Virgin Media Community

[ZHackH]

Hey goslow

The cables have been changed 3 times. Twice by myself and once by VM. Also a change in router which bought me a few days before the disconnect started again relentlessly. My Console, never moved. neither did either router and the cables being brand new...

Coupled with the admission from my neighbours wife and my experience as a gamer, I'm pretty certain the intention is malicious.

That aside, when the next attack happens what should I do. Check the BQM or post a setting/result found within the router.

So much respect and appreciation for taking the time.

[goslow]

---

@ZHackH wrote:

Hey goslow

The cables have been changed 3 times. Twice by myself and once by VM. Also a change in router which bought me a few days before the disconnect started again relentlessly. My Console, never moved. neither did either router and the cables being brand new...

<snip>

---

If that is so, I'd suggest that your VM connection needs further investigation based on the upstream stat's and the entries in the network log. Read the info here

https://community.virginmedia.com/t5/Speed/Hub-status-data-understanding-network-log-messages/td-p/4...

on 'RCS Partial Service' and T3 timeouts which appear in your network logs. You also have the 1970 date stamp in your network log which is also mentioned in the help topic in regard to noise issues. Is that all of your network log or have you edited the contents? There is not much in it if that's everything in it from end of November.

I don't think you are being attacked by your neighbour (or have been). I think you have a connection issue.

If VM has swapped your hub, I would expect your new hub would get a different IP address so any previous attack (if there ever was one) would be on the old IP address and your neighbour would not know the new one for a new hub.

In addition, just before Xmas, I had to look at the connection of a friend who was experiencing numerous disconnections and requiring a regular reboot of the hub. His upstream stat's were the same as yours (one channel on 16 QAM). VM swapped the hub, various cables and splitters and the problem went away but the upstream error still showed in his hub stat's. My friend is certainly not a gamer (web browsing only) and I guess VM's changes made sufficient improvement for him but without actually curing the problem. Gaming requires a good upstream and downstream connection so I am guessing that this is why you are experiencing the problem on your console.

If you have got the BQM running, just let it do its thing and let it run through a period when you experience the issue and the BQM should capture the disconnection (if it is your VM connection which is being affected).

You'll need some of the regular tech experts on here to advise further once you have a BQM to look at as well, alongside the hub stat's. They'll be able to add to (or correct!) what I have already suggested about your issue. Once you have got some BQM data crossing a time period in which you are disconnected, post that BQM graph for further comment and suggestions.

[legacy1]

You sure no one playing about with the coax for your connection?

[ZHackH]

It happened again today twice between 11 ant 12:30 but on my console. Is there a way to monitor the targeted device.

[goslow]

---

@ZHackH wrote:

It happened again today twice between 11 ant 12:30 but on my console. Is there a way to monitor the targeted device.

---

Your BQM is showing a small amount of packet loss at approx 00:00, 08:45 and 11:00 today (this is to your VM hub, not individually to your console).

Post up another set of your Downstream, Upstream and Network Logs.

You'll then need someone on here to comment who has a good knowledge of the stat's and the BQM graphs to advise if the info gives any clues as to whether they are the cause of the disconnections on your console.

[ZHackH]

This is obviously several hours after the loss of service so I'm not sure how relevant but as you asked.

Downstream bonded channels

Channel Frequency (Hz) Power (dBmV) SNR (dB) Modulation Channel ID

1	259000000	5.6	38	256 qam	16
2	251000000	5.5	38	256 qam	15
3	267000000	6.1	38	256 qam	17
4	275000000	6	38	256 qam	18
5	283000000	6	38	256 qam	19
6	291000000	6.1	38	256 qam	20
7	299000000	6	38	256 qam	21
8	307000000	5.5	38	256 qam	22
9	315000000	5.9	38	256 qam	23
10	323000000	5.8	37	256 qam	24
11	331000000	5.5	38	256 qam	25
12	339000000	6	37	256 qam	26
13	347000000	5.8	38	256 qam	27
14	355000000	5.4	38	256 qam	28
15	363000000	5.4	38	256 qam	29
16	371000000	4.6	37	256 qam	30
17	379000000	3.9	37	256 qam	31
18	387000000	4.1	37	256 qam	32
19	395000000	4.3	37	256 qam	33
20	403000000	4	38	256 qam	34
21	411000000	4.4	37	256 qam	35
22	419000000	4.5	38	256 qam	36
23	523000000	2.4	37	256 qam	37
24	531000000	2	37	256 qam	38

Downstream bonded channels

Channel Locked Status RxMER (dB) Pre RS Errors Post RS Errors

1	Locked	38.6	16	0
2	Locked	38.6	12	0
3	Locked	38.6	6	0
4	Locked	38.9	8	0
5	Locked	38.6	6	0
6	Locked	38.9	5	0
7	Locked	38.6	5	0
8	Locked	38.6	7	0
9	Locked	38.6	7	0
10	Locked	37.6	7	0
11	Locked	38.6	1	0
12	Locked	37.6	5	0
13	Locked	38.6	5	0
14	Locked	38.6	8	0
15	Locked	38.6	5	0
16	Locked	37.6	15	0
17	Locked	37.3	2	0
18	Locked	37.6	5	0
19	Locked	37.6	5	0
20	Locked	38.6	2	0
21	Locked	37.6	8	0
22	Locked	38.6	10	0
23	Locked	37.3	351	0
24	Locked	37.6	450	0

Upstream bonded channels

Channel Frequency (Hz) Power (dBmV) Symbol Rate (ksps) Modulation Channel ID

1	30100005	37.5	5120	64 qam	4
2	23600203	37.3	5120	16 qam	5
3	49600268	38	5120	64 qam	1
4	43099927	37.8	5120	64 qam	2
5	36600044	37.8	5120	64 qam	3

Upstream bonded channels

Channel Channel Type T1 Timeouts T2 Timeouts T3 Timeouts T4 Timeouts

1	ATDMA	0	0	0	0
2	ATDMA	0	0	0	0
3	ATDMA	0	0	0	0
4	ATDMA	0	0	0	0
5	ATDMA	0	0	0	0

[goslow]

---

@ZHackH wrote:

This is obviously several hours after the loss of service so I'm not sure how relevant but as you asked.

---

Just seeking to confirm your stat's are unchanged since yesterday. You still have 16 QAM on one of your upstream channels and it looks as if your hub has restarted since yesterday as well.

Post up your full 'Network Log' to see what is recorded when you experienced the disconnections today at 08:45, 11:00 and 12:00. Post the full log, don't edit bits out of it.

After that I'll have reached the limit of my tech skills to try to help further but others on here should be able to put the pieces together and advise on what is going on.

My thinking is along the lines that you are getting some sort of short disconnections which are knocking your console offline during gaming but without affecting your other online activities.

I am surprised no one else has dived in here with further info/advice. It's all very interesting, unusual neighbour behaviour, threats of internet tampering, one device being knocked offline ... wish I knew more about the tech side to join the dots for you.

[Andrew-G]

ZhackH: What's the BQM tracking?  It doesn't look like a Virgin Media connection, which looks like this:

I must say I'm with goslow here - never attribute to malice that which can be attributed to other stuff.  As noted your upstream modulation looks unreliable which could cause problems for a latency sensitive uses, but also notice the downstream pre-RS errors show a dodgy pattern.  Pre-RS errors don't actually cause a problem as they're corrected by the hub, but assuming from the numbers of errors on other channels that you rebooted the hub recently, then the pre-RS counts on the highest channels might be accompanied over time by post-RS errors, and they certainly will cause issues unless at very low levels.

The other thought is, is the problem connection over wifi?  There's lots of things (esp in terraced houses) that can cause momentary loss of a wifi connection.  As one example of many, any recent Panasonic microwave is a very effective wifi-denial weapon. 

[Client62]

The folks next door affecting the connection is a exceedingly remote chance, they would have to figure
out your IP address and a DOS attack would raise a huge range of red flags to VM's platform monitoring,
a DDOS attack is a costly thing to perform. 

So turning to the Hub logs, there is 1 noise degraded channel at 16 qam
and then there are 4 normal channels at 64 qam.

If we ignore the 1 degraded channel, the 4 x 64 qam channel represent a total of 108Mb/s of upstream bandwidth,
that could be over 3 times the Upstream subscription rate. The reason for having 5 channels is to be a bit more
robust there there is a noise issue.

[ZHackH]

Hey Goslow

I did disconnect my router for about 20 minutes this morning. I do that in attempts to change the ip and the only other bit of help I recieved. The network logs do not show any other entries beyond the ones I posted earlier. As for the BQM, the disconnects happened between 11:30 -12:30. I myself took the router offline.

@Andrew
The BQM is tracking my router. I'm using a VPN. The attack as we call it is device specific. It targets the console and knocks me offline. The console is unmoved, untouched apart from a duster. IF you're seeing something one the BQM that doesn't make sense please share. I am using the router / Lan connection with my console.

@client
I'm almost ashamed to say that I don't get what a noise issue is

I'd like to add this nugget of info. Before the attacks started, they'd always follow my neighbour rubbing up against the wall. My wife who was initially skeptical and wanted to rationalise it as something else, saw/heard the pattern. I could game, right up until, my neighbour starts caressing the wall. After that stopped, you could set your watch to it. The disconnects would start. And I understand that the chances are remote but seeing it in practice is a different thing. I say that with every ouce of all due respect.

The disconnects happen on the console only. I'm guessing latency and buffering make streaming/tv less of a target. They knock the console off and immediately reconnect as seen in the link in my opening post.

That being said, is there a way to monitor the console as a device or will the BQM capture everything. Also and equally as important. Are there settings I can change in the modem to make DDOS/DOS attacks less successful?

As always I really appreciate the help and guidance. I'm sure this can reach a successful conclusion. So again, thanks.