NETGEAR is aware of a growing number of phone and online scams. To learn how to stay safe click here.
Forum Discussion
Connection repeatedly dropping on mesh network from satellite
I purchased a Nighthawk MR70 and MS70.
I configured my MS70 to run ethernet to my PC. The PC keeps a static IP address and is the only device on the network to do so.
Both the MR70 and MS70 are running on the following firmware: V1.0.3.34_2.0.58 (or at least I believe they are. The Router Update page says V1.0.3.34 and that no new firmware is available for both devices, but I was only to find the very detailed firmware for the router.
My logs don't seem to show anything too suspicious:
The most common looks like this, but this is most likely a false positive.
[DoS attack: ACK Scan] from source ****, port 443
Nothing else in the logs seems to indicate an attack and it repeatedly drops - seemingly only for the PC.
Two questions:
1) Would setting a static IP to the satellite that provides the PC it's static IP resolve this and, if not, what would?
and
2) Is there a way to implement a more robust logging setup on the router? Possibly through console?
4 Replies
Netgear's firmware is great at creating false reports of DoS attacks. Many of them are no such thing.
Use Whois.net to see who is behind some of them and you may find that they are from places like Facebook, Google, even your ISP.
Two questions:
1) Would setting a static IP to the satellite that provides the PC it's static IP resolve this and, if not, what would?
and
2) Is there a way to implement a more robust logging setup on the router? Possibly through console?
Resolve what? Your subject says "Connection repeatedly dropping on mesh network from satellite".
What drops? Wifi? Any more clues? All wifi clients? Any error messages?
The IP address shouldn't influence things. (Is it fixed on the PC or reserved on the router?)
Not sure what you mean by "more robust logging". Everything that you can do with the router is there in the browser graphical user interface (GUI).
I assume that this is where you are looking.
Thanks for your reply. I figured it was a false positive.
Q: Is it fixed on the PC or reserved on the router?
A: The IP Address is reserved on the router. The PC is the only device connected by LAN to the satellite and, seemingly, the only device that consistently loses connection. My partner uses the WiFi as she is closer to that router and has only rarely suffered an outage - which is usually due to the ISP having an issue.Q: More robust logging?
A: In terms of more robust logging - I'm referring to the logs I see in my corporate setting. However, those are through PAN. I'm not sure if the Nighthawk MR70/MS70s or Nighthawk Netgear GUI records as much data.
Q: Resolve what? Your subject says "Connection repeatedly dropping on mesh network from satellite".
A: Sorry for not being clear enough. I was asking if setting my satellite to a reserved IP address could help resolve the connection dropping to the PC that it is connected to by ethernet.
To illustrate (poorly): [ MR70 ] --) ) Wireless) ) -- [ MS 70]==Ethernet==[PC]Q: What drops? The WiFi? any more clues?
The issue seems to lie in anything connected to the MS70 by ethernet, which is only the PC. The satellite drops the connection, and, obviously, the PC loses connection. The satellite is positioned so that I can see the light turn blue to solid amber when network traffic grinds to a halt or experiences issues. It doesn't ever pulse amber and does not pulse white. The devices that also use the MS70 by WiFi do not lose signal as far as I can tell.
My PC reserves a static IP, and I use OpenVPN to attempt to remotely log in while away. I do not think OpenVPN is the issue as this is a recent add to the environment, but this issue has been ongoing for weeks prior. Additionally, the PC does run virtual machines - typically Linux images, though I do have a virtual server set up on it that I use for practicing/education and is only rarely turned on (and never when this is running). I occasionally use another VPN as well - but again, never when this occurs.
Q: About the logs
A: In terms of the log information, the only two things I see are
- DHCP IP *** to MAC address: *****, and dates {All of this is standard, to my knowledge}- DoS Attack ****, port 443 {As we discussed likely false positive}
There is one majorly suspect thing: The dates are wrong on occasion. I've included an example of the ACK scan, which is associated with Amazon.
Here's a quick snip, formatting my own:
[DoS attack: ACK Scan] from source 18.238.4.18,port 443 Wednesday, Sep 06,2023 21:58:44 <- Actually correct date.
[Time synchronized with NTP server] Thursday, Oct 26,2023 15:01:30
[Internet connected] IP address: *****, Thursday, Oct 26,2023 15:01:30
[Internet disconnected] Thursday, Oct 26,2023 15:01:10
[DHCP IP: (****)] to MAC address ****, Thursday, Oct 26,2023 15:01:07
[DHCP IP: (****)] to MAC address *****, Thursday, Oct 26,2023 15:01:06
[DHCP IP: (****)] to MAC address *****, Thursday, Oct 26,2023 15:01:05
[OPENVPN] NTP sync time failed. Get correct system time then reconnect. Thursday, Oct 26,2023 15:01:04
[DHCP IP: (****)] to MAC address *****, Thursday, Oct 26,2023 15:01:04
[Initialized, firmware version: V1.0.3.34_2.0.58] Thursday, Oct 26,2023 15:01:03
a_h_s wrote:
The issue seems to lie in anything connected to the MS70 by ethernet, which is only the PC. The satellite drops the connection, and, obviously, the PC loses connection. The satellite is positioned so that I can see the light turn blue to solid amber when network traffic grinds to a halt or experiences issues.
Oh dear. One of them. Never the easiest problems to pin down.
I assume that the MS70 is on wifi to the MR70.
I'd assumed that you would plug the PC into the MR70.
I have no idea how that would play with a device with a fixed address. The "reserved" word is usually associated with setting it on the router. You could try that instead. It should have the same result.
The recommended topology is to wire the satellite to the router. That gets better speed and is more reliable. As it is, you are hit by the wifi link between the router and the satellite.
As an experiment, what happens when you connect the PC to the wifi?
The devices that also use the MS70 by WiFi do not lose signal as far as I can tell.Seems odd when the satellite appears to disconnect. Are you sure that things are connecting to the router?
My PC reserves a static IP, and I use OpenVPN to attempt to remotely log in while away. I do not think OpenVPN is the issue as this is a recent add to the environment, but this issue has been ongoing for weeks prior. Additionally, the PC does run virtual machines - typically Linux images, though I do have a virtual server set up on it that I use for practicing/education and is only rarely turned on (and never when this is running). I occasionally use another VPN as well - but again, never when this occurs.
Talk of VPNs takes us into what is, for me, alien territory. I have no idea now they are likely to affect things.
