ADSL ERR_SSL_BAD_RECORD_MAC_ALERT error

[#1]

Yikes ! - I bet your kids complain about Xbox with that latency 😮

That BQM and the high upload/download data ratio looks like it supports my hypothesis,

that excessive upload latency is causing packet loss, causing packet re-transmission, causing connection to collapse,

and potentially the frequent packet loss is breaking the SSL handshake protocol, that manifests in the errors you see.

If your bufferbloat test "Upload Active Latency" is greater than +30ms, then somehow you are going to need to implement QoS,  to prioritise and regulate the rate of traffic being sent from your network before it hits your modem.

[#2]

That BQM and the high upload/download data ratio looks like it supports my hypothesis,

that excessive upload latency is causing packet loss, causing packet re-transmission, causing connection to collapse,

and potentially the frequent packet loss is breaking the SSL handshake protocol, that manifests in the errors you see.

If your bufferbloat test "Upload Active Latency" is greater than +30ms, then somehow you are going to need to implement QoS,  to prioritise and regulate the rate of traffic being sent from your network before it hits your modem.

What would make it deteriorate to this extent in the last 2 weeks? Line fault or something else?

The TP-Link router is a recent thing - I only added this because the second Openreach engineer recommended getting rid of Powerline converters. Hub one had been working reasonably well for the last 20 months and before that John Lewis broadband was OK.

[#3]

---

@batesi wrote:

What would make it deteriorate to this extent in the last 2 weeks? Line fault or something else?

---

Christmas lights ?

Colder wetter weather ?

Kids at home more ?

More people in neighbouring homes on the internet, using more bandwidth at the unmaintained ADSL exchange ?

Bill Gates uploading your work laptop for the NSA/GCHQ to examine ?

Perhaps someone has enabled a BitTorrent on a device in your home ?

New mobile phone, set to backup to cloud regularly ?

There have been a lot of supposed "Russian" DoS attacks in recent weeks - possibly slowing the internet

Could be anything, but your line stats don't flag anything as being any problem with your ADSL

Perhaps next time you have a running BQM and an empty house,  you can go around switching one device off at a time (don't forget WiFi connected mobiles),  and see what is sending out the majority of traffic on your network ?

If you have any intention of moving your landline phone number to VoIP (due to the upcoming PSTN switch off), if you do have a bufferbloat problem, then VoIP calls will be interesting to do !

Still lets see what your bufferbloat test tells us - I might be completely wrong

[#4]

Thanks - what you say makes sense. 

It doesn't fully explain why I got the SSL errors when I connected to Plusnet hub  direct to the router in my tests last week (since I disconnected everything to do that). But that was using my work laptop - so the work laptop might possibly congest the network due to any number of maintenance agents that our IT dep't impose on us.

I'm going to do a test with everything disconnected and using the home HP laptop via ethernet - I just realized I can do this even though I don't have a ethernet to usb c adapter because I can use my work dell dock.

You mentioned the using TP  Link + bridge mode + QoS - well the Draytec 2760n is capable but I thought bridge mode PPPoE only suitable for VDSL and not ADSL2+? 

https://www.draytek.co.uk/support/guides/kb-router-as-dsl-modem

[#5]

---

@Anonymous wrote:

---

Perhaps next time you have a running BQM and an empty house,  you can go around switching one device off at a time (don't forget WiFi connected mobiles),  and see what is sending out the majority of traffic on your network ?

---

Suggestion; If the DrayTek was put into service that info could be observed for each device in the 'Diagnostics' section / 'Data Flow Monitor'.

See  https://www.draytek.com/demo/Vigor2760series/v1.2.1.1/Demo.html#Data_Flow_Monitor

[#6]

Only hesitation is that testing using the Draytek coincided with my line profile down speed dropping from 16mbs to 11mbs. I decided that the Plusnet one hub did as good a job if not better

[#7]

---

@batesi wrote:

It doesn't fully explain why I got the SSL errors when I connected to Plusnet hub  direct to the router

IF (a big IF) my thought that SSL handshaking is getting trashed by packet loss caused by bufferbloat, then it won't matter where your computer is connected.  If the volume of traffic heading out of your network, via your modem, towards the internet, consistently exceeds about 85% of your upload speed test results, then your modem will quickly fill it's buffer with data to send, until that overflows - causing latency to increase and packets to be lost.  The issue is that the upload bandwidth on ADSL is barely adequate for current internet usage, BUT can be effectively managed with router QoS that prioritises speed critical data, and better manages local data flows with handshaking protocols.

Alternatively it is still possible that you have two problems -

1)  A congested upstream ADSL connection

2)  A separate and unique SSL problem - that no one here has yet come up with the magic solution to

---

@batesi wrote:

 I thought bridge mode PPPoE only suitable for VDSL and not ADSL2+? 

I have used PPPoE to control the ethernet link from router to modem, for bridged modems both ADSL and VDSL.

I wonder whether you are thinking of a normal router with ADSL modem configuration that uses PPPoA ?

[#8]

Hi PlanetX

I tried the following:

• disconnected the hub one from the tp-link.
• hub one wifi is already disabled
• connected our home HP laptop to the router via ethernet (needed dell USB C dock)
• did some tests - as expected the internet is more responsive being the only device - however it didn't take long browsing in Chrome to hit the ERR_SSL_BAD_RECORD_MAC_ALERT error (John Lewis website is a good candidate - especially if you login to your account).
• I did several think broadband speed tests - I've attached a sample - they are all similar - down 10-14 mbs and up around 0.2-0.4.
• I attempted to run the bufferbloat test - I tried about 6 or 7 times and it either won't run at all or never gets past the initial Unloaded latency test (I waited around 5 minutes in one test at the Download stage but it just stops. I also have a screenshot attached with F12 console as I see some errors. I attempted running this test using Firefox and Chrome. I disabled ad blockers etc in FF. Sometimes the think broadband speed test also hangs at the upload stage. I'm assuming its a problem with my upload latency possibly.

[#9]

Well that's disappointing !

Have you got a different RJ11 modem cable that you could try, between Hub and Master socket ?

Do you have a spare dangly ADSL filter ?, to try and connect the modem to the "TEST" socket behind the Master Socket faceplate ?

[#10]

I'm afraid I doubt either of those would make a difference:
- rj11 cable is new I replaced it only a week ago
- the Openreach engineer replaced the master socket with a type that has an integrated filter on Wednesday but I had already tried 3 different filters

[#11]

The thing wrong here, is your upload speed test should be four times that, given the previous Hub ADSL stats.

The hub's modem is apparently happy with a 1091Kb sync, but speed test can only push 200Kbps through.

It's as if you have low frequency audio interfering with the DSL upload frequencies

So you have -

• A landline checked by Openreach yesterday
• New Master Socket and cables
• A Hub 1 with nothing obviously wrong with the connection, and MTU is perfect, WAN IP is static
• You've tried several other routers - with similar results
• You have swapped a PC reporting the SSL error, to a mobile connection and the SSL problem disappears
• There is no phone plugged in, and there is no internal phone wiring

I don't know what to suggest,  I'll sleep on it an see if anything dawns on me !

It might be worth doing the Plusnet "Troubleshoot by TEXT" thing, to see if the fault detection robot identifies anything ?

[#12]

It's baffling yes. But the actual upload speed has rarely if ever been near 1mb. Since around 25th November it's radically deteriorated and for a time it averaged 0.1 mbs. The only time I've observed respectable upload speeds is for a short time on Friday morning 1st December. This was about an hour before the second Openreach visit. Briefly got about 0.8 mbs.

I use the broadband for work up until this started I was able to share my screen on Teams without problems now it's virtually impossible...

[#13]

As there is nothing obvious wrong at your end, I'm wondering if @willcutforth could do you another line check, and check your ADSL phone exchange for link congestion ? maybe the bottle neck is there ? or the backhaul to the internet backbone ?

[#14]

---

@batesi wrote:

I'm getting to the end of my patience with Plusnet and contract is up end January unfortunately FTTP/FTTC isn't available in near future, 4G is variable here and no 5G. I'm thinking Starlink but installation costs are v.high..

---

Have you looked at "Fixed Wireless Access" broadband ?

Try putting your 'county' in to this - www.ispreview.co.uk/isp_list/ISP_List_Wireless , in the "Search by Coverage" box

Then go down the resulting list,

and visit each ISP's website, and put your postcode in to each 'coverage checker' to see what you can get

[#15]

My neighbour briefly used 4g modem before giving up and switching to Starlink 2. 4g is unreliable here.

I wanted to add about the strange nature of outages we had last week. Whereas normally the hub one would sense disconnection and automatically reconnect in this case we would lose access but the hub stay connected.
When I tried the draytek router same problem, but it was solved by switching from ARP detect to Ping for WAN connection detection. I set Draytek to ping Google server 8.8.8.8. This worked and when the connection went down it reconnected automatically. It suggested to me that problems were occurring the other side of the Plusnet gateway? I assume ARP detect is pinging the gateway automatically?