Netgear router models are RAX45-100NAS and RAX54-100NAS

Hi NetGear Community,

Allen_non here.  I am a competent computer user, mechanical engineer, etc, so I can interact with my routers, but I don’t understand the “deep magic”, ie port forwarding, bridges, channels, etc.  As such, I leave settings as factory default if I don’t know what they do.  I do have all my routers set for MAC filtering to block any devices whose MAC addresses are not recorded in the Approved Device List.

I believe I’m encountering a very similar issue as “So_tired”.

Issue:

After running fine for several years, about 6 weeks ago, my 2 Netgear routers lose internet connection regularly and precisely every Tuesday around 12:25 PM EDT (daylight saving time).  At that time, our NG routers lose internet and have to be rebooted to fix.  I have not waited for extended times to see if they recover on their own, as several family members work from home and need the connection restored pronto.

When I checked the router logs, they show several hundred entries starting around 12:25 PM.  A few sample lines read:

[DoS attack: Fraggle Attack] from source 192.168.1.254,port 67 Tuesday, Aug 05, 2025 11:29:53

[DoS attack: NetBiosReplyDrop] from source 10.0.0.3,port 137 Tuesday, Aug 05, 2025 11:29:47

whereas the vast majority of lines read :

[DoS attack: TCP SYN Flood] from source 192.168.1.254,port 38200 Tuesday, Aug 05, 2025 16:23:37

Set up:

ISP is ATT fiber going to ATT provided router (Arris BGW210).   Arris “feeds” via ethernet my two NetGear routers, RAX45-100NAS  and RAX54-100NAS.  All 3 routers update their firmware automatically, and I recently verified they are all up to date.

I have very little running on the Arris.  It supplies connection to the Netgears.  I can access it via wifi or ethernet for checking settings, etc, but I generally just use it as “gateway”.

Netgear RAX-45 is used for home office, connecting 2 desktops via ethernet, and a couple of laptops via wifi.  Other than that, I keep extraneous devices off this router.

RAX-54 is in our living room and networks all our various devices such as smart switches, thermostats, wifi cameras, phones, etc.

Note:  I have one old Netgear R7000 router that is connected to RAX-45, that connects to our Ooma VOIP box and a 3D printer that is only on when I’m printing.  Even while the RAX-45 seems to lose connectivity, the R7000 seems to maintain its connection.

I have no idea how to fix this, and appreciate any help you all have.  I’d rather not have to buy 2 new routers.  Nothing has materially changed in the last 6 weeks that I can think of.  All routers have been rebooted several times.  I can get you .cfg files and or log files if that will help.  Thanks in advance!

~Allen

Both the RAX45 and the RAX54 are in 'router mode', correct?  (the default)

The Arris router has assigned IP addresses to the RAX45 and RAX54 in the 192.168.1.x IP subnet?

Both the RAX45 and the RAX54 have created local networks using the 10.0.0.x subnet?

Hi, yes, both 45 & 54 are in router mode.  I'm pretty sure the Arris is assigning the IP addresses.  I know one of the Log entries I referenced above indicates the TCP SYN Flood is from source 192.168.1.254.  How would I check that?

I can confirm that the both the 45 & 54 are assigning local IP's in the 10.0.0.x subnets.

Your profile pic looks a lot like my orange & white manx.  One of the best friends I've ever had.

(I replied earlier but my reply seems to have been dropped.  Sorry if this gets duplicated) 

Hi, yes, both are in router mode.  As far as I know, the Arris is assigning the IPs to the Netgears.  On the "Internet" tab for the RAX45, it is showing "Get Dynamically from ISP" selected, with IP 192.168.1.121, and Gateway IP of 192.168.1.254.   I'd have to log in to the RAX 54 to verify it's properties, but I'm pretty sure it's set up the same way.

Incidentally, the log indicates that "[DoS attack: TCP SYN Flood] from source 192.168.1.254, port 38200" with many more lines showing many other ports.

I can confidently say both NG routers are generating device IP addresses in the 10.0.0.x subnet.

The profile pic of your cat reminds me of my orange/ white Manx cat.  One of the best friends I've ever had on 4 legs or 2 legs.

Whatever is being detected by the two Netgear routers is either:

• Originating in the Arris router (192.168.1.254), or is
• Passing through the Arris router,or is
• Originating from another device connected to the RAX router (i.e. [DoS attack: NetBiosReplyDrop] from source 10.0.0.3,port 137] )
  For these, the first step is to identify what devices has IP 10.0.0.3 and why some other device would be attempting to connect to it with NetBios.

Both the Arris and the Netgear routers use Network Address Translation (NAT) which results in devices "upstream" of the router seeing packets originating from only one IP address.

https://en.wikipedia.org/wiki/Network_address_translation

In this case, there is one "Double NAT" and one "Triple NAT".

Thus, the Arris sees only two devices connected directly to it:

• IP 192.168.1.121 (the RAX45), and
  (the R7000 and devices connected to it appear to the Arris as 192.168.1.121 with port numbers created by NAT.)
• IP 192.168.1.xxx (the RAX54)

It would be interesting to know if the Arris router has a Firewall feature similar to the RAX.  i.e. does the Arris "log" suspicious packets.  If it does, then one would expect to observe similar records on the Arris that will correspond with the events in the RAX log.

When someone "out there" in the internet is messing around, they have only the public IP address (the Arris).  There would be no obvious way to figure out what port number to use to hack at the RAX45 or the RAX54.

I have a suspicion that some devices connected to the RAX45 and RAX54 have opened connections to their "cloud service" and that the cloud is attempting to communicate by sending packets to the Arris IP address with the port number that has been created (by "Double NAT" - one NAT by the RAX45, a second NAT by the Arris) and that the RAX45 is falsely detecting those as attacks.

The way Netgear router firewalls are supposed to work is: when packets arrive at the firewall:

• If they are addressed to an existing open connection created by a device connected to the router, they are accepted by the router, the IP address & port are changed by the NAT process to match the desired device, and they are sent through the network to that device.
• If they are addressed to the public IP address and match a Port Forwarding rule, they are send through the network to the internal IP address matching that rule.
• If they are not addressed to an existing connection and they do not match a Port Forwarding rule, they are simply rejected.  The firewall may "log" them, but they go nowhere.

My assumption is that the Arris would have a similar firewall.

CrimpOn, thanks for your help with this!  How you can read someone else's network woes and make sense of it is quite impressive!

I do know that the 10.0.0.3 is my work laptop that I was using today to monitor the office router (RAX-45) logs looking for the precise moment the DoS attack began.  It is set up by my employer's IT group, and should be pretty secure.

However, on prior Tuesdays when this occurs (always around 12:25pm), I have been at work, so my work laptop could not possibly have been part of the equation for those days.

I have had similar thoughts that maybe one of my wifi devices was communicating on its on volition to the "cloud", but none of those devices are connected to my office router RAX45.  All those devices (smart thermostat, smart switches, phones, Roku, etc) are all on the living room router (RAX54) for that very reason.  I wanted to keep any "sketchy" wifi devices away from my secure ones by keeping on separate routers.

I'll check my Arris to have a look at its firewall.  Can you tell me what I should be looking for?

Also, the fact that both Netgear routers go down at the same time, same day, every week is intriguing to me.  It would seem there is some sort of schedule involved.  That first lead me to check the firmware updates, in case the updates are sent out at 12:20 pm every Tuesday and my routers stumbling on the update.  But, they are all up to date, as is my Arris.  My thermostats and cameras do communicate their data thru the router to the cloud, I guess, but again, they are on RAX54, so shouldn't affect RAX45 I would think.

I'm already learning from you, and though this isn't sorted yet, I very much appreciate your help!  Let me know what info you need from me.  I can get you router .cfg files, router event logs, etc.

Thanks,  Allen

I am not familiar with the RAX router web interface.  (and, I'm too cheap to buy one)  On Orbi systems, there is an "Advanced Tab" that shows information about the WAN interface, specifically when the router received an IP address from the upstream router, how long the lease was for, and when it will expire.

My ISP (Spectrum) assigns my Orbi router an IPv4 lease for 86,400 seconds (one day) and an IPv6 lease for 604,800 seconds (one week).  If the router follows the DHCP protocol correctly, it will seek to renew the IPv4 lease in 12 hours and the IPv6 lease in 3 1/2 days.  (I have verified this by observing the Ethernet link between Orbi router and Spectrum modem.)

Can you provide more detail about what happens every week.  i.e.

• Both routers (RAX45 and RAX54) stop broadcasting their WiFi signals
• What happens to devices that are 'wired' to those two routers?

By chance is IPv6 enabled or disabled on these routers?

Great detail. Thanks.

• All of these WiFi routers use the same WiFi credentials? (SSID/password), or are they different?
• Eager to hear if IPv6 is enabled on the RAX routers.**
• Can you access the management interface of the Arris router?  During these episodes, does the Arris have a way to display information about "connected devices"?
• Because all three of your routers are connected to the Arris router, it should be possible for a computer connected to the R7000 to 'ping' the WAN interface of the two RAX routers.  (i.e. the IP address assigned to them by the Arris.)

I have a suspicion that the "flood" is a result of the RAX routers not responding to the Fios router, causing the Fios to keep asking, "are you there?"

https://en.wikipedia.org/wiki/SYN_flood  The flood may be a symptom of the underlying problem, not the cause.

** IPv6 appears to be a "hot topic" on the Forum these days.  I, personally, have had IPv6 enabled on my aging Orbi router with Spectrum for YEARS and never notice any issues, but the Forum seems to have a lot of discussion about IPv6.  If it IS enabled on those RAX routers, maybe turning it off would be a useful experiment.

Forgot to mention-  each router has unique SSID/ passwords, credentials, etc.

Netgear router web management typically has a screen that displays the DHCP lease the router received from the network (how long it is and when it will expire). On the Orbi systems, this is on the Advanced tab.  (do not have an RAX)  Would be interested to see if the lease expiration has any relationship to Tuesday at 12:25

Your intuition is correct that many users resolve "problems" by manually installing the previous firmware version.

Both the RAX45 and the RAX54 updated firmware on 5/20/2025.  If this problem has become apparent since May 20, then it would be an interesting experiment to (a) manually install the previous firmware version on the router, and (b) set the router to NOT allow automatic firmware updates.  (many users have downgraded firmware only to find their router upgrade almost immediately.)