NETGEAR is aware of a growing number of phone and online scams. To learn how to stay safe click here.
Forum Discussion
Solved
DoS and Reboots
Hi all,
Need some insight. Something I have never had an issue with before as started to peek with my new Orbi RBK50 system. I am frequently getting logs about DoS attempts, however, the router is rebooting almost every day. I need to know how to mitigate this. I've previously used ASUS routers and never had a problem until now. Here is a copy of the log once it comes up and then shows some attempts, but at some point reboots. All options are default so all security services are enabled currently:
[admin login] from source 192.168.2.4, Friday, May 03, 2019 13:18:07
[DoS Attack: ACK Scan] from source: 216.220.61.236, port 8190, Friday, May 03, 2019 11:25:09
[DoS Attack: ACK Scan] from source: 190.106.206.50, port 443, Friday, May 03, 2019 11:24:26
[DoS Attack: ACK Scan] from source: 216.220.61.236, port 8190, Friday, May 03, 2019 11:22:38
[DoS Attack: SYN/ACK Scan] from source: 203.107.43.194, port 1321, Friday, May 03, 2019 11:02:40
[DoS Attack: ACK Scan] from source: 216.220.61.236, port 8190, Friday, May 03, 2019 10:54:41
[DoS Attack: ACK Scan] from source: 17.249.156.78, port 5223, Friday, May 03, 2019 10:53:52
[DoS Attack: ACK Scan] from source: 216.220.61.236, port 8190, Friday, May 03, 2019 10:52:11
[DoS Attack: ACK Scan] from source: 199.167.65.24, port 443, Friday, May 03, 2019 10:51:34
[DoS Attack: ACK Scan] from source: 216.220.61.236, port 8190, Friday, May 03, 2019 10:50:55
[DoS Attack: ACK Scan] from source: 216.220.61.236, port 8190, Friday, May 03, 2019 10:49:40
[DoS Attack: ACK Scan] from source: 199.167.65.24, port 443, Friday, May 03, 2019 10:49:34
[DoS Attack: ACK Scan] from source: 216.220.61.236, port 8190, Friday, May 03, 2019 10:48:25
[DoS Attack: ACK Scan] from source: 199.167.65.24, port 443, Friday, May 03, 2019 10:47:34
[Time synchronized with NTP server] Friday, May 03, 2019 10:45:44
[Initialized, firmware version: V2.3.1.44] Friday, May 03, 2019 10:45:28
I know I can't stop DoS, but I should not have to be dealing with frequent reboots.
For sure, I had an RBK20W set before the RBK50. I never had any issues with it and have no doubt that if I had quick access to another set that it would be fine. Also, turns out that Target just let me return the product since it was 90 days within the purchase date. I did not want to ship it the device out at my expense for some amount of time. Rather, all Target had was the RBK20W in stock, so I just went back to that and saved 100 dollars. The RBK50 was truly over kill for my house anyway..I really wanted it for the upscale ethernet bridge over 5ghz :( ....can't really find that anywhere else that easy and price. It is for cameras. I ended up putting my 2.4ghz wireless ethernet bridge back in place to feed the camera switch. There just aren't too many systems consumer wise that have the dedcated backhaul. Thank you for your replies.
15 Replies
What Firmware is currently loaded?
What is the Mfr and model# of the ISP modem the NG router is connected too?Contact your ISP and have them change your WAN IP address your Modem/ONT gets.
Use Domaintools.com to see where those IP addresses are coming from.
Router Firmware Version
V2.3.1.44ZHONE...wait..just reading the rest of your post..this isn't going to help in my situation. I am an IT guy, so I understand how this stuff works..just not why the devices are rebooting when my previous ones were not on the same ISP/modem. I am on fiber 500/500.
When the system reboots, it is pulling a different WAN address (I've checked) simply because it rebooted and, being residential service, I'm not paying for a static address.I've already checked out where those attacks are coming from, but it's not really anything I can use with the Orbi system... I saw the main hits coming from Canada and some from New Jersey USA.
This has happened across mutiple firmwares on this system.
Have you factory reset the RBR and setup from scratch since you updated to v44? Try this.
Might try upgrading to v60.
Again, contact your ISP.
xtract wrote:
............ I am frequently getting logs about DoS attempts, however, the router is rebooting almost every day.
............
I doubt that Orbi is rebooting because of the DoS attacks.
Softwre 2.3.1.44 and .48 has issues, please see the following post:
https://community.netgear.com/t5/Orbi/Resolving-RBR-RBS50-dropouts-my-experience/m-p/1745653#M60777
