cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

1.6Gbit connection new smart hub (white, small box) sporadic issues? DNS MITM?

allamavortex
Established Contributor
Established Contributor

Hello all,

So I recently changed my service from 900mbit to 1.6Gbit and that involved a change of router and obviously the OR ONT on the wall.

Ever since having it installed there seems to be an issue with (most likely DNS issues). Whatever is loaded/playing/game continue to work, but I have spells where NO further DNS requests seem to make it through.

I totally forgot to nslookup during one of these issues, but I will the next time it happens (it's pretty frequent and annoying). I can ping 8.8.8.8 (google) whilst being unable to load any webpages on any device/browser. Thus removing the possibility of it being localised to a single machine/device as some were using the router, some were set to DNS over HTTPS and some were using Google's 8.8.8.8 etc. 

It is very much like the router is playing the MITM and intercepting the requests and then slowly, or failing to process these requests at all for a period of time which ranges up to about 45 seconds.

As I said, cached requests, or those already in process are fine, but even something as trivial as trying to watch a YT video is met with 45 seconds of nothing, totally unable to look up ANY address, but established connections and new connections not requiring DNS all work fine.

I'm not really one for conspiracies but I really feel like this new router is intercepting (MITM), attempting to do something with, and failing the DNS requests. This behaviour is only been present since getting the new Smart Hub (the tall, thing white one).

I did a quick google and it seems I'm not alone with this - is anyone else noticing this type of behavior?

Mixture of wired and wireless devices, same behaviour.

368 REPLIES 368
rainman2871
Established Contributor
Established Contributor

But then again I swapped from BT to EE . This year June 9th so either my info is not correct or yours is not correct ? anyway mate thanks for letting me know

rainman2871
Established Contributor
Established Contributor

So if that is the case the issues would of happened back in Feb so nothing has been fixed since then doesn't seem right or a lot customers didn't notice this. which Im sure they would of done if they were using there devices wireless or hard wired I noticed the issues  first week of activation of service when I was connected back in June 2 months ago .  Andy from EE  Tech support is phoning me this Friday will state this again with firmware issues and mention theres been no firmware fixes in 6 months and  if that's case EE are in a spot of bother and this service is poor with the issues we are experiencing so Customers are in the right to cancel there contract due to this ??.

TraderTravel
Established Contributor
Established Contributor

@bobpullen You have prompted me to run the script now.

My key concern about that script is that it literally does a DNS resolution again the router and 1.1.1.1 and then does a ping test. Ideally I would also want to monitor other packets to the internet beyond a ping. I might have a go of pulling a web page or something later when I have a little time.

I am definitely still seeing drop outs at random times in the day, but it is not something that happens all throughout the day at regular intervals.

edit: I've updated the script to add a webpage pull so that is tested too.:)

TraderTravel
Established Contributor
Established Contributor

@bobpullen I've had my adjusted version of the script running for the last 1.5 hours. I've noticed that the pings to the router (EE Hub) seem to have a hiccup every 30+ mins. Pings go from 0ms up to 87ms, which is obviously when the router has a little bit of a turn. This largely coincides with ping delay to the BBC website too (going from 2ms to sometimes over 100ms). That said, I so far don't see actual packet loss which is a positive. Interestingly it does not impact my web request for the BBC website.

I'm not sure if you see what I see from your end.

 

# Path to log file
$LogFile = "network_monitor.log"

# Running averages
$global:AvgPingBBC = $null
$global:AvgPingRouter = $null
$global:PingCountBBC = 0
$global:PingCountRouter = 0

function Update-Average {
param([ref]$CurrentAvg, [ref]$Count, [double]$NewValue)
if ($null -eq $CurrentAvg.Value) {
$CurrentAvg.Value = $NewValue
$Count.Value = 1
} else {
$Count.Value++
$CurrentAvg.Value = (($CurrentAvg.Value * ($Count.Value - 1)) + $NewValue) / $Count.Value
}
}

function Get-Color {
param(
[bool]$StatusOk,
[double]$Ping,
[double]$AvgPing,
[int]$LossPercent
)

if (-not $StatusOk) { return "Red" }
if ($LossPercent -ge 50) { return "Red" }
if ($Ping -gt ($AvgPing * 1.5)) { return "Red" }
if ($LossPercent -gt 0) { return "Yellow" }
if ($Ping -gt $AvgPing) { return "Yellow" }
return "Green"
}

Write-Host "Monitoring started... press Ctrl+C to stop."

while ($true) {
$timestamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
$jobs = @()

# DNS resolution checks
$jobs += Start-Job -ScriptBlock {
try {
Resolve-DnsName -Name "bbc.co.uk" -Server "192.168.1.254" -ErrorAction Stop | Out-Null
$true
} catch { $false }
}
$jobs += Start-Job -ScriptBlock {
try {
Resolve-DnsName -Name "bbc.co.uk" -Server "1.1.1.1" -ErrorAction Stop | Out-Null
$true
} catch { $false }
}
$jobs += Start-Job -ScriptBlock {
try {
Resolve-DnsName -Name "bbc.co.uk" -Server "192.168.1.1" -ErrorAction Stop | Out-Null
$true
} catch { $false }
}

# Ping checks
$jobs += Start-Job -ScriptBlock {
$count = 4
$ping = Test-Connection -ComputerName "bbc.co.uk" -Count $count -ErrorAction SilentlyContinue
if ($ping) {
$avg = [math]::Round(($ping | Measure-Object -Property ResponseTime -Average).Average, 2)
$loss = [math]::Round((($count - $ping.Count) / $count) * 100, 0)
@{ Avg = $avg; Loss = $loss }
} else { @{ Avg = $null; Loss = 100 } }
}
$jobs += Start-Job -ScriptBlock {
$count = 4
$ping = Test-Connection -ComputerName "192.168.1.254" -Count $count -ErrorAction SilentlyContinue
if ($ping) {
$avg = [math]::Round(($ping | Measure-Object -Property ResponseTime -Average).Average, 2)
$loss = [math]::Round((($count - $ping.Count) / $count) * 100, 0)
@{ Avg = $avg; Loss = $loss }
} else { @{ Avg = $null; Loss = 100 } }
}

# Web page test
$jobs += Start-Job -ScriptBlock {
$url = "https://www.bbc.co.uk"
$sw = [System.Diagnostics.Stopwatch]::StartNew()
try {
$response = Invoke-WebRequest -Uri $url -UseBasicParsing -TimeoutSec 10
$sw.Stop()
@{ Success = $true; TimeMs = [math]::Round($sw.Elapsed.TotalMilliseconds, 2) }
} catch {
$sw.Stop()
@{ Success = $false; TimeMs = $sw.Elapsed.TotalMilliseconds }
}
}

Wait-Job $jobs | Out-Null

$results = foreach ($job in $jobs) {
try { Receive-Job $job -ErrorAction Stop } catch { $null } finally { Remove-Job $job -Force }
}

$dns1Ok = $results[0]
$dns2Ok = $results[1]
$dnsPiOk = $results[2]
$pingBBC = $results[3]
$pingRouter = $results[4]
$webTest = $results[5]

if ($pingBBC.Avg -ne $null) { Update-Average ([ref]$global:AvgPingBBC) ([ref]$global:PingCountBBC) $pingBBC.Avg }
if ($pingRouter.Avg -ne $null) { Update-Average ([ref]$global:AvgPingRouter) ([ref]$global:PingCountRouter) $pingRouter.Avg }

# Determine colors
$colorDns1 = if ($dns1Ok) { "Green" } else { "Red" }
$colorDns2 = if ($dns2Ok) { "Green" } else { "Red" }
$colorDnsPi = if ($dnsPiOk) { "Green" } else { "Red" }
$colorPingBBC = Get-Color -StatusOk $dns1Ok -Ping $pingBBC.Avg -AvgPing $global:AvgPingBBC -LossPercent $pingBBC.Loss
$colorPingRouter = Get-Color -StatusOk $dns2Ok -Ping $pingRouter.Avg -AvgPing $global:AvgPingRouter -LossPercent $pingRouter.Loss
$colorWebTest = if (-not $webTest.Success) { "Red" }
elseif ($webTest.TimeMs -gt 1500) { "Yellow" }
else { "Green" }

# Compose output strings
$consoleOutput = @(
"$timestamp | DNS(192.168.1.254)=",
$dns1Ok,
" | DNS(1.1.1.1)=",
$dns2Ok,
" | DNS(192.168.1.1)=",
$dnsPiOk,
" | PingBBC=",
"$($pingBBC.Avg) ms (loss=$($pingBBC.Loss)%, avg=$([math]::Round($global:AvgPingBBC,2)))",
" | PingRouter=",
"$($pingRouter.Avg) ms (loss=$($pingRouter.Loss)%, avg=$([math]::Round($global:AvgPingRouter,2)))",
" | WebTest=",
"$($webTest.TimeMs) ms (success=$($webTest.Success))"
)

# Print colored console output
Write-Host $consoleOutput[0] -NoNewline
Write-Host $consoleOutput[1] -ForegroundColor $colorDns1 -NoNewline
Write-Host $consoleOutput[2] -NoNewline
Write-Host $consoleOutput[3] -ForegroundColor $colorDns2 -NoNewline
Write-Host $consoleOutput[4] -NoNewline
Write-Host $consoleOutput[5] -ForegroundColor $colorDnsPi -NoNewline
Write-Host $consoleOutput[6] -NoNewline
Write-Host $consoleOutput[7] -ForegroundColor $colorPingBBC -NoNewline
Write-Host $consoleOutput[8] -NoNewline
Write-Host $consoleOutput[9] -ForegroundColor $colorPingRouter -NoNewline
Write-Host $consoleOutput[10] -NoNewline
Write-Host $consoleOutput[11] -ForegroundColor $colorWebTest

# Decide if logging is needed
$logCondition = -not $dns1Ok -or -not $dns2Ok -or -not $dnsPiOk `
-or ($colorPingBBC -ne "Green") `
-or ($colorPingRouter -ne "Green") `
-or (-not $webTest.Success) `
-or ($webTest.TimeMs -gt 1500)

if ($logCondition) {
$line = "$timestamp | DNS(192.168.1.254)=$dns1Ok | DNS(1.1.1.1)=$dns2Ok | DNS(192.168.1.1)=$dnsPiOk | " +
"PingBBC=$($pingBBC.Avg) ms (loss=$($pingBBC.Loss)%, avg=$([math]::Round($global:AvgPingBBC,2))) | " +
"PingRouter=$($pingRouter.Avg) ms (loss=$($pingRouter.Loss)%, avg=$([math]::Round($global:AvgPingRouter,2))) | " +
"WebTest=$($webTest.TimeMs) ms (success=$($webTest.Success))"
Add-Content -Path $LogFile -Value $line
}

Start-Sleep -Seconds 15
}

 

@TraderTravel - great minds! I'd already modified my version to also include an Invoke-WebRequest or two (I used one to bt.com and one to the Hub Manager at the local 192.168.1.254 address).

I'd have to revisit my results but I hadn't noticed any ping spikes at routine intervals. I've left the script running at one location for now, so will have a good chunk of results in a day or two.

Ewan15
Expert Contributor
Expert Contributor

@TraderTravel @bobpullen I have set this script running on my network as well

To phone EE CS: Dial Freephone +44 800 079 8586 - Option 1 for Home Broadband & Home Phone or Option 2 for Mobile Phone & Mobile Broadband.
bobpullen
Star Contributor
Star Contributor

@Ewan15 thanks. Just checked in on my results from overnight and nothing untoward at a glance. No DNS failures and pings to hub consistently below a few milliseconds at worst.

TraderTravel
Established Contributor
Established Contributor

I stopped running the script last night (as I did not want to leave my desktop switched on). Again my read of the log output is that when the router has a bit of a turn (approx every 30 mins or so - it is not consistent) and we get both a delay on the ping to the EE router (192.168.1.254), we also get a delay to the ping on an external website (e.g. BBC). I don't see a delay with web requests (to BBC) however which correspond to this.

What is very  odd is that this morning I fired up the script again, and my web requests have gone from around 420 ms, to under 180ms. This however I don't think is related to all the issues that have been raised in this thread. In fact I can't think of why web requests (i.e. latency) to a major public website (BBC) have gone down by well over 50%. I literally have no good explanation around why this has happened... Did BT/EE have a routing issue yesterday on their networks? Did the BBC have issues with their servers? Considering in reality I am probably hitting a Cloudflare cache, I am very confused at this result.

Regardless I will keep this script up today. I might even add a few additions to check a few other things. Keen to hear what others are experiencing.

TraderTravel
Established Contributor
Established Contributor

I've done a little more testing and sadly there have been some failures:

2025-08-14 09:39:57 | DNS(192.168.1.254)=True | DNS(1.1.1.1)=True | DNS(192.168.1.1)=True | PingBBC=0 ms (loss=0%, avg=0) | PingRouter=0 ms (loss=0%, avg=0) | WebTest=171.9 ms (success=True)
2025-08-14 09:40:16 | DNS(192.168.1.254)=False | DNS(1.1.1.1)=False | DNS(192.168.1.1)=True | PingBBC=0 ms (loss=0%, avg=0) | PingRouter=0 ms (loss=0%, avg=0) | WebTest=10046.477 ms (success=False)
2025-08-14 09:40:42 | DNS(192.168.1.254)=False | DNS(1.1.1.1)=False | DNS(192.168.1.1)=True | PingBBC=0 ms (loss=0%, avg=0) | PingRouter=0 ms (loss=0%, avg=0) | WebTest=10045.7031 ms (success=False)

2025-08-14 10:10:25 | DNS(192.168.1.254)=False | DNS(1.1.1.1)=False | DNS(192.168.1.1)=True | PingBBC=0 ms (loss=0%, avg=0) | PingRouter=0 ms (loss=0%, avg=0) | WebTest=10047.1271 ms (success=False)
2025-08-14 10:10:52 | DNS(192.168.1.254)=True | DNS(1.1.1.1)=True | DNS(192.168.1.1)=True | PingBBC=0 ms (loss=0%, avg=0) | PingRouter=0 ms (loss=0%, avg=0) | WebTest=165.68 ms (success=True)
2025-08-14 10:11:11 | DNS(192.168.1.254)=False | DNS(1.1.1.1)=False | DNS(192.168.1.1)=True | PingBBC=0 ms (loss=0%, avg=0) | PingRouter=0 ms (loss=0%, avg=0) | WebTest=10045.1636 ms (success=False)

2025-08-14 10:16:25 | DNS(192.168.1.254)=True | DNS(1.1.1.1)=True | DNS(192.168.1.1)=True | PingBBC=0 ms (loss=0%, avg=0) | PingRouter=0 ms (loss=0%, avg=0) | WebTest=167.06 ms (success=True)
2025-08-14 10:16:44 | DNS(192.168.1.254)=False | DNS(1.1.1.1)=False | DNS(192.168.1.1)=True | PingBBC=0 ms (loss=0%, avg=0) | PingRouter=0 ms (loss=0%, avg=0) | WebTest=10051.6177 ms (success=False)
2025-08-14 10:17:10 | DNS(192.168.1.254)=True | DNS(1.1.1.1)=True | DNS(192.168.1.1)=True | PingBBC=0 ms (loss=0%, avg=0) | PingRouter=0 ms (loss=0%, avg=0) | WebTest=165.61 ms (success=True)

2025-08-14 10:28:30 | DNS(192.168.1.254)=False | DNS(1.1.1.1)=False | DNS(192.168.1.1)=True | PingBBC=0 ms (loss=0%, avg=0) | PingRouter=0 ms (loss=0%, avg=0) | WebTest=10051.6645 ms (success=False)
2025-08-14 10:28:57 | DNS(192.168.1.254)=False | DNS(1.1.1.1)=False | DNS(192.168.1.1)=True | PingBBC=0 ms (loss=0%, avg=0) | PingRouter=0 ms (loss=0%, avg=0) | WebTest=10050.4913 ms (success=False)
2025-08-14 10:29:23 | DNS(192.168.1.254)=True | DNS(1.1.1.1)=True | DNS(192.168.1.1)=True | PingBBC=0 ms (loss=0%, avg=0) | PingRouter=0 ms (loss=0%, avg=0) | WebTest=170.06 ms (success=True)

2025-08-14 11:36:24 | DNS(192.168.1.254)=True | DNS(1.1.1.1)=True | DNS(192.168.1.1)=True | PingBBC=0 ms (loss=0%, avg=0) | PingRouter=0 ms (loss=0%, avg=0) | WebTest=172.99 ms (success=True)
2025-08-14 11:36:43 | DNS(192.168.1.254)=False | DNS(1.1.1.1)=False | DNS(192.168.1.1)=True | PingBBC=0 ms (loss=0%, avg=0) | PingRouter=0 ms (loss=0%, avg=0) | WebTest=10048.3288 ms (success=False)
2025-08-14 11:37:09 | DNS(192.168.1.254)=True | DNS(1.1.1.1)=True | DNS(192.168.1.1)=True | PingBBC=0 ms (loss=0%, avg=0) | PingRouter=0 ms (loss=0%, avg=0) | WebTest=165.08 ms (success=True)

2025-08-14 11:52:53 | DNS(192.168.1.254)=True | DNS(1.1.1.1)=True | DNS(192.168.1.1)=True | PingBBC=0 ms (loss=0%, avg=0) | PingRouter=0 ms (loss=0%, avg=0) | WebTest=175.21 ms (success=True)
2025-08-14 11:53:12 | DNS(192.168.1.254)=False | DNS(1.1.1.1)=True | DNS(192.168.1.1)=True | PingBBC=0 ms (loss=0%, avg=0) | PingRouter=0 ms (loss=0%, avg=0) | WebTest=10043.4786 ms (success=False)
2025-08-14 11:53:39 | DNS(192.168.1.254)=True | DNS(1.1.1.1)=True | DNS(192.168.1.1)=True | PingBBC=0 ms (loss=0%, avg=0) | PingRouter=0 ms (loss=0%, avg=0) | WebTest=170.6 ms (success=True)

2025-08-14 11:55:32 | DNS(192.168.1.254)=True | DNS(1.1.1.1)=True | DNS(192.168.1.1)=True | PingBBC=0 ms (loss=0%, avg=0) | PingRouter=0 ms (loss=0%, avg=0) | WebTest=177.65 ms (success=True)
2025-08-14 11:55:51 | DNS(192.168.1.254)=False | DNS(1.1.1.1)=False | DNS(192.168.1.1)=True | PingBBC=0 ms (loss=0%, avg=0) | PingRouter=0 ms (loss=0%, avg=0) | WebTest=10054.9042 ms (success=False)
2025-08-14 11:56:17 | DNS(192.168.1.254)=True | DNS(1.1.1.1)=True | DNS(192.168.1.1)=True | PingBBC=0 ms (loss=0%, avg=0) | PingRouter=0 ms (loss=0%, avg=0) | WebTest=7189.64 ms (success=True)

2025-08-14 12:01:24 | DNS(192.168.1.254)=True | DNS(1.1.1.1)=True | DNS(192.168.1.1)=True | PingBBC=0 ms (loss=0%, avg=0) | PingRouter=0 ms (loss=0%, avg=0) | WebTest=170.98 ms (success=True)
2025-08-14 12:01:43 | DNS(192.168.1.254)=False | DNS(1.1.1.1)=False | DNS(192.168.1.1)=True | PingBBC=0 ms (loss=0%, avg=0) | PingRouter=0 ms (loss=0%, avg=0) | WebTest=10047.4417 ms (success=False)
2025-08-14 12:02:09 | DNS(192.168.1.254)=True | DNS(1.1.1.1)=True | DNS(192.168.1.1)=True | PingBBC=0 ms (loss=0%, avg=0) | PingRouter=0 ms (loss=0%, avg=0) | WebTest=175.06 ms (success=True)

2025-08-14 12:20:05 | DNS(192.168.1.254)=True | DNS(1.1.1.1)=True | DNS(192.168.1.1)=True | PingBBC=0 ms (loss=0%, avg=0) | PingRouter=0 ms (loss=0%, avg=0) | WebTest=171.08 ms (success=True)
2025-08-14 12:20:24 | DNS(192.168.1.254)=False | DNS(1.1.1.1)=True | DNS(192.168.1.1)=True | PingBBC=0 ms (loss=0%, avg=0) | PingRouter=0 ms (loss=0%, avg=0) | WebTest=10045.6056 ms (success=False)
2025-08-14 12:20:51 | DNS(192.168.1.254)=True | DNS(1.1.1.1)=True | DNS(192.168.1.1)=True | PingBBC=0 ms (loss=0%, avg=0) | PingRouter=0 ms (loss=0%, avg=0) | WebTest=176.02 ms (success=True)

rainman2871
Established Contributor
Established Contributor

The issues that customers are experiencing with DNS and slow webpage loading or freezing has anyone tried to use VPN  I just tried connecting my surfshark vpn seems to work ok I even rebooted my PC I connect to my vpn first then try numerous web pages all seems ok by passing any restriction from EE router. speed is  ok to using the wireguard protocol