NEED SOME HELP?

We’re here 24/7. 365 days a year.
Ask questions. Find your answers. Connect.

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

HG633 Router high ARP traffic, wearing out phone batteries

djjarvis
Popular Poster
Message 12 of 12

Hi all,

 

This is my first post, sorry it's a bit technical!

 

As per the subject, does anyone else experience a high volume of Address Resolution Protocol (ARP) traffic from their HG633 router?  Of course, you might be experiencing this but not notice or it doesn't affect you.  For me the symptoms are as follows:

 

  • Netgear GS108 switch connected to HG633 has all lamps flashing rapidly, even devices that are not being accessed.
  • HG633 wireless and ethernet lamps flashing constantly - this is less obvious because the lamps flash at a constant rate when there is network traffic, regardless of the level.
  • Phone batteries run down quicker - Android battery meter reports that "Android OS" kept the device awake for several hours.

 

I found that either of the following will stop this activity:

  • Disconnect all wi-fi devices (turn off wi-fi on phones, turn off other devices, etc)  When the last one is disconnected the ARP traffic stops.  Re-connecting to Wi-Fi and all is fine for a while.
  • Go into the HG633 router management page and make any change to Wi-Fi settings (turn beamforming on or off, QoS on or off) - this seems to reset the Wi-Fi and stop the ARP traffic for a while.

After a few hours though, it will enevitably start up again.

 

I used Wireshark to monitor the network and it showed that the ARP requests were coming from the HG633 and were only requesting the MAC address of Wireless clients.  ARP requests are broadcast to all devices, which explains the rapid flashing lamps on the GS108 switch.

 

I understand that home routers typically use ARP requests occasionally to confirm if devices are still there, so that they can update the list of connected devices in the router management page.  But in this case it seems to be an issue with Wi-Fi specifically.

 

I found the following posts that may be relevant:

Android battery drain with HG633 router

HG633 Super Router WiFi Errors Known Fault Slow Throughput - the Google cached version showed that it was the same issue, reported back in 2015!

 

I tried to chat with tech support but they said to log it with HUAWEI - that may be difficult as I'm not a direct customer of theirs.

 

Any ideas?

 

Thanks,

 

J

J
0 Likes
11 REPLIES 11

Message 1 of 12

Hi,

 

I've had this problem with that router for a long time (must be over a year now).  I think I had a Nexus 5X when I noticed the terrible battery drain just after changing to that router.  I've now got an LG V20 and that has the same issue.

 

Anyway, I'll try turning off 5GHz and seeing if that fixes it for me. Or, I think you're saying it's when a device moves from one to the other.  I have different SSID's so I guess I could make sure each device is only configured for one SID.  I'll just turn off 5GHz first to see what that does.

 

Useful post - thanks.

 

Peter.

Message 2 of 12

Hi Keith

 

Yes, it is probably not enough traffic to degrade the network performance, it is (was) just a annoyance, plus the battery draining issue.

 

Luckily I have solved the issue by process of elimination.

  1. Running with 5Ghz turned off for a whole weekend - no issue.
  2. Turned 5Ghz back on but with a separate SSID - no issue.
  3. Moved one device from 2.4Ghz to 5Ghz - within a minute or too - flashing lights everywhere!
    After I turned Wi-Fi on that device off and back on, the extra traffic stopped and did not return.
  4. Moved a second device from 2.4Ghz to 5Ghz - again within a minute or too, the extra ARP traffic began.
    This time I had to turn off Wi-Fi on both 5Ghz devices for it to stop.  Turning them both back on and the issue hasn't returned.

Conclusion: Devices moving between the 2 Wi-Fi bands seems to be a trigger for the behaviour, perhaps specifically from 2.4Ghz to 5Ghz.

 

Thanks for your time on this.

J
0 Likes

Message 3 of 12

Don't forget unless you are getting a minimum of 30 ARP frames per 100ms, then it is not a storm & need not be worried about.

Keith
I am not employed by TalkTalk, I'm just a customer. If my post has fixed the issue, please set Accept as Solution from the 3 dot menu.
TalkTalk support and Community Stars - Who are they? 

0 Likes

Message 4 of 12
Hi Keith,

Thanks for running that test. I suspect that what you've captured is the normal process of the router maintaining it's list of active devices. I presume you saw ARP requests for Ethernet connected devices as often as Wireless ones? Whereas I'm seeing a higher rate of ARP requests for wireless clients and not all the time.

Some things I'm going to try:
* Run a trace next time this happens and disconnect clients, see whether the router stops sending ARP requests for the disconnected device.

* Try a separate SSID for 5 GHz because for a few days I've had 5 GHz disabled entirely and haven't seen a recurrence of the issue. Therefore there is a chance that devices roaming between frequencies could be a trigger.

I've already switched the Wi-Fi on my android devices to turn off during "sleep" except when plugged in. So the battery drain is no longer an issue.
J
0 Likes

Message 5 of 12

I did tests on my HG633 & connected my PC via Ethernet & a couple of other wired devices, all showing as active in LAN Devices. I then started a trace and then disconnected the wireless devices.

 

I think that the HG633 uses ARP broadcasts to maintain its ARP cache, prior to “ageing out” old entries. The router can detect if a device is active or not within its LAN Devices display. However, this probably has no direct link to the ARP cache. The cache in most routers/APs removes inactive entries from its list after a configured period of time (often referred to as “ageing out”).

 

The devices that the router has seen as active within a certain time period are now checked to see if they are still present.

 

It does this I think, by sending out ARP requests to those devices. Each entry within the cache is then updated if a valid ARP Response is received. These responses are used to keep that device entry within the cache. Those that do not respond after a certain amount of time are removed from its cache.

 

It carried this on at a rate of about 2 frames per minute (I am guessing as you have a switch involved you will have a lot more devices connected than me).

Keith
I am not employed by TalkTalk, I'm just a customer. If my post has fixed the issue, please set Accept as Solution from the 3 dot menu.
TalkTalk support and Community Stars - Who are they? 

0 Likes

Message 6 of 12

After spending some hours on this I have an initial answer for you.

 

Is this an ARP storm then - well what amount of ARP frames constitutes a storm? The internet quotes a lot of varying figures. Some say over 500 frames per second, others say if there are 50 – 60 ARP frames per second that request the MAC addresses of each device on the subnet.

Wireshark has a configurable detection method for these, which default to 30 frames per 100ms, sort of equating to 300 per second. Probably the 30 frames per 100ms is the more likely threshold.

 

What are you getting in that trace, you are maxing out at just 33 ARP frames per second - so definitely not a storm or high level of them.

 

I do have a theory as to what in the HG633 is causing this low level of frames, but I need to test this out against an HG633 myself tomorrow.

 

So to your real problem - this is either a throughput issue or a mobile battery issue. If it is the latter, you could look to power management on the device's wireless adapters, but make sure updates etc can only be done via the Wi-Fi, otherwise you could be in for an unexpected bill for mobile data usage.

 

The problem with any device with an active Wi-Fi network adapter (does not need to be connected to anything) is that it must act upon a special Wi-Fi management frame called a "Beacon frame". The information contained within that frame allows your Wi-Fi adapter to add/keep your network(s) in the list of available Wi-Fi networks.

 

This is broadcast out to all active devices from your router/AP every 100ms by default (some APs allow this to be configurable. Then it also has to act upon all beacon frames for any other Wi-Fi network in range, each of those going out every 100ms too, but of course, they are not syncronised, so the device may have to deal with say ten or more such frames per 100ms.

 

 

Keith
I am not employed by TalkTalk, I'm just a customer. If my post has fixed the issue, please set Accept as Solution from the 3 dot menu.
TalkTalk support and Community Stars - Who are they? 

0 Likes

Message 7 of 12

I'll look at the trace today or tomorrow, time permitting.

 

Does your Netgear switch support Spanning Tree & if so, is it enabled?

Keith
I am not employed by TalkTalk, I'm just a customer. If my post has fixed the issue, please set Accept as Solution from the 3 dot menu.
TalkTalk support and Community Stars - Who are they? 

0 Likes

Message 8 of 12

Hi Keith

 

Google cache of the topic - see post from LeeTvr - this describes my issue exactly, although back in 2015 and presumably running older firmware.

 

I've attached my wireshark trace.  It's only a few seconds of capture but the ARP broadcasts loop round about 6 times per second.  The IPs it's requesting are all Wireless clients, none are ethernet.

J
0 Likes

Message 9 of 12

Hi @djjarvis

 

Prior to V2.00 the bug that I referred to caused loads of errors to falsly displayed with the HG633 Wi-Fi stats. The bug concerned how these were reported & nothing to do with your issue.

 

Tried that search & only 1 page looks likely, but I don't have the required access to view it & I have the top level of access a customer can have. It looks to be from 2015, so that can probably be discounted.

 

Alas, you can't send the trace in a PM, the best way is to rename the extension to PDF & attach it here. I'll download it, then once I have it I will delete it from your post ASAP & rename it back.

Keith
I am not employed by TalkTalk, I'm just a customer. If my post has fixed the issue, please set Accept as Solution from the 3 dot menu.
TalkTalk support and Community Stars - Who are they? 

0 Likes

Message 10 of 12

Hi Keith

 

When you say it was a bug that was fixed, do you mean the slow Wi-Fi performance?

 

I am indeed running firmware v2.00.  I have only been a broadband subscriber since December 2017 so maybe my router was supplied with that firmware already installed.

 

The post within the archived topic that caught my eye was from "LeeTvr".  It even mentions a Wireshark trace showing repeated ARP broadcasts to only the Wi-Fi clients.  Google search on "HG633 ARP Flood" (no quotes) will find it.

 

How shall I send you the Wireshark trace?  PM?

 

J

J
0 Likes

KeithFrench
Community Star
Message 11 of 12

The WiFi errors were nothing to do with ARP at all, it was simply a bug that has been subsequently fixed. You should be running the latest firmware V2.00.

 

To comment further I would need to see your Wireshark trace.

Keith
I am not employed by TalkTalk, I'm just a customer. If my post has fixed the issue, please set Accept as Solution from the 3 dot menu.
TalkTalk support and Community Stars - Who are they? 

0 Likes