← Back to Blog
homelabnetzwerkunifidebuggingJuly 7, 2026 · 4 min read
StandardSimply explained

When your 600 Mbit fiber line feels like 300: a detective story with the UniFi UCG Ultra – Simply Explained

ONT · PPPoE direct test · DPI · 300 → 600 Mbit
Editorial diagram: a UCG router panel with the Critical Apps rule highlighted, behind it a DPI funnel choking the data stream; on the left an ONT and a laptop running the PPPoE direct test at the full 600 Mbit, on the right two gauges reading 300 and 600 Mbit.Editorial diagram: a UCG router panel with the Critical Apps rule highlighted, behind it a DPI funnel choking the data stream; on the left an ONT and a laptop running the PPPoE direct test at the full 600 Mbit, on the right two gauges reading 300 and 600 Mbit.

Four hours, a laptop connected straight to the fiber box on the wall, and one by one every suspect ruled out. In the end it was a single switch in the router’s settings. This is the story.

The starting point

The internet connection at home is a fiber line. What we pay for: 600 Mbit download, 300 Mbit upload. Fast enough to stream several movies at once without thinking about it.

The reality: speed tests consistently showed about 300 Mbit. Exactly half.

And “exactly half” is the kind of pattern that makes you suspicious. Not a bit slow, not sometimes. Exactly half, every time.

The suspects

When something is wrong with the internet, there’s a long list of things it could be. Here’s the lineup we worked through.

The cables. Every cable was checked. An extra network switch between the computer and the router was removed entirely, just to be sure. No change.

The internet provider. Maybe they’re not actually delivering 600? Hard to know from behind your own router. The first speed test ran against a server far away and showed 435 Mbit. Then one against a server nearby: suddenly 598. Lesson number one: a single slow test server can send you on a completely wrong trail.

The fiber box on the wall. The ONT (Optical Network Terminal – the little box where the fiber cable meets your home network) might be the bottleneck. This one was ruled out by a clever test I’ll describe in a moment.

The router’s security features. There’s a honeypot (a decoy trap for attackers), intrusion detection, content filters, threat management. All checked. Turning off the honeypot helped a tiny bit. The rest was either already off or didn’t change anything.

A leftover VPN rule. A VPN (Virtual Private Network – a kind of encrypted tunnel) rule was sitting in the configuration, disabled and unused. Removed entirely. No change.

151 firewall rules. Complex, yes. The problem? No.

The direct test – bypassing the router

This was the decisive step. Instead of testing through the router, the laptop was connected directly to the fiber box on the wall. Using a protocol called PPPoE (Point-to-Point Protocol over Ethernet – the way most German fiber connections talk to the provider), the laptop dialed in on its own. No router in between.

There are a few traps with this. The provider only allows one connection at a time, so the router had to be fully powered off first. Then the fiber box too, with a wait of several minutes for the old session to expire on the provider’s side.

Once the laptop connected directly: 598 Mbit down, 293 Mbit up. Full speed. The provider delivers what it should.

That’s worth remembering as a general trick: if you ever suspect your router is the problem, a laptop straight on the fiber box settles the question in ten minutes.

The culprit

After all the obvious suspects had been ruled out, one small setting was left sitting quietly at the top of the router’s policy list: a rule called “Critical Apps Prioritization”. It told the router to prioritize video call apps like Microsoft Teams and Zoom.

It looked completely harmless. It doesn’t block anything. It just says: “these five apps get priority.”

But here’s what that actually means. For the router to know whether a data packet belongs to Teams or not, it has to open and inspect every single packet that flows through it. Headers, patterns, sometimes even peeking into encrypted connections. This is called DPI (Deep Packet Inspection – imagine a postal worker opening every letter to check who it’s from, instead of just reading the address on the envelope).

The router has a modest processor. Under normal load, it handles the job. But when a fast download tries to fill the whole 600 Mbit line, the processor can’t inspect packets fast enough. The result: almost exactly half the speed gets through.

Rule disabled, new speed test: 647 Mbit, even a bit above what we pay for.

Four hours of searching, and in the end it was one checkbox.

What I took away from this

Harmless-looking switches can be expensive. A toggle that says “prioritize my video calls” sounds like a good idea. Nobody warns you that it forces the router to x-ray every single packet. If you really want to prioritize video calls, there are smarter ways that don’t require the router to inspect everything. But that toggle in the settings is not one of them.

The router’s own speed test lies. The built-in test on the router runs on the device itself. It doesn’t pass through its own inspection pipeline. It showed nearly full speed even while clients behind it got only half.

“Exactly half” doesn’t always mean what you think. The classic explanation would be a cable problem. But it can also mean the router’s brain is simply full.

Test against several speed servers. The first test against a badly connected server almost sent me chasing entirely the wrong lead. Always try at least two or three different ones.

The laptop-on-the-fiber-box test is worth gold. Before you spend hours poking at router settings, prove the line itself is fine. Ten minutes, one cable, question answered.