NETGEAR is aware of a growing number of phone and online scams. To learn how to stay safe click here.
Forum Discussion
Solved
TCP SYN Flooding on RAX54v2 Router, Please help!
Hello all, i REALLY need help with stopping massive TCP SYN Floods to my home router. What has happened thus far: I got this router about 2 months ago ,(upgrading from a very old TP-link whic...
OK so updated my RAX50v2 to recent FW version.
Factory reset and setup from scratch.CAX80 in modem mode.
PE is enabled by default. Testing with it enabled and disabled:
PE Enabled:
PE Disabled:
I Noticed that the testing site was being reported as flooding the logs:
[admin login] from source 192.168.1.2, Wednesday, Aug 06, 2025 15:39:37
[admin login] from source 192.168.1.2, Wednesday, Aug 06, 2025 15:39:33
[DoS attack: TCP SYN Flood] from source 4.79.142.206,port 45743 Wednesday, Aug 06, 2025 15:39:03After I logged in at 15:39 and disabled PE and re-tested again after that, logs didn't report any flooding from the test site.
I recommend that after you disable PE and re-test, have your ISP give you a new WAN IP address as I presume some nefarious items may have a target for that WAN IP address. Once you have PE disabled and a new WAN IP address, I'm hoping you shouldn't see issues continue.
Yes, sorry I am very busy with work most days so my reply can be sparce.
I tried that and its still showing all ports CLOSED none open and just a few STEALTHed. Still getting massive amounts of TCP SYN flood, notifications in logs and my connection can randomly "hiccup" several times a day. Where as, if im doing something on the internet, ill get s tiny buffer time of around 15-20 seconds on things im doing, then it comes back. Never truely disconnecting but doing this hiccup now.
I ended up getting a very powerful cm2500 modem. Now I have the new RAX54v2 router and this modem.
The cm2500 has mid/high split and 3.1 docsis so its all up to date... I should not be getting these hiccups or floods and im pretty sure my ports should not be like this still.
Any ideas?
When you tested ShieldsUp and PE disabled, did you first disconnect all ethernet devices from the router accept for the one test pc and then disable the wifi radios on the router prior to testing?
Please post a screen capture of the test results from all serivce ports testing.
Please post a copy and paste of the modems connection status and event log page.
https://kb.netgear.com/30007/How-do-I-obtain-the-cable-connection-information-from-a-NETGEAR-cable-modem-modem-router
https://kb.netgear.com/30008/How-do-I-view-or-clear-the-event-logs-on-my-NETGEAR-cable-modem-or-modem-router
Yes i disconnected all devices, except my test one and i shut off my wireless radios to both 2.4g and 5g networks. Made sure they are off.
I got into my router and still getting SYN floods, RST scans and DoS fraggles. (This is just a portion)
I also got my modem logs, i dont understand them but here they are. (Redacted any MACs)
After all of that, i STILL have most everything CLOSED and not stealthed.
My internet status is GOOD on both modem and router.
Both have all farmwear up to date.
I have Netgear Armor installed.
I am still having random packet loss, loss of loading sometimes and huge stutters in gaming/streaming.
I'm just a broke person trying to have a good internet connection like i used to have before all this 'upgrading' took over the world man. I just want a secure connection for what I pay for. :(
What firmware version # is loaded on the router?
Do a Whois look up on the WAN side IP addresses to see where they are coming from.
Please post a copy and paste of the modems connection status page.
https://kb.netgear.com/30007/How-do-I-obtain-the-cable-connection-information-from-a-NETGEAR-cable-modem-modem-routerAny Criticals, Errors or Warnings seen in the event logs needs to be reviewed and resolved by the ISP. Indicates a signal issue on the ISP line up to the modem.
Is Armor installed on the PC and enabled on the Router?
Try disabling Armor all together on the router and PC then re-test again. All those post should be stealthed and not closed.
v1.1.6.36 is the firmwear on router and I checked the Nighthawk app and the online router page for new, said I was up to date.
So I need to comtact my ISP about these logs in my Modem? What should I say?
Armor is not installed on anything, its just activated through the Armor app on my phone.
How do i turn it off in my router?
If its not installed on my pc and only in app, can it still make all my ports not stealthed?
Can an ISP stealth your ports for you?
The no-stealth is probably why I am getting so flooded.