How to monitor internet connection for interruptions - for Mac OS X

Question

I have subscribed to a new ISP and I am experiencing problems with this new ISP. The problems are several micro interruptions on the internet connection, kind of lags, that is probably related to timeouts on their proxies or in my connection to their network.

As these micro interruptions occur at random, I cannot prove that, because every time they send a technician to my office the problem is not detectable, specially because the service may be stable for 3, 4 hours and then start to show the problem again.

It is very annoying for two reasons. I am downloading something and then the download stops suddenly and I have to start again. Another reason is that I use a VoIP box connected to my phone using ethernet and this VoIP box loses connection every time, and my VoIP phone stops receiving/making calls, forcing me to restart the box every time I detect it and to stay hours with the phone down, without noticing.

My question is: How can I monitor the internet service for a period, telling me when the service is down, plot a graphic or something like that? Any tool or some way for monitoring the quality of the network or connection that can run on a Mac?

My idea is to have something to show them and prove I am right.

Solution 1

Applications->Utilities->Console.app

Take a look in the logs there as a start.

You could also look into ntop or Little Snitch.

Solution 2

If you use the following:

ping -A -i 10 --apple-time 10.20.30.40 > monitor.txt

It will run continuously until stopped and ping every 10 seconds to 10.20.30.40 (change for your address)

The --apple-time means that it will log the time of each ping so you can see failures. Like so:

11:33:10.793801 64 bytes from 10.20.30.40: icmp_seq=0 ttl=58 time=27.744 ms
11:33:11.780250 64 bytes from 10.20.30.40: icmp_seq=1 ttl=58 time=9.757 ms
11:33:12.781136 64 bytes from 10.20.30.40: icmp_seq=2 ttl=58 time=10.150 ms
11:33:13.782932 64 bytes from 10.20.30.40: icmp_seq=3 ttl=58 time=11.779 ms
11:33:14.785446 64 bytes from 10.20.30.40: icmp_seq=4 ttl=58 time=11.254 ms

Solution 3

PrettyPing

• like ping but with bit of visuals in the terminal, making it easier too spot interruptions/slow moments.

If you have homeBrew, then brew install prettyping will install it and prettyping somedomain.com will keep pinging and showing bars...

Solution 4

This app logs your connection status and even claims it is used internally by Apple.

Log your network outages, graph speeds over time, and more. Network Logger Pro can also be used to monitor web sites and produce historical graphs of their speeds, outages, and response times.

https://itunes.apple.com/us/app/network-logger-pro/id764324406?mt=12

It's $10 though :/

Solution 5

Ping

To monitor internet connection, you can simply use ping command. It just sends ICMP ECHO_REQUEST and expects the response.

Ping your router IP, when it's not responding, you can report to your ISP as internet interruption.

If your router has firewall, use arping instead, or simply chose another remote host, e.g.

$ ping 4.2.2.1
PING 4.2.2.1 (4.2.2.1): 56 data bytes
64 bytes from 4.2.2.1: icmp_seq=0 ttl=57 time=37.710 ms
64 bytes from 4.2.2.1: icmp_seq=1 ttl=57 time=32.051 ms

Arping

To monitor your physical connection to the router, you can use arping, e.g.

$ sudo arping 192.168.0.1

This is especially useful when your WiFi keeps dropping and your router doesn't respond to standard ICMP packets. Install via Brew (brew install arping).

Tcpdump

There is tcpdump which can dump traffic on a network. For example to dump all outgoing packets into port 80 and 443, the syntax could be:

sudo tcpdump -i en0 port http or port https

To write into the file, add -w file, then read it via -r file. This will include exact timestamps of each network packets being received or sent.

To check whether the internet is interrupted, look for SYN packets (in Flags section) which your computer sends, and for each one the server should reply with a SYN-ACK. If that is not happening and there is no any traffic going back (just SYN packets, then there is no internet connection).

View more solutions

Comments

[Admin]

This Q may really be on topic, it fits the "good question" template (from How do I ask a question that may require recommending software? ) "I have <problem-x - network interruptions > that I don't know how to solve. I've already tried X, Y, Z (restart VoIP when I detect it) , but those programs don't work because this or that. How do I do this?" Is the only problem basically asking for a "Tool for monitoring internet connection" instead of saying "How to monitor internet connection for interruptions?

[Duck]

Interesting, but you got to the point. Yes, my connection unfortunately is by cable modem, but it is a brand new (it was installed by them a month ago). I suspect the problem is their cable network. I never liked cable internet (I was forced to use them, because there's no other broadband company offering services in my region).

[Frank Lämmer]

ntop.org < correct link to ntop (i think)

[Justin]

Search for en0 or en1 once you open console.app (your network interface name(s)) to see network info.

[Xen2050]

Is there an easy way (like a script) that automatically searches the tcpdump output looking for SYN packets that have no corresponding SYN-ACK reply?

[kenorb]

@Xen2050 I think I would grep the dump or output by looking for S flag like: sudo tcpdump -i en0 -nl | grep -C5 "Flags .S", from there, if you've ack in the context (extra | grep ack), than means something responded. So you need something opposite. I think you you find some awk/sed syntax that can find 5 SYN packet in a row, then it can alert that something wrong (unless you're contacting some dead host).

[brianfit]

For live monitoring, ping -A www.yahoo.com will beep when connection goes down. While you can use an IP address, using a human-readable address will test DNS failures as well.

[bertieb]

Welcome to Super User! Your script is short enough to include in your post; you should edit your answer to include it

[Superman.Lopez]

Thanks for the suggestion

[tenmiles]

This doesn't timestamp when the request times out. If you're manually reading the logs you could infer based on the times of successful pings, but if you're trying to analyze it in another program or graph or something it might not work out as well.

[Fabien Snauwaert]

What are we supposed to look for in the logs? Not getting anything on en0 or en1.

[MaasSql]

+1 for monitoring the connection to the physical router