NETGEAR is aware of a growing number of phone and online scams. To learn how to stay safe click here.

Forum Discussion

BigMoneyTK's avatar
BigMoneyTK
Aspirant
Mar 27, 2018
Solved

HTB: quantum of class 11024 is big. Losing internet

I have several loose internet connection intermittenly. The log shows this, HTB: quantum of class 11024 is big consider r2q change. Also could show 11024 instead of 10001 or both. I'm looking for a s...
Solutions
Troubleshooting
  • DaneA's avatar
    DaneA
    May 03, 2018

    BigMoneyTK,

     

    Hi! Thank's for solution.

    I'm doing a follow up to see any more error so far, still watching this log : 

    Tue Apr 17 11:29:31 2018((GMT-0300)) [FVS336GV3][Kernel][KERNEL] xt_TCPMSS: bad length (209 bytes)
    Tue Apr 17 11:25:06 2018((GMT-0300)) [FVS336GV3][Kernel][KERNEL] xt_TCPMSS: bad length (209 bytes)
    Tue Apr 17 08:34:25 2018((GMT-0300)) [FVS336GV3][Kernel][KERNEL] xt_TCPMSS: bad length (552 bytes)
    Mon Apr 16 18:24:19 2018((GMT-0300)) [FVS336GV3][Kernel][KERNEL] xt_TCPMSS: bad length (324 bytes)

    As I have mentioned from my previous response, there might be possible that there is a DDOS attack. It is similar to the concern posted on the forum thread here.  The logs states that the firewall received an improperly formatted TCP packet.  It might be a hacker probing the firewall to see if it can breach the firewall's security. The firewall handles this correctly in which it discards the packet without any harm.  

     

     

    Regards,

     

    DaneA

    NETGEAR Community Team

DaneA's avatar
DaneA
NETGEAR Employee Retired
Mar 29, 2018

Hi BigMoneyTK,

 

Welcome to the community! :) 

 

Let us isolate the problem.  Kindly answer the questions below:

 

a. Disconnect the FVS336Gv3 from the modem.  Then, connect a PC directly to the modem and observe if the internet connection is stable.  Is the internet connection fine when connected directly to the modem?

 

b. The modem where the FVS336Gv3 is connected to, is it a modem-only device or a combination of modem-router?

 

c. Are you using the DNS provided by your ISP?  If yes, kindly try using Google DNS such as 8.8.8.8 or 8.8.4.4 then observe the internet connection as well as if the same logs will show up. 

 

d. Since you mentioned, "When I connect two Wan connections, it drops," are you subscribed to 2 different ISPs?  

 

e. Are there firewall rules configured on the FVS336Gv3?  If yes, kindly try to disable (or delete) it then observe the internet connection through the FVS336Gv3 as well as if the same logs will appear.

 

f. Are there requests from an unknown Public IP address?  To check this, on the web-GUI of the FVS336Gv3, go to Monitoring > Firewall Logs & E-mail.  Then, under the Accepted Packets section, check the boxes on both LAN-to-WAN and WAN-to-LAN. 

 

 

Regards,


DaneA

NETGEAR Community Team

BigMoneyTK's avatar
BigMoneyTK
Aspirant
Apr 05, 2018

I'm sorry for the delay, follow the answers below :

 

a. Disconnect the FVS336Gv3 from the modem.  Then, connect a PC directly to the modem and observe if the internet connection is stable.  Is the internet connection fine when connected directly to the modem? 

Positive, the internet connections keep stable. In both connections.

 

b. The modem where the FVS336Gv3 is connected to, is it a modem-only device or a combination of modem-router?

Modem-only

 

 

c. Are you using the DNS provided by your ISP?  If yes, kindly try using Google DNS such as 8.8.8.8 or 8.8.4.4 then observe the internet connection as well as if the same logs will show up. 

I put the google dns and it looked like it had normalized, but today it came back the problem

 

d. Since you mentioned, "When I connect two Wan connections, it drops," are you subscribed to 2 different ISPs?  

Yes, i use load balance - weighted LB

 

e. Are there firewall rules configured on the FVS336Gv3?  If yes, kindly try to disable (or delete) it then observe the internet connection through the FVS336Gv3 as well as if the same logs will appear.

ok, it was all right, but now you have these errors : 

 

Thu Apr 5 11:19:40 2018((GMT-0300)) [FVS336GV3][Kernel][KERNEL] xt_TCPMSS: bad length (209 bytes)
Thu Apr 5 11:09:40 2018((GMT-0300)) [FVS336GV3][Kernel][KERNEL] xt_TCPMSS: bad length (209 bytes)
Thu Apr 5 11:06:55 2018((GMT-0300)) [FVS336GV3][Kernel][KERNEL] HTB: quantum of class 11024 is big. Consider r2q change.
Thu Apr 5 11:06:55 2018((GMT-0300)) [FVS336GV3][Kernel][KERNEL] HTB: quantum of class 10001 is big. Consider r2q change.
Thu Apr 5 11:06:55 2018((GMT-0300)) [FVS336GV3][Kernel][KERNEL] p->perfect 0000000000000000 p->h a800000004a02e00
Thu Apr 5 11:06:55 2018((GMT-0300)) [FVS336GV3][Kernel][KERNEL] tcindex_dump(tp a8000000025f9780,fh 0x0,skb a800000005451380,t a800000003ac7010),p a800000006f74a00,r 0000000000000000,b a800000003ac7038
Thu Apr 5 11:06:55 2018((GMT-0300)) [FVS336GV3][Kernel][KERNEL] tcindex_change(tp a8000000025f9780,handle 0x00000000,tca a800000007c05a80,arg a8000000028f3950),opt a800000005311a30,p a800000006f74a00,r 0000000000000000,*arg 0x0
Thu Apr 5 11:06:55 2018((GMT-0300)) [FVS336GV3][Kernel][KERNEL] tcindex_get(tp a8000000025f9780,handle 0x00000000)
Thu Apr 5 11:06:55 2018((GMT-0300)) [FVS336GV3][Kernel][KERNEL] tcindex_init(tp a8000000025f9780)
Thu Apr 5 11:06:55 2018((GMT-0300)) [FVS336GV3][Kernel][KERNEL] tcindex_delete(tp a800000003a83f80,arg 0xa800000006f74a08),p a8000000025f9780,f 0000000000000000
Thu Apr 5 11:06:55 2018((GMT-0300)) [FVS336GV3][Kernel][KERNEL] tcindex_walk(tp a800000003a83f80,walker a80000000251f900),p a8000000025f9780
Thu Apr 5 11:06:55 2018((GMT-0300)) [FVS336GV3][Kernel][KERNEL] tcindex_destroy(tp a800000003a83f80),p a8000000025f9780
Thu Apr 5 11:05:55 2018((GMT-0300)) [FVS336GV3][Kernel][KERNEL] HTB: quantum of class 11024 is big. Consider r2q change.
Thu Apr 5 11:05:55 2018((GMT-0300)) [FVS336GV3][Kernel][KERNEL] HTB: quantum of class 10001 is big. Consider r2q change.
Thu Apr 5 11:05:55 2018((GMT-0300)) [FVS336GV3][Kernel][KERNEL] p->perfect 0000000000000000 p->h a800000004e92800
Thu Apr 5 11:05:55 2018((GMT-0300)) [FVS336GV3][Kernel][KERNEL] tcindex_dump(tp a800000003a83f80,fh 0x0,skb a800000002ccb200,t a8000000037f9010),p a8000000025f9780,r 0000000000000000,b a8000000037f9038
Thu Apr 5 11:05:55 2018((GMT-0300)) [FVS336GV3][Kernel][KERNEL] tcindex_change(tp a800000003a83f80,handle 0x00000000,tca a800000007c05a80,arg a8000000038f7950),opt a800000004a02a30,p a8000000025f9780,r 0000000000000000,*arg 0x0
Thu Apr 5 11:05:55 2018((GMT-0300)) [FVS336GV3][Kernel][KERNEL] tcindex_get(tp a800000003a83f80,handle 0x00000000)
Thu Apr 5 11:05:55 2018((GMT-0300)) [FVS336GV3][Kernel][KERNEL] tcindex_init(tp a800000003a83f80)
Thu Apr 5 11:05:10 2018((GMT-0300)) [FVS336GV3][Kernel][KERNEL] IPsec: device unregistering: ppp1
Thu Apr 5 11:05:10 2018((GMT-0300)) [FVS336GV3][Kernel][KERNEL] tcindex_delete(tp a800000006f70e00,arg 0xa800000006cfdd08),p a800000003826e80,f 0000000000000000
Thu Apr 5 11:05:10 2018((GMT-0300)) [FVS336GV3][Kernel][KERNEL] tcindex_walk(tp a800000006f70e00,walker a8000000028f3d00),p a800000003826e80
Thu Apr 5 11:05:10 2018((GMT-0300)) [FVS336GV3][Kernel][KERNEL] tcindex_destroy(tp a800000006f70e00),p a800000003826e80
Thu Apr 5 11:05:10 2018((GMT-0300)) [FVS336GV3][Kernel][KERNEL] IPsec: device down: ppp1
Thu Apr 5 10:50:52 2018((GMT-0300)) [FVS336GV3][Kernel][KERNEL] HTB: quantum of class 11024 is big. Consider r2q change.
Thu Apr 5 10:50:52 2018((GMT-0300)) [FVS336GV3][Kernel][KERNEL] HTB: quantum of class 10001 is big. Consider r2q change.
Thu Apr 5 10:50:52 2018((GMT-0300)) [FVS336GV3][Kernel][KERNEL] p->perfect 0000000000000000 p->h a800000004a02600
Thu Apr 5 10:50:52 2018((GMT-0300)) [FVS336GV3][Kernel][KERNEL] tcindex_dump(tp a800000006f70e00,fh 0x0,skb a8000000062c2c80,t a8000000031fc010),p a800000003826e80,r 0000000000000000,b a8000000031fc038
Thu Apr 5 10:50:52 2018((GMT-0300)) [FVS336GV3][Kernel][KERNEL] tcindex_change(tp a800000006f70e00,handle 0x00000000,tca a800000007c05a80,arg a800000002d33950),opt a800000004e92630,p a800000003826e80,r 0000000000000000,*arg 0x0
Thu Apr 5 10:50:52 2018((GMT-0300)) [FVS336GV3][Kernel][KERNEL] tcindex_get(tp a800000006f70e00,handle 0x00000000)
Thu Apr 5 10:50:52 2018((GMT-0300)) [FVS336GV3][Kernel][KERNEL] tcindex_init(tp a800000006f70e00)
Thu Apr 5 10:48:27 2018((GMT-0300)) [FVS336GV3][Kernel][KERNEL] IPsec: device unregistering: ppp1
Thu Apr 5 10:48:27 2018((GMT-0300)) [FVS336GV3][Kernel][KERNEL] tcindex_delete(tp a8000000027d7d00,arg 0xa800000003965708),p a800000006f08b00,f 0000000000000000
Thu Apr 5 10:48:27 2018((GMT-0300)) [FVS336GV3][Kernel][KERNEL] tcindex_walk(tp a8000000027d7d00,walker a800000002d33d00),p a800000006f08b00
Thu Apr 5 10:48:27 2018((GMT-0300)) [FVS336GV3][Kernel][KERNEL] tcindex_destroy(tp a8000000027d7d00),p a800000006f08b00
Thu Apr 5 10:48:27 2018((GMT-0300)) [FVS336GV3][Kernel][KERNEL] IPsec: device down: ppp1
Thu Apr 5 09:41:32 2018((GMT-0300)) [FVS336GV3][Kernel][KERNEL] HTB: quantum of class 11024 is big. Consider r2q change.
Thu Apr 5 09:41:32 2018((GMT-0300)) [FVS336GV3][Kernel][KERNEL] HTB: quantum of class 10001 is big. Consider r2q change.
Thu Apr 5 09:41:32 2018((GMT-0300)) [FVS336GV3][Kernel][KERNEL] p->perfect 0000000000000000 p->h a800000004a02200
Thu Apr 5 09:41:32 2018((GMT-0300)) [FVS336GV3][Kernel][KERNEL] tcindex_dump(tp a8000000027d7d00,fh 0x0,skb a800000002845680,t a800000002e35010),p a800000006f08b00,r 0000000000000000,b a800000002e35038
Thu Apr 5 09:41:32 2018((GMT-0300)) [FVS336GV3][Kernel][KERNEL] tcindex_change(tp a8000000027d7d00,handle 0x00000000,tca a800000007c05a80,arg a800000002b07950),opt a800000004a02030,p a800000006f08b00,r 0000000000000000,*arg 0x0
Thu Apr 5 09:41:32 2018((GMT-0300)) [FVS336GV3][Kernel][KERNEL] tcindex_get(tp a8000000027d7d00,handle 0x00000000)
Thu Apr 5 09:41:32 2018((GMT-0300)) [FVS336GV3][Kernel][KERNEL] tcindex_init(tp a8000000027d7d00)
Thu Apr 5 09:39:27 2018((GMT-0300)) [FVS336GV3][Kernel][KERNEL] IPsec: device unregistering: ppp1
Thu Apr 5 09:39:27 2018((GMT-0300)) [FVS336GV3][Kernel][KERNEL] tcindex_delete(tp a8000000027d7480,arg 0xa800000001756d88),p a800000006f08280,f 0000000000000000
Thu Apr 5 09:39:27 2018((GMT-0300)) [FVS336GV3][Kernel][KERNEL] tcindex_walk(tp a8000000027d7480,walker a8000000034cbd00),p a800000006f08280
Thu Apr 5 09:39:27 2018((GMT-0300)) [FVS336GV3][Kernel][KERNEL] tcindex_destroy(tp a8000000027d7480),p a800000006f08280
Thu Apr 5 09:39:27 2018((GMT-0300)) [FVS336GV3][Kernel][KERNEL] IPsec: device down: ppp1
Thu Apr 5 08:16:57 2018((GMT-0300)) [FVS336GV3][Kernel][KERNEL] xt_TCPMSS: bad length (68 bytes)
Thu Apr 5 03:40:42 2018((GMT-0300)) [FVS336GV3][Kernel][KERNEL] HTB: quantum of class 11024 is big. Consider r2q change.
Thu Apr 5 03:40:42 2018((GMT-0300)) [FVS336GV3][Kernel][KERNEL] HTB: quantum of class 10001 is big. Consider r2q change.
Thu Apr 5 03:40:42 2018((GMT-0300)) [FVS336GV3][Kernel][KERNEL] p->perfect 0000000000000000 p->h a800000005311e00
Thu Apr 5 03:40:42 2018((GMT-0300)) [FVS336GV3][Kernel][KERNEL] tcindex_dump(tp a8000000027d7480,fh 0x0,skb a8000000062c4200,t a800000002628010),p a800000006f08280,r 0000000000000000,b a800000002628038
Thu Apr 5 03:40:42 2018((GMT-0300)) [FVS336GV3][Kernel][KERNEL] tcindex_change(tp a8000000027d7480,handle 0x00000000,tca a800000007c05a80,arg a800000002aab950),opt a800000004a02030,p a800000006f08280,r 0000000000000000,*arg 0x0
Thu Apr 5 03:40:42 2018((GMT-0300)) [FVS336GV3][Kernel][KERNEL] tcindex_get(tp a8000000027d7480,handle 0x00000000)
Thu Apr 5 03:40:42 2018((GMT-0300)) [FVS336GV3][Kernel][KERNEL] tcindex_init(tp a8000000027d7480)
Thu Apr 5 03:39:12 2018((GMT-0300)) [FVS336GV3][Kernel][KERNEL] IPsec: device unregistering: ppp1
Thu Apr 5 03:39:12 2018((GMT-0300)) [FVS336GV3][Kernel][KERNEL] IPsec: device down: ppp1
Thu Apr 5 02:40:47 2018((GMT-0300)) [FVS336GV3][Kernel][KERNEL] IPsec: device unregistering: ppp1
Thu Apr 5 02:40:47 2018((GMT-0300)) [FVS336GV3][Kernel][KERNEL] tcindex_delete(tp a800000004f4e400,arg 0xa800000003edb288),p a8000000027d7180,f 0000000000000000
Thu Apr 5 02:40:47 2018((GMT-0300)) [FVS336GV3][Kernel][KERNEL] tcindex_walk(tp a800000004f4e400,walker a800000002413d00),p a8000000027d7180
Thu Apr 5 02:40:47 2018((GMT-0300)) [FVS336GV3][Kernel][KERNEL] tcindex_destroy(tp a800000004f4e400),p a8000000027d7180
Thu Apr 5 02:40:42 2018((GMT-0300)) [FVS336GV3][Kernel][KERNEL] IPsec: device down: ppp1

 

f. Are there requests from an unknown Public IP address?  To check this, on the web-GUI of the FVS336Gv3, go to Monitoring > Firewall Logs & E-mail.  Then, under the Accepted Packets section, check the boxes on both LAN-to-WAN and WAN-to-LAN. 

I dit it now

 

  • DaneA's avatar
    DaneA
    NETGEAR Employee Retired
    Apr 12, 2018

    BigMoneyTK,

     

    I apologize for the late response.  

     

    Thu Apr 5 11:19:40 2018((GMT-0300)) [FVS336GV3][Kernel][KERNEL] xt_TCPMSS: bad length (209 bytes)
    Thu Apr 5 11:09:40 2018((GMT-0300)) [FVS336GV3][Kernel][KERNEL] xt_TCPMSS: bad length (209 bytes)

    It might be possible that there is a DDOS attack. It is similar to the concern posted on the forum thread here.

     

    Thu Apr 5 11:06:55 2018((GMT-0300)) [FVS336GV3][Kernel][KERNEL] HTB: quantum of class 10001 is big. Consider r2q change.
    Thu Apr 5 11:06:55 2018((GMT-0300)) [FVS336GV3][Kernel][KERNEL] p->perfect 0000000000000000 p->h a800000004a02e00
    Thu Apr 5 11:06:55 2018((GMT-0300)) [FVS336GV3][Kernel][KERNEL] tcindex_dump(tp a8000000025f9780,fh 0x0,skb a800000005451380,t a800000003ac7010),p a800000006f74a00,r 0000000000000000,b a800000003ac7038
    Thu Apr 5 11:06:55 2018((GMT-0300)) [FVS336GV3][Kernel][KERNEL] tcindex_change(tp a8000000025f9780,handle 0x00000000,tca a800000007c05a80,arg a8000000028f3950),opt a800000005311a30,p a800000006f74a00,r 0000000000000000,*arg 0x0
    Thu Apr 5 11:06:55 2018((GMT-0300)) [FVS336GV3][Kernel][KERNEL] tcindex_get(tp a8000000025f9780,handle 0x00000000)
    Thu Apr 5 11:06:55 2018((GMT-0300)) [FVS336GV3][Kernel][KERNEL] tcindex_init(tp a8000000025f9780)
    Thu Apr 5 11:06:55 2018((GMT-0300)) [FVS336GV3][Kernel][KERNEL] tcindex_delete(tp a800000003a83f80,arg 0xa800000006f74a08),p a8000000025f9780,f 0000000000000000
    Thu Apr 5 11:06:55 2018((GMT-0300)) [FVS336GV3][Kernel][KERNEL] tcindex_walk(tp a800000003a83f80,walker a80000000251f900),p a8000000025f9780
    Thu Apr 5 11:06:55 2018((GMT-0300)) [FVS336GV3][Kernel][KERNEL] tcindex_destroy(tp a800000003a83f80),p a8000000025f9780

    These logs are similar to the logs that was posted on the old forum post here.  The forum user 'WANAO' posted the solution he did wherein he changed the NTP settings and that solved the issue. 

     

     

    Regards,


    DaneA

    NETGEAR Community Team

    • DaneA's avatar
      DaneA
      NETGEAR Employee Retired
      Apr 16, 2018

      @BigMoneyTK,

       

      I just want to follow-up on this.  We’d greatly appreciate hearing your feedback

       

      Otherwise, if ever your concern has been addressed or resolved, I encourage you to mark the appropriate reply as the “Accepted Solution” so others can be confident in benefiting from the solution. The NETGEAR Community looks forward to hearing from you and being a helpful resource in the future!

       


      Regards,

       

      DaneA

      NETGEAR Community Team

NETGEAR Academy

Boost your skills with the Netgear Academy - Get trained, certified and stay ahead with the latest Netgear technology! 

Join Us!

ProSupport for Business

Comprehensive support plans for maximum network uptime and business peace of mind.

 

Learn More