Is my outage inside or out?

lairdb

I'm having trouble diagnosing an outage, because it's intermittent and lasts only a few seconds to a couple of minutes; very hard to catch and troubleshoot, and nothing on-prem shows errors in the logs after the fact.

The tracker reports it as "inside" most of the time... but it reports the address of the first outside hop, which makes me not entirely confident. ("How do it know?")

Here's the topology: It's a double-NAT; the tracer agent is running on a 24x7 windows PC; this tracert was run from there:

Tracing route to dns.google [8.8.8.8]
over a maximum of 30 hops:

  1    <1 ms     1 ms    <1 ms  www.asusrouter.com [192.168.222.1]
  2     2 ms    <1 ms    <1 ms  192.168.111.1
  3    98 ms   405 ms    22 ms  int-1.sndgcaxt03m.netops.charter.com [142.254.184.109]
  4   214 ms   275 ms   416 ms  lag-61.sndgcaxt02h.netops.charter.com [76.167.27.205]
  5   871 ms   177 ms   334 ms  lag-19.hcr02sndgcaxt.netops.charter.com [72.129.15.182]
  6   934 ms    78 ms   228 ms  lag-20.sndhcaax02r.netops.charter.com [72.129.15.186]
  7    30 ms    41 ms    46 ms  lag-22.rcr01tustcaft.netops.charter.com [72.129.1.2]
  8   381 ms    55 ms   234 ms  72.14.221.250
  9   223 ms   156 ms    95 ms  172.253.51.129
 10   113 ms   414 ms   206 ms  142.250.226.113
 11   682 ms   208 ms   329 ms  dns.google [8.8.8.8]

..222.1 is the internal router, ..111.1 is the cablemodem, then 142.254.184.109 is the first piece of ISP equipment. The reports show that the outage (92% of the time) is at 142.254.184.109 -- though it labels that "Internal" (which it isn't, again in the "how do it know" category.)

So... where's my issue actually happening? TIA.

SBK

HI, let me take a look to understand what is happening and will get back to you asap

SBK

It seems we are talking of the agent ID 129695 in San Diego, can you please confirm?

lairdb

Correct.

SBK

I am assuming that ID 129695 is the agent since your your traceroute is almost identical to the hops we have for it.

The weird thing is that for some reason the IP 142.254.184.109 has been considered part of your network while definitely it is not.
I am overriding that hop to be part of the ISP network to be sure that next outages will be associated correctly but at the same time I am opening an internal ticket to check why this has happened to your agent

lairdb

Thanks -- but what interpretation should I put on this? Is my issue with the cablemodem ..111.1 or with the Charter device 142.254.184.109 (or the link between?)

SBK

I was still redacting my answer and stumbled on the hops assignment...

The above image shows the outages recorded at your site and you can see that both 192.168.111.1 and 142.254.184.109 are identified as triggering the outage

My question is are these two IP the LAN and the WAN interface of you ISP router ?
Or the private one is your router and the public one is the ISP?

In any case, as I mentioned above the Affected network is wrong when the 142.254.184.109 is "responsible" of the outage