Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.
Dismiss

Does "LCP Time-out" indicate a problem?

695 views
Skip to first unread message

Chris Green

unread,
Nov 22, 2020, 4:18:04 AM11/22/20
to
I have PlusNet FTTC and, once a day or a bit more frequently I'm
seeing LCP Time-out messages from my Draytek 2860n router:-

2020/11/21 21:08:38 -- PPP Closed : LCP Time-out ()

2020/11/22 00:55:27 -- PPP Closed : LCP Time-out ()
2020/11/22 00:55:29 -- PPP Closed : LCP Time-out ()


The connection generally is very good, the speed is always hard up
against the 40Mb/s that we're paying for:-


Downstream Upstream
Actual Rate 39998 Kbps 9999 Kbps
Attainable Rate 72645 Kbps 24812 Kbps



Do the LCP Time-out messages indicate anything wrong?

--
Chris Green
·

Graham J

unread,
Nov 22, 2020, 5:51:43 AM11/22/20
to
What are the error messages immediately before?

I have a similar router and I see a group of messages like this, about
once per day:

Nov 18 21:09:43 V2860n: PPP Start ()
Nov 18 21:09:43 V2860n: Incoming Call Failed : No Such Entry for 123
Nov 18 21:09:43 V2860n: CHAP Login Failed () -
Nov 18 21:09:43 V2860n: PPP Start ()
Nov 18 21:09:43 V2860n: Incoming Call Failed : No Such Entry for vpn
Nov 18 21:09:43 V2860n: CHAP Login Failed () -
Nov 18 21:09:52 V2860n: PPP Closed : LCP Time-out ()

These are failed attempts to establish a VPN login, which uses PPP over LCP

By contrast, sometimes I see lines like this:

Sep 3 01:53:46 V2860n: PPP Closed : No Echo Response (PPPoA)
Sep 3 01:54:10 V2860n: PPP Closed : Hang Up ()
Sep 3 01:54:10 V2860n: PPP Closed : LCP Time-out (PPPoA)
Sep 3 01:54:13 V2860n: ADSL_Status:[Mode=17A States=SHOWTIME
UpSpeed=2301000 DownSpeed=19998000 SNR=10 Atten=27 ]
Sep 3 02:01:41 V2860n: PPP Start (PPPoA)
Sep 3 02:01:41 V2860n: CHAP Login OK (PPPoA)
Sep 3 02:01:41 V2860n: IPCP Opening (PPPoA); Own IP Address ...

Note the PPPoA in braces - this shows it is the internal modem on WAN1
which has lost the connection.

This is where sync has failed so the regular PPP traffic is not
responded to, the modem disconnects and the LCP timeout is reported.
Three seconds later sync is re-established, then after 28 seconds the
next PPP session starts. I suspect the modem retrain starts even before
the No Echo Response (PPPoA) and takes most of a minute to establish sync.

This is FTTC to a cabinet about 1.1km away so it's fairly slow.

This often happens in the early hours - I suspect Openreach reboots
something ...

Somtimes I see:

Nov 14 07:31:59 V2860n: PPP Closed : No Echo Response (PPPoE)
Nov 14 07:32:08 V2860n: PPP Closed : LCP Time-out (PPPoE)
Nov 14 07:32:14 V2860n: PPP Start (PPPoE)
Nov 14 07:32:14 V2860n: CHAP Login OK (PPPoE)
Nov 14 07:32:15 V2860n: IPCP Opening (PPPoE); Own IP Address

Here it is the PPPoE session using the extermal modem connected by
Ethernet to WAN2 which has lost the connection. Note the V2860 does not
report here the sync speed achieved by the external V130 modem.

At 7:30 in the morning it is almost certainly an Openreach technician
touching the line with his/testgear either in the exchange or at the
local cabinet. On this occasion the WAN1 connection dropped momentarily
about 23 minutes later.

(For any American readers, this is the English usage of the word
'momentarily')

--
Graham J

grinch

unread,
Nov 22, 2020, 7:18:33 AM11/22/20
to
from google



https://en.wikipedia.org/wiki/Link_Control_Protocol

Chris Green

unread,
Nov 22, 2020, 7:48:04 AM11/22/20
to
Graham J <nob...@nowhere.co.uk> wrote:
> Chris Green wrote:
> > I have PlusNet FTTC and, once a day or a bit more frequently I'm
> > seeing LCP Time-out messages from my Draytek 2860n router:-
> >
> > 2020/11/21 21:08:38 -- PPP Closed : LCP Time-out ()
> >
> > 2020/11/22 00:55:27 -- PPP Closed : LCP Time-out ()
> > 2020/11/22 00:55:29 -- PPP Closed : LCP Time-out ()
> >
> >
> > The connection generally is very good, the speed is always hard up
> > against the 40Mb/s that we're paying for:-
> >
> >
> > Downstream Upstream
> > Actual Rate 39998 Kbps 9999 Kbps
> > Attainable Rate 72645 Kbps 24812 Kbps
> >
> >
> >
> > Do the LCP Time-out messages indicate anything wrong?
>
> What are the error messages immediately before?
>
The above is *all* that appears in my mail, I have log to mail turned
on in the Draytek.

I have tried turning on logging to 'syslog server' but I've never
managed to make it work.


> I have a similar router and I see a group of messages like this, about
> once per day:
>
> Nov 18 21:09:43 V2860n: PPP Start ()
> Nov 18 21:09:43 V2860n: Incoming Call Failed : No Such Entry for 123
> Nov 18 21:09:43 V2860n: CHAP Login Failed () -
> Nov 18 21:09:43 V2860n: PPP Start ()
> Nov 18 21:09:43 V2860n: Incoming Call Failed : No Such Entry for vpn
> Nov 18 21:09:43 V2860n: CHAP Login Failed () -
> Nov 18 21:09:52 V2860n: PPP Closed : LCP Time-out ()
>
> These are failed attempts to establish a VPN login, which uses PPP over LCP
>
I don't use VPN but I suppose an incoming VPN could be someone trying
to break in.
Thanks Graham. It would *seem* then that maybe what I'm seeing is
someone trying to log in from outside.

I'll try and get some more logging turned on.

--
Chris Green
·

grinch

unread,
Nov 22, 2020, 8:51:54 AM11/22/20
to
On 22/11/2020 12:33, Chris Green wrote:
> Graham J <nob...@nowhere.co.uk> wrote:
>> Chris Green wrote:
>>> I have PlusNet FTTC and, once a day or a bit more frequently I'm
>>> seeing LCP Time-out messages from my Draytek 2860n router:-
>>>
>>> 2020/11/21 21:08:38 -- PPP Closed : LCP Time-out ()
>>>
>>> 2020/11/22 00:55:27 -- PPP Closed : LCP Time-out ()
>>> 2020/11/22 00:55:29 -- PPP Closed : LCP Time-out ()
>>>
>>>
>>> The connection generally is very good, the speed is always hard up
>>> against the 40Mb/s that we're paying for:-
>>>
>>>
>>> Downstream Upstream
>>> Actual Rate 39998 Kbps 9999 Kbps
>>> Attainable Rate 72645 Kbps 24812 Kbps
>>>
>>>
>>>
>>> Do the LCP Time-out messages indicate anything wrong?
>>
>> What are the error messages immediately before?
>>
> The above is *all* that appears in my mail, I have log to mail turned
> on in the Draytek.
>
> I have tried turning on logging to 'syslog server' but I've never
> managed to make it work.
>
>
>> I have a similar router and I see a group of messages like this, about
>> once per day:
>>
>> Nov 18 21:09:43 V2860n: PPP Start ()
>> Nov 18 21:09:43 V2860n: Incoming Call Failed : No Such Entry for 123
interface ATM0
no ip address
shutdown
no atm ilmi-keepalive
!
interface Ethernet0
no ip address
!
interface Ethernet0.101
encapsulation dot1Q 101
pppoe-client dial-pool-number 1
FTTC should be using PPPoE and vlan 101 not PPPoA ,mine uses PPPoE only.
The data packets are Ethernet and vlan tagged with vlan 101

From my routers config can you see the ATM is shut down


interface ATM0
no ip address
shutdown ,<----------------<<<
no atm ilmi-keepalive
!
interface Ethernet0
no ip address
!
interface Ethernet0.101
encapsulation dot1Q 101
pppoe-client dial-pool-number 1



What you are seeing from the logs is your PPP session to plusnet failing
.The LCP is trying to establish a link but failing due to timeout.

That could be a local issue with the line or a plusnet issue in that
they are not responding in time so the LCP session times out ,this is
the more likely issue.

Turn off anything PPPoA that night be wasting time and causing a LCP
timeout ,FTTC is normally Ethernet but most routers can auto detect which

I always thought that ADSL was PPPoE and FTTC (VDSL) was PPPoE




Graham J

unread,
Nov 22, 2020, 1:08:19 PM11/22/20
to
Chris Green wrote:
> Graham J <nob...@nowhere.co.uk> wrote:
>> Chris Green wrote:
>>> I have PlusNet FTTC and, once a day or a bit more frequently I'm
>>> seeing LCP Time-out messages from my Draytek 2860n router:-
>>>
>>> 2020/11/21 21:08:38 -- PPP Closed : LCP Time-out ()
>>>
>>> 2020/11/22 00:55:27 -- PPP Closed : LCP Time-out ()
>>> 2020/11/22 00:55:29 -- PPP Closed : LCP Time-out ()
>>>
>>>
>>> The connection generally is very good, the speed is always hard up
>>> against the 40Mb/s that we're paying for:-
>>>
>>>
>>> Downstream Upstream
>>> Actual Rate 39998 Kbps 9999 Kbps
>>> Attainable Rate 72645 Kbps 24812 Kbps
>>>
>>>
>>>
>>> Do the LCP Time-out messages indicate anything wrong?
>>
>> What are the error messages immediately before?
>>
> The above is *all* that appears in my mail, I have log to mail turned
> on in the Draytek.
>
> I have tried turning on logging to 'syslog server' but I've never
> managed to make it work.

[snip]

YOu have to have a syslog service running on a PC or similar to receive
the syslog traffic. Draytek offer one, see:

<https://www.draytek.co.uk/support/downloads/software>

You can plug in a USB memory stick and log to that.


--
Graham J

Graham J

unread,
Nov 22, 2020, 1:15:30 PM11/22/20
to
grinch wrote:

[snip]

>
> I always thought that ADSL was PPPoE and FTTC (VDSL) was PPPoE

I think it depends on the router and the ISP. On the V2860 I think I
can select either for WAN1 and it works with either. This is with Zen FTTC


--
Graham J

Chris Green

unread,
Nov 22, 2020, 4:03:04 PM11/22/20
to
I do, it's a Linux xubuntu system. I tried telnet to the syslog port
and it created a syslog entry.

I'm trying USB logging at the moment.

--
Chris Green
·

Graham J

unread,
Nov 22, 2020, 4:25:28 PM11/22/20
to
Chris Green wrote:

[snip]

>>
>> YOu have to have a syslog service running on a PC or similar to receive
>> the syslog traffic. Draytek offer one, see:
>>
>> <https://www.draytek.co.uk/support/downloads/software>
>>
>> You can plug in a USB memory stick and log to that.
>>
> I do, it's a Linux xubuntu system. I tried telnet to the syslog port
> and it created a syslog entry.

You have to have the V2860 configured for the correct server IP address
and port number ...

Can you try the Draytek software on a PC, to establish whether there is
something strange with your Linux system?

>
> I'm trying USB logging at the moment.
>

Does it record anything? You have to select the traffic you want to see.

--
Graham J

Andy Burns

unread,
Nov 22, 2020, 4:36:30 PM11/22/20
to
Chris Green wrote:

> I tried telnet to the syslog port
> and it created a syslog entry.

typically syslog runs on UDP port 514, which you wouldn't be able to
reach by telnet, yes you can run it on TCP, but would the router try to
send to that?

Chris Green

unread,
Nov 22, 2020, 4:48:04 PM11/22/20
to
Graham J <nob...@nowhere.co.uk> wrote:
> Chris Green wrote:
>
> [snip]
>
> >>
> >> YOu have to have a syslog service running on a PC or similar to receive
> >> the syslog traffic. Draytek offer one, see:
> >>
> >> <https://www.draytek.co.uk/support/downloads/software>
> >>
> >> You can plug in a USB memory stick and log to that.
> >>
> > I do, it's a Linux xubuntu system. I tried telnet to the syslog port
> > and it created a syslog entry.
>
> You have to have the V2860 configured for the correct server IP address
> and port number ...
>
Well it works from my laptop using the port number and IP that I have
put in the Draytek configuration.


> Can you try the Draytek software on a PC, to establish whether there is
> something strange with your Linux system?
>
Might I point out that PC doesn't mean Microsoft! :-) I don't have
any MS machines here.

I do seem to remember that many years ago I got my 2820n router to
write to a Linux syslog, but I'm not at all sure about that, it might
have been a memory of it not working. Still the USB log seems to be
working so it doesn't matter too much.


> >
> > I'm trying USB logging at the moment.
> >
>
> Does it record anything? You have to select the traffic you want to see.
>
All the boxes are ticked/blued. It does seem to be logging stuff to
the USB stick. I'll now have to wait to see if I get another LCP
timeout and then look in the USB log at the relevant time.

Listen to this space tomorrow! :-)

--
Chris Green
·

Chris Green

unread,
Nov 22, 2020, 5:03:03 PM11/22/20
to
Chris Green <c...@isbd.net> wrote:
> > YOu have to have a syslog service running on a PC or similar to receive
> > the syslog traffic. Draytek offer one, see:
> >
> > <https://www.draytek.co.uk/support/downloads/software>
> >
> > You can plug in a USB memory stick and log to that.
> >
> I do, it's a Linux xubuntu system. I tried telnet to the syslog port
> and it created a syslog entry.
>
Got it! :-)

For reasons only known to itself the Draytek router uses UDP to send
messages to syslog. By default the syslog server on Linux only
enables TCP logging. I've configured rsyslog to accept UDP messages
and now I see the 2860n logging in my syslog file.

If the Draytek documentation had bothered to say it uses UDP I'd not
have wasted so much time! :-)

So, I now wait for another LCP timeout.

--
Chris Green
·

Andy Burns

unread,
Nov 22, 2020, 5:13:46 PM11/22/20
to
Chris Green wrote:

> For reasons only known to itself the Draytek router uses UDP to send
> messages to syslog.

Because syslog traditionally runs on UDP/514, now TLS over TCP/6514 is
available too (but not very widely used IME).

Chris Green

unread,
Nov 22, 2020, 5:18:04 PM11/22/20
to
Well by default Linux only enables TCP logging. As I've reported
elsewhere in this thread I've just discovered that enabling UDP in the
rsyslog configuration makes the Draytek syslog work, confirming what
you say here. I wonder why the default (in the Linux configuration)
is TCP only.

--
Chris Green
·
0 new messages