same issue, reported back in 2015!
I tried to chat with tech support but they said to log it with HUAWEI - that may be difficult as I'm not a direct customer of theirs.
on 17-10-2018 02:52 PM
I've had this problem with that router for a long time (must be over a year now). I think I had a Nexus 5X when I noticed the terrible battery drain just after changing to that router. I've now got an LG V20 and that has the same issue.
Anyway, I'll try turning off 5GHz and seeing if that fixes it for me. Or, I think you're saying it's when a device moves from one to the other. I have different SSID's so I guess I could make sure each device is only configured for one SID. I'll just turn off 5GHz first to see what that does.
Useful post - thanks.
on 26-08-2018 12:47 PM
Yes, it is probably not enough traffic to degrade the network performance, it is (was) just a annoyance, plus the battery draining issue.
Luckily I have solved the issue by process of elimination.
Conclusion: Devices moving between the 2 Wi-Fi bands seems to be a trigger for the behaviour, perhaps specifically from 2.4Ghz to 5Ghz.
Thanks for your time on this.
on 20-08-2018 01:39 PM
Don't forget unless you are getting a minimum of 30 ARP frames per 100ms, then it is not a storm & need not be worried about.
on 20-08-2018 01:22 PM
17-08-2018 09:33 AM - edited 17-08-2018 10:21 AM
I did tests on my HG633 & connected my PC via Ethernet & a couple of other wired devices, all showing as active in LAN Devices. I then started a trace and then disconnected the wireless devices.
I think that the HG633 uses ARP broadcasts to maintain its ARP cache, prior to “ageing out” old entries. The router can detect if a device is active or not within its LAN Devices display. However, this probably has no direct link to the ARP cache. The cache in most routers/APs removes inactive entries from its list after a configured period of time (often referred to as “ageing out”).
The devices that the router has seen as active within a certain time period are now checked to see if they are still present.
It does this I think, by sending out ARP requests to those devices. Each entry within the cache is then updated if a valid ARP Response is received. These responses are used to keep that device entry within the cache. Those that do not respond after a certain amount of time are removed from its cache.
It carried this on at a rate of about 2 frames per minute (I am guessing as you have a switch involved you will have a lot more devices connected than me).
on 16-08-2018 01:30 PM
After spending some hours on this I have an initial answer for you.
Is this an ARP storm then - well what amount of ARP frames constitutes a storm? The internet quotes a lot of varying figures. Some say over 500 frames per second, others say if there are 50 – 60 ARP frames per second that request the MAC addresses of each device on the subnet.
Wireshark has a configurable detection method for these, which default to 30 frames per 100ms, sort of equating to 300 per second. Probably the 30 frames per 100ms is the more likely threshold.
What are you getting in that trace, you are maxing out at just 33 ARP frames per second - so definitely not a storm or high level of them.
I do have a theory as to what in the HG633 is causing this low level of frames, but I need to test this out against an HG633 myself tomorrow.
So to your real problem - this is either a throughput issue or a mobile battery issue. If it is the latter, you could look to power management on the device's wireless adapters, but make sure updates etc can only be done via the Wi-Fi, otherwise you could be in for an unexpected bill for mobile data usage.
The problem with any device with an active Wi-Fi network adapter (does not need to be connected to anything) is that it must act upon a special Wi-Fi management frame called a "Beacon frame". The information contained within that frame allows your Wi-Fi adapter to add/keep your network(s) in the list of available Wi-Fi networks.
This is broadcast out to all active devices from your router/AP every 100ms by default (some APs allow this to be configurable. Then it also has to act upon all beacon frames for any other Wi-Fi network in range, each of those going out every 100ms too, but of course, they are not syncronised, so the device may have to deal with say ten or more such frames per 100ms.
on 16-08-2018 08:50 AM
I'll look at the trace today or tomorrow, time permitting.
Does your Netgear switch support Spanning Tree & if so, is it enabled?
on 15-08-2018 10:30 PM - last edited on 16-08-2018 08:44 AM by KeithFrench
Google cache of the topic - see post from LeeTvr - this describes my issue exactly, although back in 2015 and presumably running older firmware.
I've attached my wireshark trace. It's only a few seconds of capture but the ARP broadcasts loop round about 6 times per second. The IPs it's requesting are all Wireless clients, none are ethernet.
on 15-08-2018 03:24 PM
Prior to V2.00 the bug that I referred to caused loads of errors to falsly displayed with the HG633 Wi-Fi stats. The bug concerned how these were reported & nothing to do with your issue.
Tried that search & only 1 page looks likely, but I don't have the required access to view it & I have the top level of access a customer can have. It looks to be from 2015, so that can probably be discounted.
Alas, you can't send the trace in a PM, the best way is to rename the extension to PDF & attach it here. I'll download it, then once I have it I will delete it from your post ASAP & rename it back.
on 15-08-2018 03:12 PM
When you say it was a bug that was fixed, do you mean the slow Wi-Fi performance?
I am indeed running firmware v2.00. I have only been a broadband subscriber since December 2017 so maybe my router was supplied with that firmware already installed.
The post within the archived topic that caught my eye was from "LeeTvr". It even mentions a Wireshark trace showing repeated ARP broadcasts to only the Wi-Fi clients. Google search on "HG633 ARP Flood" (no quotes) will find it.
How shall I send you the Wireshark trace? PM?
on 15-08-2018 10:01 AM
The WiFi errors were nothing to do with ARP at all, it was simply a bug that has been subsequently fixed. You should be running the latest firmware V2.00.
To comment further I would need to see your Wireshark trace.