For about four months, my internet connection has occasionally become extremely slow for 30–90 minutes, roughly once every three days. During these episodes, none of my devices can really do anything online. My ISP's outage page does not show any problems, and my computer remains connected by Ethernet over fiber with no visible cable damage. How can I determine whether this is a DDoS attack or an issue with my ISP, router, or home network?
5 Answers
The most useful test is to compare several things while the slowdown is happening: ping the router’s local address, ping a reliable public address, and run a speed test over Ethernet. If the router itself is slow to respond, the local network or router may be the problem. If the router responds normally but the public test fails, the ISP connection is more suspicious. Rebooting the router and the fiber network device can help temporarily, but record the results before rebooting if you want useful evidence.
Installing a packet-capture tool can help, but it may be difficult to interpret without networking experience. Router traffic graphs and logs are usually a better first step. Look for unusually high upload or download usage, repeated connection attempts, overheating, reboots, or warnings about the fiber signal. Also check whether one device on the network is using all the bandwidth or may be infected.
A DDoS attack is possible, but recurring slowdowns are more often caused by an ISP connection problem, poor signal levels, congestion during peak hours, or a faulty router or optical network device. Check whether the problem affects every device and whether it happens at roughly the same time of day. Your router’s WAN statistics, event logs, and bandwidth monitor may also provide clues. Keep the router firmware and all internet-connected devices updated, and make sure you do not have unnecessary inbound ports forwarded.
Avoid bypassing the router and leaving a computer directly exposed to the internet, since the router’s firewall is important. Instead, contact the ISP during or immediately after an incident and provide the exact start time, duration, affected devices, speed-test results, and router logs. They can check the fiber signal, neighborhood congestion, DHCP lease, and whether they see attack traffic.
If you suspect the public IP address is being targeted, ask your ISP whether they can renew or change your WAN IP. Depending on the provider, turning the router off for several hours may also result in a new DHCP lease. However, changing the IP is not a substitute for diagnosing the connection, and an ISP can usually confirm whether they are seeing unusual inbound traffic or signal problems.
It affects my other devices too, not just the computer, so I’ll check the router logs and whether the timing matches peak hours.