CAX80 keeps rebooting

"One main issue that would cause a reboot is that the ISP signal has stopped or signal on the line is degraded. Remember the CAX80 will auto reboot if ANY signal on the line  becomes bad or the signal completely stops for any reason."

But if it is a ISP signal issue, then we should be seeing it when we go to .5, however, it appears that most people (including myself, so far) have not experienced these issues on .5. So I just don't see how that could be a ISP signal issue.

Anything is possible when it comes to ISP signals. Others have also not seen with with v.7 as well. Including me. 

Users can either downgrade the FW or use v.7 however again, I would check with the ISP and signals on the line as mentioned. Any of the suggestions are there to help identify what else could cause the problem. 

If you still experience problems ever all this, users will need to contact NG support and open a support ticket. 

I already had Comcast visit a few days ago. They confirmed there are no signal issues or issues in general. Somebody else earlier on this thread also had Comcast come out and confirm. This is not an ISP issue, it's a firmware issue.

I opened a support ticket and referenced this thread. Perhaps if everyone else on this thread did the same we will get a fix sooner?

Tickets can be opened here: https://my.netgear.com/support/contact.aspx

Netgear pls fix this issue. I can't do my school work online because the modem reboots whenever it feels like it. 😞 

I tried to do this, however, it says my support has expired. I can only "search knowledgebase" or "visit a community". Is that true? They won't even open a ticket if you don't have tech support purchase. That is so dumb for an in-warranty hardware product.

Those of you who still have support. Are you able to open a ticket so we can get helped out?

Tickets can be opened here: https://my.netgear.com/support/contact.aspx

FURRYe38 I'm going to have to disagree about the Auto reboot on any signal issue.  Every other month my Downlink light starts to blink and I see multiple links that are not locked and the Router has never rebooted automatically.

In looking at my log, I see that the initial Firmware update was initiated Nov 2021

As you can see, there are no DoS attacks before this.  However, I DO see DoS attacks starting shortly afterwards:

AND the IP Address is NOT a DoS Attack, not sure why the Router labels it as such.  When I do an IP Lookup it reports:

AND I show my IP Address as the one listed as the Source of the DoS attack.  SO those who posted about the DoS attack, look at the IP and determine if it is YOUR IP from your ISP.  But this still points back to an issue with Firmware .7 since the DoS attacks didn't start logging until AFTER .7 was updated to the Router.  Either way, the issue is almost definitely with the firmware.

SO again, HOW can we stop the Router Firmware from being auto updated?  AND why did it start on or about 11 Jun 22, why not way back in Nov. when the update was pushed . . .

Alright, downgraded again to .5

Performed a factory reset, unplugged for 1 minute and then went through setup.  I guess we'll see what happens . . .

Since downgrading to v2.1.3.5 I have not experienced any random reboots. Nor had I observed any DOS "LAND Atack" events in the Log.

Last night when I went to bed, I was still running v2.1.3.5 so I anticipated this was to continue. I was wrong.

When I awoke this morning and looked at the UI to see if any reboots occurred in the middle of the night, I discovered my router upgraded to firmware v2.1.3.7.

Looking closer at the Log it reflects the router upgraded its firmware to v.2.1.3.7 at approximately 1:20am. After the upgrade the Log reflects twenty or so DOS "LAND Attack" events involving port 2190 and a few DOS "NULL Attack" events.

Then at approximately 3:40am the router does a reboot and has since recorded another thirty plus DOS "LAND Attack" events involving port 2190 in the log.

Obviously, I am not pleased.

Being extremely familiar with Internet security and network security for thirty years, I find it highly improbable and very unlikely my network is experiencing a LAND attack. Especially whereas others are reporting LAND attacks with the SAME port number all of sudden after upgrading the firmware.

For reference a LAND attack is often a human (user) generated attack, designed with the intention of causing a Denial of Service (DoS). It involves the user injecting traffic into the network with the source IP and destination IP addresses being the same as well as choosing a port number (1-65535) to be used as the source and destination ports. The fact this attack is being recorded by multiple persons with the same port number (2190) is highly indicative this event is being generated by the router itself.

In all likelihood there is something wrong with firmware v.2.1.3.7

After the CAX80 running .7 rebooted itself at  ~3:30am this morning... besides the "[DoS attack] LAND Attack SPT:2190 DPT:2190" messages in the log I'm also getting  a bunch of "[DoS attack] DoSPortScan PROTO:Icmp" log messages.

Would NOT be a FW issue if your getting DOS attacked. You'll need to discuss this with your ISP. 
Do a who is look up on WAN IP addresses to see where they are coming from. 

If your seeing locked channels not working well or downlink issues on  the modem. This is a ISP signal line issue. ISP needs to check this. 

All this  seem to be a recent problem that has appeared for some. v.7 has been out for a while now. 

---

kinghq1 wrote:

FURRYe38 I'm going to have to disagree about the Auto reboot on any signal issue.  Every other month my Downlink light starts to blink and I see multiple links that are not locked and the Router has never rebooted automatically.

 

In looking at my log, I see that the initial Firmware update was initiated Nov 2021

As you can see, there are no DoS attacks before this.  However, I DO see DoS attacks starting shortly afterwards:

 

AND the IP Address is NOT a DoS Attack, not sure why the Router labels it as such.  When I do an IP Lookup it reports:

AND I show my IP Address as the one listed as the Source of the DoS attack.  SO those who posted about the DoS attack, look at the IP and determine if it is YOUR IP from your ISP.  But this still points back to an issue with Firmware .7 since the DoS attacks didn't start logging until AFTER .7 was updated to the Router.  Either way, the issue is almost definitely with the firmware.

 

SO again, HOW can we stop the Router Firmware from being auto updated?  AND why did it start on or about 11 Jun 22, why not way back in Nov. when the update was pushed . . .

---

Seems like firmware version .7 is incorrectly labelling DOS attacks. Unsure if this has anything to do with the router reboots. It could just be two separate unrelated issues.

When I was on firmware version .7. I saw many DOS attacks and the router was rebooting throughout the day.

After downgrading to .5 I have seen zero DOS attacks and the router has stopped rebooting.

FURRYe38 there is clearly an issue with firmware version .7

Something to report to NG support then. https://my.netgear.com/support/contact.aspx

Again this seem to have just appeared for some and some of us have not seen this. This maybe particular to some ISPs as well. 

I've had my CAX80 loaded with v.7 since day one over 3 months ago and been working as expected. I just removed it a couple of weeks ago and now using a CM2000. 

Otherwise use what works. 

olympos1625 per your previous question. Several people on this thread have confirmed the issue resolves when downgrading to firmware version 2.1.3.5. BUT the router auto-updates to 2.1.3.7 within 24 hours, so that is not a long term fix.

Can we please get an update from Netgear? I tried opening a support ticket and got no response. I tried calling the support line and just got stuck on hold for 1 hour.

Next step will be to form a class action lawsuit with my lawyers for loss of earning caused by the disconnects during work calls.

Hi Guys,

 

Good day!

 

Welcome to NETGEAR Community!

 

We are sorry to hear about your experience with the latest firmware update. Does anyone able to isolate the issue by downgrading the firmware?

 

Please do not hesitate to let me know if you need further assistance. 

 

Regards,

 

Oliver

Community Team

I downgraded my firmware on my CAX80 and Comcast decided at 2:15am to automatically update the firmware without my permission. As a customer we should have the right to choose what we do with it. How did I pay an extreme amount of money for something that's worthless to me right about now. You claim to save money on modem rentals, at this point I want to rent a modem, so I wouldn't have to deal with poor company practices. Do you even test the firmware before release??? I can't even speak to someone without paying money for tech support. And its the problem you caused. Yea, I'm heading down to Comcast first thing in the morning and renting a modem now. I could care less for wifi 6. You have truly wasted my time and money trouble shooting this DOS LAND ATTACK CRASH. I hope there is a class action lawsuit on NG. No wonder why the Arlo Camera team left you guys. I will be switching everything over to Cisco business from here on out. I will reach out to all the YouTubers and give them feedback on how NG won't do anything about this firmware problem. Just like what Linus Tech did to NEWEGG.COM 

I can also report that running firmware v2.1.3.5 on my CAX80 stops the DoS Attacks messages in the log. The router runs fine on .v2.1.3.5 until Netgear pushes v2.1.3.7 overnight. No ISP signal issues... my Internet speeds are better than what the ISP provisioned them for.  From that point on the DoS Attacks messages return. Netgear needs to provide a firmware that  fixes the DoS Attacks issue + gives the user an option to opt out of automatic firmware updates or stop the Netgear firmware server from pushing the  v2.1.3.7 update as it is broken. (Netgear can put firmware v2.1.3.7 on their firmware download page for those that want to update to it)

Something to report to NG support. https://my.netgear.com/support/contact.aspx

How did you do this?

---

Omnitron wrote:
Please ignore my message about “A router firmware upgrade is available”. After a reboot, it’s gone now.

I was able to force the Cable Connection to a starting frequency of 405MHz. It took a couple tries: the first time the first channel still latched to 507MHz for some reason. We’ll see if that helps. PS: after you hit Apply, you get 404 Page Not Found, but the change did go through.

---

@tfc3000 I'll join in on the class action.

My CAX80 connected to Spectrum and running .7 still rebooting every morning at ~3.00am (8:30am current time) - C'mon Netgear do something!

UPDATE: my brand new CAX80 updated to firmware version 2.1.3.7 overnight. The reboots started shortly after. Purchasing a new CAX80 does not solve the issue. THIS IS A FIRMWARE ISSUE.

olympos1625 I found you and your manager on LinkedIn. I will be reporting you to your manager for ignoring this thread unless we receive a response from you before EOD Monday 20th June.

Is there something preventing NG hardware owners from blocking the auto-update server? Maybe blocking the port number it is utilizing? Also the NG C7800 started having this exact same issue at the same time the CAX80 got its .7 update. It has gotten so bad that my C7800 finally burned itself out after thousands of reboots caused by fake DoS attacks. Which of course forces me to use up my 4 year warranty more than a full year before my warranty would have expired.

Hi @Gentleman1013,

Thank you for reaching out. We are sorry to hear about your experience with the modem. We would like to endorse you to NETGEAR Level 2 support team for a callback. Please DM us the following information:

Name:

Email:

Phone:

Preferred schedule (at least 2 days ahead)

Timezone:

Device S/N:

Alternatively, if you wish to be contacted via email only then kindly include your preferred email address.

I am looking forward to your response.
 

Regards,

Oliver

Community Team

I've already made an insurance claim on the cable gateway at this point as I've been dealing with this issue for years and finally had enough.

Hi @Gentleman1013,

We are really sorry again for the inconvenience this has caused you. Rest assured that your feedback will help us improve our product and services in the future. We hope we can still regain your trust.

Please do not hesitate to let me know if you need further assistance. 

Regards,

Oliver

Community Team