NETGEAR is aware of a growing number of phone and online scams. To learn how to stay safe click here.
Forum Discussion
Joelovinlife
May 03, 2020Aspirant
AC2200 Orbi Router(Dos Attacks - Loss of Service)
So I'm having the popular issue of DOS attacks. I've done some research and see most Netgear Routers report these in their logs. However, I lose internet connection randomly through out the day and all troubleshooting and support calls have led me here. I understand most DOS attacks logged are common by google and Facebook but my logs don't show hundreds or thousands of attacks per second which is usually what stops service. I typically lose connection on all my devices until the router stabilizes and comes back online. Wifi connection more specifically. I have read that these can cause Netgear routers to restart . I have a verizon fios hard wired ethernet connection at home plugged into my Orbi Router and 2 Satellites. No Modem.
I've done some troubleshooting and I am testing certain devices 1 by 1 to see if my connection drops due to any particular device connecting. I've read posts and articles related to this issue and I am not sure if the attacks are enough to drop service intermittently like it's doing. I've gotten my ISP to change my ip a couple times already. Any help would be appreciated!
Here are the questionable DOS attacks from my log:
34.98.102.181 (google)
Ports:
5222
31.13.66.51 (facebook)
Ports:
5222
433
203.205.239.248 (China)
Ports:
8080
217.182.137.219 (France)
Ports:
80
147.135.252.44 (France)
Ports:
80
103.109.57.62 (Bangledesh)
Ports:
80
Most logged are from Facebook and google... like 95%! The others maybe 2 logged entries. But if there are not hundreds of these logged at a time, why would this cause my connection to fail?
I've done some troubleshooting and I am testing certain devices 1 by 1 to see if my connection drops due to any particular device connecting. I've read posts and articles related to this issue and I am not sure if the attacks are enough to drop service intermittently like it's doing. I've gotten my ISP to change my ip a couple times already. Any help would be appreciated!
Here are the questionable DOS attacks from my log:
34.98.102.181 (google)
Ports:
5222
31.13.66.51 (facebook)
Ports:
5222
433
203.205.239.248 (China)
Ports:
8080
217.182.137.219 (France)
Ports:
80
147.135.252.44 (France)
Ports:
80
103.109.57.62 (Bangledesh)
Ports:
80
Most logged are from Facebook and google... like 95%! The others maybe 2 logged entries. But if there are not hundreds of these logged at a time, why would this cause my connection to fail?
12 Replies
- tomschmidtVirtuoso
If you suspect your router is rebooting due to DDOS attacks, then login to the http://orbilogin.net/debug.htm web interface and check the uptime reported.
- JoelovinlifeAspirantYes I did that and I believe it's definitely related time wise but will 1 to 3 dos attacks make the connection drop??
- CrimpOnGuru - Experienced User
I monitor two Orbi systems that regularly log over 100 "DoS Attacks" every day. One of them just recently filled the log file every 3 minutes for 8 hours with DoS Attacks, and never went down. This was a sustained rate of 2-3 attacks logged per second for 8 hours.
I do not doubt that something is causing the Orbi to malfunction frequently, but I have serious doubts that a small number of "DoS Attacks" is the cause.
- FURRYe38Guru - Experienced User
What Firmware version is currently loaded?
What is the Mfr and model# of the Internet Service Providers modem/ONT the NG router is connected too?Have your ISP change your WAN IP address on the modem.