I have a raspberry pi running mumble, softether vpn, and samba services. Whenever the pi is on, the internet connection for the network is frequently disconnected and forced to reconnect at the router/modem level, i.e. I can still connect to the network, so I don't think it's a too many devices problem. When I check the router's status page it's reporting the internet disconnected. This only occurs when the pi is on.

I'm technically minded but a novice linux user and I'm struggling to diagnose the problem.

What tools/commands can be used to monitor the network usage of the pi (it doesn't have a display attached, but I have a windows machine I can use for monitoring/connecting to)?

What tools/commands can be used to determine what service/process is using the network?

Has anyone ever come across any similar behaviour (odd as it is) and have a solution?

1 Answer 1


Has anyone ever come across any similar behaviour (odd as it is)

Yes, you are not the first person to report this here. I just went looking for those other reports but could not find them, however, there is the chance they were pruned from the system if they were closed without an answer, as they might have been. I can definitely remember one and possibly two others over the past three years.

Here's the thing, though: Without getting into book length explanations of the nature of IP and level 1/2 wireless and wired networking (yes, I've read them), you'll have to take my word for the following fact:

It is NOT possible, either via error or deception, for a single device on a subnet to cause other devices on the subnet to spontaneously disconnect, or for them to induce the central gateway (router) of that subnet to spontaneously disconnect them or otherwise wreck widespread havoc except:

  1. Via a denial of service attack which causes so much meaningless/aborted traffic to the router (in particular; a device or devices plural with sufficient capabilities could do it to numbers of other devices) that the router/devices become overwhelmed dealing with these constantly aborting/meaningless connections that it cripples their attachment to the network, or in the case of the router, the network itself.

    Unless you have a very diminutive router -- say, one which your ISP warned you, "Don't try to hook up more than one or two computers at a time!" -- one raspberry pi is simply not capable of mounting a DoS attack on anything. And yes I am being facetious about the diminutive router. No one would provide you such a thing and as far as I am aware no one even makes one for general purpose use.

  2. The pi or any other device attached to the network introduced some kind of malware which has infected other systems which could, particularly when working in unison, mount a DoS attack on the router, or malware which may have affected the router itself.

To summarize, the first case is not a possibility. Again, without explaining all the details that provide definitive evidence of why, I'll give you a simple real world scenario as a clue instead. Let's pretend that device #1 exists in a small, portable, inexpensive, easily available form (akin to the Raspberry Pi), and that there were some simple means by way of which such devices could either intentionally or (what would be much worse) simple user error, disable a wifi/local area network.

Major news networks eat this stuff up: "TEENAGERS CRIPPLING SMALL SCALE WIFI HOTSPOTS CITY WIDE, USING TINY COMPUTERS IN BACKPACKS!! ", etc. Note at this point that your average cellphone today has considerably more processing power than most raspberry pis (the Pi 3 might give some current lower end models a competition) and would be much more suited to this role, and, with regard to ethernet, any laptop or netbook built in the last half decade would have at least the same level of advantage going that route (and wifi).

Yet, despite that fact that your average populuous-western-world urban coffee shop, many many of which offer free wifi, probably contain more such devices than people, our friends in news broadcasting and other forms of journalism have yet to get their hands on such an exciting story!

"But," you say, "those places have much different and more powerful equipment than I do at home". This is probably at best marginally true in many cases, but it does bring us to a much more likely explanation for your problem: your router. Why it would choose to do this just because of the pi, who can say, but it is obviously not supposed to do that (but almost certainly is anyway). If you do end up talking to your ISP about this, BTW, and the first flunkey you talk to tries to claim, "just don't use that device, we don't support everything," ask to talk to someone else until you get to someone who actually went to school because anyone who did understands what I've just explained.

Considering at most three stories here in three years here that I can remember, this could all just be pure coincidence. That, "I can't find any other explanation" does not make it true, just like the fact that most people could not find the earth being flat an explanation for why the sky was up made that true.

What tools/commands can be used to monitor the network usage of the pi (it doesn't have a display attached, but I have a windows machine I can use for monitoring/connecting to)?

I'd recommend using wireshark on the windows box or any other computer on the network (the only thing it doesn't work on are mobile devices). It is probably going to be somewhere between confusing and gobbledy-gook at first, but the simple thing it might allow you to do is see the difference between when that computer works properly online and when it doesn't. With a "wired" only network it is also usually possible to easily see all the traffic from all other systems; with an (encrypted) wifi network it is also possible, but you have to 1) Shut the network down, attach the computer with wireshark and run it, then allow other devices to connect (this problem doesn't exist with unencrypted wifi, so if you really want to do this for a bit you could disable that), 2) Configure your wifi interface in a way it may or may not be capable of (though most of them are) and that windows may or may not make easy for you to do.

Something like a DoS staging will I think be really obvious to anyone when it happens (and you can leave wireshark running perpetually, scroll back through and save the record). If you can do this for a while in a situation where most devices are idle (stuff like cellphones never completely will be, but close enough), what you'll see is just a continuous, slow (say a half dozen packets/minute per device) continuous stream of administrative things going on. If you suddenly start doing something with a web browser, something more drastic will happen.

If the network itself shuts down, probably something very strange will happen before then and the nature of the observed traffic afterward will have changed dramatically.

  • I think it is possible for an imperfect router to be denied service by otherwise legal traffic coming from a device. Not all network elements are created equal
    – Blake
    Mar 10, 2019 at 9:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.