NETGEAR is aware of a growing number of phone and online scams. To learn how to stay safe click here.
Forum Discussion
Solved
TCP SYN Flooding on RAX54v2 Router, Please help!
Hello all, i REALLY need help with stopping massive TCP SYN Floods to my home router. What has happened thus far: I got this router about 2 months ago ,(upgrading from a very old TP-link whic...
OK so updated my RAX50v2 to recent FW version.
Factory reset and setup from scratch.CAX80 in modem mode.
PE is enabled by default. Testing with it enabled and disabled:
PE Enabled:
PE Disabled:
I Noticed that the testing site was being reported as flooding the logs:
[admin login] from source 192.168.1.2, Wednesday, Aug 06, 2025 15:39:37
[admin login] from source 192.168.1.2, Wednesday, Aug 06, 2025 15:39:33
[DoS attack: TCP SYN Flood] from source 4.79.142.206,port 45743 Wednesday, Aug 06, 2025 15:39:03After I logged in at 15:39 and disabled PE and re-tested again after that, logs didn't report any flooding from the test site.
I recommend that after you disable PE and re-test, have your ISP give you a new WAN IP address as I presume some nefarious items may have a target for that WAN IP address. Once you have PE disabled and a new WAN IP address, I'm hoping you shouldn't see issues continue.
Any progress on this?
Were you to re-test with PE disabled with alll devices disconnected accept for one ethernet connected PC?
Yes, sorry I am very busy with work most days so my reply can be sparce.
I tried that and its still showing all ports CLOSED none open and just a few STEALTHed. Still getting massive amounts of TCP SYN flood, notifications in logs and my connection can randomly "hiccup" several times a day. Where as, if im doing something on the internet, ill get s tiny buffer time of around 15-20 seconds on things im doing, then it comes back. Never truely disconnecting but doing this hiccup now.
I ended up getting a very powerful cm2500 modem. Now I have the new RAX54v2 router and this modem.
The cm2500 has mid/high split and 3.1 docsis so its all up to date... I should not be getting these hiccups or floods and im pretty sure my ports should not be like this still.
Any ideas?