Internet Speed Throttled to 13.5Mb

Question

This is the first ever time I've used Microsoft Ask a Question, because this is the first ever time I've seen an issue like this and i'm prepared to log the hell of this to help others in the future as I cannot express my frustration.

The Setup

My laptop is wired in, it goes via one unmanaged gigabit switch down to the Unifi Security Gateway, which authenticates to my ISP via PPPoE.
I have a 1Gb FTTP (Fibre to the Premises) Internet connection with a 110Mb upload and on a typical day I can comfortably get 950Mb Down and 107 Up.
There is no QoS, bandwidth limitations or other impacting configurations set on any of my home infrastructure.

I connect through a Dock, Dell WD19 USB-C, which might sound like the cause, but I have also used a USB-A to Ethernet adaptor as well as a USB-C to Ethernet adaptor. There is no built in Ethernet with this laptop. Note that this laptop has worked perfectly fine up until the problem.

The Problem

As of Sunday 5th December 2021, my laptop was found to be off, despite me leaving it on over the weekend. I turned it back on without any issues but then discovered by internet speed was 13.5Mb/s (lower case b) on all speed tests, except Ookla.

Interestingly Ookla's Speedtest.net revealed speeds of up to 400Mb down and 98Up, which is still slower than normal, but gives me a good indication something is broken somewhere. All other speed tests tell me exactly 13.5Mb, consistently and actual download speed is indeed 13.5Mb, despite Speedtest.net's result of >400Mb, my actual download speed is indeed 13.5Mb.

The speed tests carried out are via Edge, Chrome and Firefox browsers.

It affects both Wired and Wireless. Yes, this is not just wired. 13.5Mb on both!

Iperf to external servers reveals 13.5Mbs, I am indeed throttled.

My upload is unaffected running >90Mb/s.
All other devices on my network are running happily at >900Mb/s.

I know the difference between Mb/s and MB/s, I'm measuring network performance not disk performance.
Yes, I've done sfc /scannow, if someone says that I might flip a lid.

Troubleshooting

Let's begin ruling stuff out.

• Windows 10 Operating System - Fully up to date, even optional updates included
• BIOS - Fully up to date
• Drivers (Dock's NIC, Chipset, Wireless Card) - Fully up to date
• Dock Drivers - Fully up to date
• Only this laptop effected. Other devices, including those that connect via the same switch, running at >900Mb/s
• Network card is capable, this laptop, in the same configuration, worked at >900Mb/s prior to the date it failed.
• Network cable replaced just in case, running now off a Cat 6a, massively overkill, still slow.
• IPerf tests reveal speeds to other computers in my network at 1Gb/s, telling me the network card, cabling and infrastructure is working fine.
• Linux Portable Distro, running on same laptop, in the same configuration, gets 1Gb/s internet fine.
• Reset Network card with all netsh commands already
• Changed policies to turn off Windows Update 80% bandwidth reservation
• Plugged in a new USB-C to Ethernet adapter, still get 13.5Mb/s
• Bypassed my Unifi Security Gateway and plugged straight into ISP provided router, same 13.5Mb/s
• Bypassed and routed directly PPPoE from my network adapter, thus exposing my laptop to the raw internet, turning my laptop into a router, still 13.5Mb/s
• At a friends home, still 13.5Mb/s.
• No Proxies or VPNs.
• Wireshark revealed 13.5Mb/s speed when reviewing bandwidth speeds, EXCEPT, when running speedtest.net of which I see higher speeds. ****.
• There are no running background processes utilising any networking.
• Firewall has been turned off and on
• Disconnected all USB Devices, still slow

Variables

My laptop is managed by my company's Intune. There are no bandwidth limitation policies in place, but this is a variable I cannot verify.

Conclusions

The fact my laptop can connect to local devices at 1Gb, rules out hardware (cable, switches, docks)
The fact my laptop is still limited at another location, rules out network configuration external to the laptop, including ISP
The fact that Linux Distro works at a Gigabit on the same laptop, tells me it's the Windows OS.

It seems that potentially Windows 10 is indeed throttling my internet connection.

Usually I would just rebuild at this stage, but for a change I want to find the root cause.
I've read people have rebuilt and it still remains, but that would surprise me.
I might have to do that, but naturally as a intune managed device, its going to be a pain.

Hardware

Dell Latitude 7420
i7 1185G7 (4 core, 8 threads)
16GB RAM
NVME 256GB

Answer 1

I have discovered the true cause of this problem.

My laptop has various Dell apps that have had no discovered negative effects up until recently, whereby an application known as Dell Optimizer (ironic), took control of my network card and limited it's performance to 13.5Mb/s.

Here is the video of evidence of this:

Dell Optimizer App - Throttling my Internet Connection

It led me to believe that the Windows Operating System was the cause as I was under the illusion that the only thing that had changed recently was Windows updates.
In fact, this application self updates and there is no evidence of any change to it or it’s version. Strange I know but I think the application has self repaired, restoring it to defaults, thus not changing any files but instead deleting its own config. Unfortunately, by default, is that it takes over the network adapter. What a stupid default.

It was discovered off the back of the fact that the only setting in the network adapter that made any impact was the Priority and VLAN setting.
Looking up what this setting does, it is indeed related to 802.1p (QoS). It seems that this Dell Optimizer tool is essentially a QoS management tool and when enabled, it bottlenecked my connection to 13.5Mb.

Priority and VLAN setting impacts the "Priority Level Definition", which in short is the configuration you can make within task manager where you can prioritise CPU Resources to specific services. I noticed when carrying out my speed tests to any internet location, not a LAN location, that the Dell Optimiser App began demonstrating CPU/Memory spikes along with networking traffic.

Once I found the app, I realised that it was enabled to "optimise" my network cards. (Wifi and Ethernet).
Once turned off my speed test immediately went back up to the actual speed provided to me by my Internet Service Provider.

May I pass on my thanks tremendously to @Anonymous for his incredible determination to help discover the cause by analysing deep level knowledge of network data.
It was always going to be something stupid, but I can let Microsoft off the hook with this one and point all my blame to the OEM Dell. It felt like software, it was software, case resolved.

Dell - Fix your Optimiser, what on earth is the point of it.

Answer 2

Hello @Anonymous ,

I am retired and do this just for fun - if you also have time and interest then that is great.

To get a stack trace, using built-in Windows tools, we will have to use Windows Performance Recorder (WPR). WPR is controlled by an XML format (profile) input file (conventionally with the extension .wprp). I have attached a suitable file (with a .txt extension, due to constraints on attachments in this forum) and have also pasted it contents below to make discussion of it easier.

157215-rscwprp.txt

<?xml version="1.0" encoding="utf-8"?>  
<!-- wpr -start rsc.wprp!RSC -filemode -->  
<!-- wpr -stop ?.etl -->  
<WindowsPerformanceRecorder Version="1.0" Author="Gary">  
  <Profiles>  
    <SystemCollector Id="NTKL" Name="NT Kernel Logger">  
      <BufferSize Value="64" />  
      <Buffers Value="128" />  
    </SystemCollector>  
    <EventCollector Id="ETW" Name="ETW">  
      <BufferSize Value="64" />  
      <Buffers Value="128" />  
    </EventCollector>  
    <SystemProvider Id="Map">  
      <Keywords>  
	<Keyword Value="Loader" />   
	<Keyword Value="ProcessThread" />   
      </Keywords>  
    </SystemProvider>  
    <EventProvider Id="TCPIP" Name="Microsoft-Windows-TCPIP" NonPagedMemory="true" Level="17" Stack="true">  
      <Keywords>  
        <Keyword Value="0x200700000000" />  
      </Keywords>  
    </EventProvider>  
    <Profile Id="RSC.Verbose.File" Name="RSC" Description="RSC" DetailLevel="Verbose" LoggingMode="File">  
      <Collectors>  
        <SystemCollectorId Value="NTKL">  
          <SystemProviderId Value="Map" />  
        </SystemCollectorId>  
        <EventCollectorId Value="ETW">  
          <EventProviders>  
            <EventProviderId Value="TCPIP" />  
          </EventProviders>  
        </EventCollectorId>  
      </Collectors>  
    </Profile>  
  </Profiles>  
</WindowsPerformanceRecorder>  

We need to collect system Loader and Process events in order to map the 64-bit addresses in the stack traces to modules (.DLL, .SYS, etc.); WPR augments these events with information about the versions of the modules. We also need to collect events from Microsoft-Windows-TCPIP using the same keywords as previously (0x200700000000); the Stack="true" attribute creates stack traces for events from this provider.

Assuming that the XML is saved with the name rsc.wprp, the command to start a trace is wpr -start rsc.wprp!RSC -filemode and the command to stop a trace is wpr -stop why.etl.

You could try analysing the captured data yourself with Windows Performance Analyser (WPA) which is dowloadable from the Microsoft store. I would not necessarily recommend this, as WPA would probably download gigabytes of symbolic debug information when trying to analyse the trace. WPA is designed for analysing aggregated data and although it is possible to drill down to individual events and stacks, it is not easy.

We probably don't need to capture much network traffic, since each stack for the TcpRscNblOobInfo event should be the same.

Gary