Diagnosing intermittent WAN outages: how to listen on WAN and gather details?

[OmnomBánhmì]

The question may seem odd, so I'll explain. In order to diagnose intermittent outages with my DOCSIS internet provider I'd like to sneek peek into the WAN network. The cable modem works in bridge mode. The connection has dual stack.

From time to time there's outages, a few seconds long at a time, irregularly (every 1 to 4 hours) but consistently multiple times a day. There is no service interruption, WAN interface stays up, and all clients notice a sudden lag. If you're in an RDP session the connection stalls, breaks down and needs to be re-established. Most other things run as usual after the hiccup.

If this were on a LAN connection on any Linux box I'd use ss, sar and arp next to Wireshark and such to build some knowledge about who's connecting and who is there (on the ISP end) in the first place. Since I'm on OPNsense this will not work, right?

Since calling the ISP leads to suggestions "please restart your router" and no observable improvement, what do you suggest I do instead to track down issues? Any ideas?

[cobbers83]

Following. After this latest update, 2 hot fixes, and a manually kernel patch, my internet is doing the same thing. I'm pulling my hair out. I see no red flags in the logs. Argh!

[OPNenthu]

There is no service interruption, WAN interface stays up, and all clients notice a sudden lag. If you're in an RDP session the connection stalls, breaks down and needs to be re-established. Most other things run as usual after the hiccup.

Hey, I don't know the direct answer to your question, but based on your description here I'm wondering if you're experiencing congestion?

I have DOCSIS too and I was getting pretty terrible ping times and a bufferbloat score of 'C' or worse before I did this.

I think most cable customers wouldn't see this because they're using the ISP gateway as the router and it has all the traffic filtering and shaping already, but once we put it into bridge mode I think all of that goes out the window. (could be wrong)

Not saying this is your issue, but worth mentioning.

UPDATE: a cautionary word from @meyergru about some ISPs not behaving well with shaping. YMMV.

[OmnomBánhmì]

FTR, I still haven't solved the actual issue, that is "how to passively detect WAN issues". Thinking about putting an SBC onto the WAN as a sole device and log what I get (which may be not much, but I have an otherwise underused Pine64 board here).

The traffic shaping tips may help, will try them soon, thank you OPNenthu!

cobbers83, any change? I still have the same thing.