Hello
Does anyone know why I'm starting to get some devices (CPE's) standing and use data without the user is on the unit.
And the when I turn WDS off from the CPE side and leave it enabled on the AP side, it falls to normal again.
Hope someone can shine som light on it
PLEASE READ DOWN THROUGH THIS THREAD FOR A TOOL TO HELP FIGURE THIS OUT!!! - SIRHC
UBNT (WDS) Need help - POSSIBLE TOOL TO HELP
-
Mola9850 - Member
- Posts: 78
- Joined: Thu Feb 19, 2015 3:47 pm
- Location: Denmark
- Has thanked: 14 times
- Been thanked: 14 times
UBNT (WDS) Need help - POSSIBLE TOOL TO HELP
- Attachments
-
- 1.png (106.27 KiB) Viewed 30494 times
-
- 2.png (90.68 KiB) Viewed 30494 times
Med venlig hilsen / Yours sincerely
Morten Lauritsen
Salg & Service
D: +45 9393 7040
M: [url=mailto:Morten@wified.dk]Morten@wified.dk[/url]
Morten Lauritsen
Salg & Service
D: +45 9393 7040
M: [url=mailto:Morten@wified.dk]Morten@wified.dk[/url]
-
rebelwireless - Experienced Member
- Posts: 607
- Joined: Mon Sep 01, 2014 1:46 pm
- Has thanked: 31 times
- Been thanked: 136 times
Re: UBNT (WDS) Need help
Hej Morten!
WDS preserves the MAC, so it's a layer2 link. non-WDS does not. Basically, the WDS will pass data that non-WDS just ignores or drops. I doubt this is the radio link, but probably something doing layer2 discovery.
WDS preserves the MAC, so it's a layer2 link. non-WDS does not. Basically, the WDS will pass data that non-WDS just ignores or drops. I doubt this is the radio link, but probably something doing layer2 discovery.
-
Mola9850 - Member
- Posts: 78
- Joined: Thu Feb 19, 2015 3:47 pm
- Location: Denmark
- Has thanked: 14 times
- Been thanked: 14 times
Re: UBNT (WDS) Need help
Hello Rebelwireless
thanks for your answer.
Just think that it is crazy that a device that is not being used can use up to 1.5 Mbps on doing nothing, and when I turn off WDS on the CPE side it falls to 30-50 kbit.
what would you do , just turn WDS off from the CPE side or just leave it and let it use data.
thanks for your answer.
Just think that it is crazy that a device that is not being used can use up to 1.5 Mbps on doing nothing, and when I turn off WDS on the CPE side it falls to 30-50 kbit.
what would you do , just turn WDS off from the CPE side or just leave it and let it use data.
Med venlig hilsen / Yours sincerely
Morten Lauritsen
Salg & Service
D: +45 9393 7040
M: [url=mailto:Morten@wified.dk]Morten@wified.dk[/url]
Morten Lauritsen
Salg & Service
D: +45 9393 7040
M: [url=mailto:Morten@wified.dk]Morten@wified.dk[/url]
-
rebelwireless - Experienced Member
- Posts: 607
- Joined: Mon Sep 01, 2014 1:46 pm
- Has thanked: 31 times
- Been thanked: 136 times
Re: UBNT (WDS) Need help
Mola9850 wrote:what would you do , just turn WDS off from the CPE side or just leave it and let it use data.
I would keep WDS on and figure out the source of that traffic. You can plug into the radio with a laptop and capture packets with wireshark. Then you can see whats going on.
-
mhoppes - Associate
- Posts: 664
- Joined: Thu Apr 10, 2014 9:14 pm
- Location: Pennsylvania
- Has thanked: 10 times
- Been thanked: 125 times
Re: UBNT (WDS) Need help
How do you know the device is not being used?
Could be a virus, update, some kind of network share.
Could be a virus, update, some kind of network share.
-
Mola9850 - Member
- Posts: 78
- Joined: Thu Feb 19, 2015 3:47 pm
- Location: Denmark
- Has thanked: 14 times
- Been thanked: 14 times
Re: UBNT (WDS) Need help
ok I'll try to take the data out whit wireshark
ty .
I know it is not use, i have to talk to the customer and can also see that the data output has changed, after i turn off WDS from the customer devices.
I don't hope it is a virus
ty .
I know it is not use, i have to talk to the customer and can also see that the data output has changed, after i turn off WDS from the customer devices.
I don't hope it is a virus
- Attachments
-
- Skærmbillede 2015-05-07 10.16.45.png (44.8 KiB) Viewed 30429 times
Med venlig hilsen / Yours sincerely
Morten Lauritsen
Salg & Service
D: +45 9393 7040
M: [url=mailto:Morten@wified.dk]Morten@wified.dk[/url]
Morten Lauritsen
Salg & Service
D: +45 9393 7040
M: [url=mailto:Morten@wified.dk]Morten@wified.dk[/url]
-
sirhc - Employee
- Posts: 7415
- Joined: Tue Apr 08, 2014 3:48 pm
- Location: Lancaster, PA
- Has thanked: 1608 times
- Been thanked: 1325 times
Would this tool help you Mola9850
Outline for our MIRROR port to IP which is a NEW feature we are developing in v1.3.0
1) These packets should be separate from other normal packets the switch is getting from the core including the following:
BPDU
RSTP
LOOP Protection
UI / CLI packets - DO NOT WANT THE CLI TO BECOME UNRESPONSIVE.
This stream should be limited as is at 1K pps to protect the CPU from loops or packet storms.
2) The other stream containing the MIRRORED packets should be limited by CPU ability meaning it should allow as many packets per second as it can up until the CPU becomes too loaded, say 90% utilization. When the CPU gets to 90% utilization it limits the pipe for the MIRROR.
3) Being able to then filter that MIRRORED stream based on IP or maybe even MAC - THAT WOULD BE FANTASTIC
Example of use:
A WISP sees weird behavior on a port feeding an AP that services 30+ customers so they mirror that port to their computer running WireShark to capture the stream (Yes Wireshark supports this)
The WISP then looks through the garbage looking for something of interest to a specific customer IP so they stop the MIRROR and then add an IP or MAC Filter and restart the MIRROR. Now they am able to determine that the customer is running a bittorrent, or maybe they must have a worm or something of that nature. Or in this case figure out what this strange amount of data is.
Being a WISP for 16 years I can tell you that this feature would be invaluable.
Another thing that would make this feature fast and convent is to mirror the packets to a window on the MIRROR tab negating the need for Wireshark for quick and dirty peaks without all the advanced features Wireshark provides to sort the data.
This is a PRIME EXAMPLE of where this function would be AWESOME.
If people think this feature is a great idea please comment in this thread.
1) These packets should be separate from other normal packets the switch is getting from the core including the following:
BPDU
RSTP
LOOP Protection
UI / CLI packets - DO NOT WANT THE CLI TO BECOME UNRESPONSIVE.
This stream should be limited as is at 1K pps to protect the CPU from loops or packet storms.
2) The other stream containing the MIRRORED packets should be limited by CPU ability meaning it should allow as many packets per second as it can up until the CPU becomes too loaded, say 90% utilization. When the CPU gets to 90% utilization it limits the pipe for the MIRROR.
3) Being able to then filter that MIRRORED stream based on IP or maybe even MAC - THAT WOULD BE FANTASTIC
Example of use:
A WISP sees weird behavior on a port feeding an AP that services 30+ customers so they mirror that port to their computer running WireShark to capture the stream (Yes Wireshark supports this)
The WISP then looks through the garbage looking for something of interest to a specific customer IP so they stop the MIRROR and then add an IP or MAC Filter and restart the MIRROR. Now they am able to determine that the customer is running a bittorrent, or maybe they must have a worm or something of that nature. Or in this case figure out what this strange amount of data is.
Being a WISP for 16 years I can tell you that this feature would be invaluable.
Another thing that would make this feature fast and convent is to mirror the packets to a window on the MIRROR tab negating the need for Wireshark for quick and dirty peaks without all the advanced features Wireshark provides to sort the data.
This is a PRIME EXAMPLE of where this function would be AWESOME.
If people think this feature is a great idea please comment in this thread.
Support is handled on the Forums not in Emails and PMs.
Before you ask a question use the Search function to see it has been answered before.
To do an Advanced Search click the magnifying glass in the Search Box.
To upload pictures click the Upload attachment link below the BLUE SUBMIT BUTTON.
Before you ask a question use the Search function to see it has been answered before.
To do an Advanced Search click the magnifying glass in the Search Box.
To upload pictures click the Upload attachment link below the BLUE SUBMIT BUTTON.
-
jjonsson - Associate
- Posts: 337
- Joined: Wed Nov 05, 2014 12:30 pm
- Location: Denmark
- Has thanked: 37 times
- Been thanked: 65 times
Re: UBNT (WDS) Need help
mhoppes wrote:How do you know the device is not being used?
Could be a virus, update, some kind of network share.
I could be a router/other network device infected with something. Looks like DDoS or similar....
-
Mola9850 - Member
- Posts: 78
- Joined: Thu Feb 19, 2015 3:47 pm
- Location: Denmark
- Has thanked: 14 times
- Been thanked: 14 times
Re: UBNT (WDS) Need help - POSSIBLE TOOL TO HELP
have tried to capture some data from one of the devices, but do not know if I'm doing it right or what to look for
- Attachments
-
- Skærmbillede 2015-05-12 20.05.01.png (221.89 KiB) Viewed 30352 times
Med venlig hilsen / Yours sincerely
Morten Lauritsen
Salg & Service
D: +45 9393 7040
M: [url=mailto:Morten@wified.dk]Morten@wified.dk[/url]
Morten Lauritsen
Salg & Service
D: +45 9393 7040
M: [url=mailto:Morten@wified.dk]Morten@wified.dk[/url]
-
Mola9850 - Member
- Posts: 78
- Joined: Thu Feb 19, 2015 3:47 pm
- Location: Denmark
- Has thanked: 14 times
- Been thanked: 14 times
Re: UBNT (WDS) Need help - POSSIBLE TOOL TO HELP
any one??
Med venlig hilsen / Yours sincerely
Morten Lauritsen
Salg & Service
D: +45 9393 7040
M: [url=mailto:Morten@wified.dk]Morten@wified.dk[/url]
Morten Lauritsen
Salg & Service
D: +45 9393 7040
M: [url=mailto:Morten@wified.dk]Morten@wified.dk[/url]
Who is online
Users browsing this forum: No registered users and 32 guests