Is my outage inside or out?

[lairdb]

I'm having trouble diagnosing an outage, because it's intermittent and lasts only a few seconds to a couple of minutes; very hard to catch and troubleshoot, and nothing on-prem shows errors in the logs after the fact.

The tracker reports it as "inside" most of the time... but it reports the address of the first outside hop, which makes me not entirely confident. ("How do it know?")

Here's the topology: It's a double-NAT; the tracer agent is running on a 24x7 windows PC; this tracert was run from there:

Tracing route to dns.google [8.8.8.8]
over a maximum of 30 hops:

  1    <1 ms     1 ms    <1 ms  www.asusrouter.com [192.168.222.1]
  2     2 ms    <1 ms    <1 ms  192.168.111.1
  3    98 ms   405 ms    22 ms  int-1.sndgcaxt03m.netops.charter.com [142.254.184.109]
  4   214 ms   275 ms   416 ms  lag-61.sndgcaxt02h.netops.charter.com [76.167.27.205]
  5   871 ms   177 ms   334 ms  lag-19.hcr02sndgcaxt.netops.charter.com [72.129.15.182]
  6   934 ms    78 ms   228 ms  lag-20.sndhcaax02r.netops.charter.com [72.129.15.186]
  7    30 ms    41 ms    46 ms  lag-22.rcr01tustcaft.netops.charter.com [72.129.1.2]
  8   381 ms    55 ms   234 ms  72.14.221.250
  9   223 ms   156 ms    95 ms  172.253.51.129
 10   113 ms   414 ms   206 ms  142.250.226.113
 11   682 ms   208 ms   329 ms  dns.google [8.8.8.8]

..222.1 is the internal router, ..111.1 is the cablemodem, then 142.254.184.109 is the first piece of ISP equipment. The reports show that the outage (92% of the time) is at 142.254.184.109 -- though it labels that "Internal" (which it isn't, again in the "how do it know" category.)

So... where's my issue actually happening? TIA.

[SBK]

HI, let me take a look to understand what is happening and will get back to you asap

[SBK]

It seems we are talking of the agent ID 129695 in San Diego, can you please confirm?

[lairdb]

Correct.

[SBK]

I am assuming that ID 129695 is the agent since your your traceroute is almost identical to the hops we have for it.

The weird thing is that for some reason the IP 142.254.184.109 has been considered part of your network while definitely it is not.
I am overriding that hop to be part of the ISP network to be sure that next outages will be associated correctly but at the same time I am opening an internal ticket to check why this has happened to your agent

[lairdb]

Thanks -- but what interpretation should I put on this? Is my issue with the cablemodem ..111.1 or with the Charter device 142.254.184.109 (or the link between?)

[SBK]

I was still redacting my answer and stumbled on the hops assignment...

The above image shows the outages recorded at your site and you can see that both 192.168.111.1 and 142.254.184.109 are identified as triggering the outage

My question is are these two IP the LAN and the WAN interface of you ISP router ?
Or the private one is your router and the public one is the ISP?

In any case, as I mentioned above the Affected network is wrong when the 142.254.184.109 is "responsible" of the outage

[SBK]

Now it seems better, as far as I can see

[SBK]

said in Is my outage inside or out?:

The weird thing is that for some reason the IP 142.254.184.109 has been considered part of your network while definitely it is not.
I am overriding that hop to be part of the ISP network to be sure that next outages will be associated correctly but at the same time I am opening an internal ticket to check why this has happened to your agent

I also have an answer for this

If you take a look at the hops

you will see that exactly THAT hop 142.254.184.109 has no ASN number/org this is something that can happen when portion of networks were before owned by a different provider (same could happen when the same company is assigned different ASN like 20001 and 7843 both belonging to Charter Communications)

So thank you for highlighting this exception!

[lairdb]

@SBK said in Is my outage inside or out?:

The above image shows the outages recorded at your site and you can see that both 192.168.111.1 and 142.254.184.109 are identified as triggering the outage

My question is are these two IP the LAN and the WAN interface of you ISP router ?
Or the private one is your router and the public one is the ISP?

So, ..222.1 is the inside of my router, ..111.1 is the inside of my cablemodem. 142.254.184.109 ("int-1.sndgcaxt03m.netops.charter.com") is, I believe, the first piece of equipment not on my prem; definitely not my cablemodem's outside IP.

[SBK]

Then the first ISP hop is and must be 142.254.184.109 which is how it shows up now

[lairdb]

FYI still sometimes showing their IP as internal:

2026-02-25 11:06:14 - Down (72.129.1.2) for 16s (Provider)
2026-02-25 08:45:14 - Down (142.254.184.109) for 7s (Internal)
2026-02-25 08:24:54 - Down (142.254.184.109) for 20s (Provider)
2026-02-25 06:49:09 - Down (142.254.184.109) for 21s (Provider)
2026-02-25 06:11:04 - Down (142.254.184.109) for 20s (Provider)

[SBK]

I was testing an exception
Sorry for not informing!
It has been fixed now
Please confirm

[lairdb]

@SBK said in Is my outage inside or out?:

I was testing an exception
Sorry for not informing!
It has been fixed now
Please confirm

Yes; thanks.

[SBK]

Keep us posted if you see something else that sounds "weird"

[lairdb]

2026-02-27 11:25:10 - Down (142.254.184.109) for 1m 38s (Provider)
2026-02-27 10:53:14 - Down (142.254.184.109) for 8s (Provider)
2026-02-27 10:04:39 - Down (142.254.184.109) for 55s (Internal)
2026-02-27 09:44:39 - Down (142.254.184.109) for 2s (Internal)
2026-02-27 09:09:04 - Down (142.254.184.109) for 3s (Provider)
2026-02-27 08:00:44 - Down (142.254.184.109) for 6s (Provider)