NETGEAR is aware of a growing number of phone and online scams. To learn how to stay safe click here.

Forum Discussion

whatisgoingon's avatar
whatisgoingon
Aspirant
Jul 26, 2018

CM700/Nighthawk Dropping Internet + DoS/WLAN access rejected spam

All of these problems began showing in the logs a few minutes after updating to V1.2.0.24_1.0.1.  My internet has been disconnecting multiple times a day (modem loses connection).

 

In the logs I see:

1. Multiple [DoS attack: ACK Scan] from various IP's.

2. Multiple [WLAN access rejected: incorrect security] from my iPhone's MAC address

3. Multiple [WLAN access rejected: incorrect security] from 16 different unknown MAC addresses (a little concerned about this)

 

I can post the log if necessary but it's very long (6 days worth).  Attached is a picture of the unknown MAC addresses that have been rapidly trying to connect to my wifi (which has a password).

Troubleshooting

4 Replies

  • DarrenM's avatar
    DarrenM
    Sr. NETGEAR Moderator
    Jul 30, 2018

    Not in the router logs but the logs of the modem do you seen any T3 or T4 timeouts?

     

    DarrenM

    • whatisgoingon's avatar
      whatisgoingon
      Aspirant
      Jul 30, 2018

      I never knew I could login to the modem like this so I'm a bit unfamiliar with the data.  Unfortunately, I recently rebooted the modem to regain internet connection which seems to have cleared the logs.  I do see:

       

      No Ranging Response received - T3 time-out

      MIMO Event MIMO: Stored MIMO=-1 post cfg file MIMO=-1

       

       

      Downstream

      Channel Lock Status Modulation Channel ID Frequency Power SNR Correctables UnCorrectables
      1 Locked QAM 256 17 603000000 Hz -7.7 dBmV 37.3 dB 0 0
      2 Locked QAM 256 18 609000000 Hz -7.7 dBmV 37.3 dB 0 0
      3 Locked QAM 256 19 615000000 Hz -7.2 dBmV 37.3 dB 0 0
      4 Locked QAM 256 20 621000000 Hz -7.4 dBmV 37.3 dB 0 0
      5 Locked QAM 256 21 627000000 Hz -8.0 dBmV 37.3 dB 0 0
      6 Locked QAM 256 22 633000000 Hz -8.2 dBmV 36.6 dB 7 0
      7 Locked QAM 256 23 639000000 Hz -7.7 dBmV 37.6 dB 7 0
      8 Locked QAM 256 24 645000000 Hz -8.2 dBmV 37.3 dB 0 0
      9 Locked QAM 256 25 651000000 Hz -8.2 dBmV 37.3 dB 0 0
      10 Locked QAM 256 26 657000000 Hz -8.2 dBmV 36.6 dB 0 0
      11 Locked QAM 256 27 663000000 Hz -8.2 dBmV 37.3 dB 0 0
      12 Locked QAM 256 28 669000000 Hz -7.7 dBmV 37.3 dB 0 0
      13 Locked QAM 256 29 675000000 Hz -7.2 dBmV 37.3 dB 0 0
      14 Locked QAM 256 30 681000000 Hz -7.2 dBmV 37.6 dB 0 0
      15 Locked QAM 256 31 687000000 Hz -7.2 dBmV 37.3 dB 0 0
      16 Locked QAM 256 32 693000000 Hz -7.2 dBmV 37.3 dB 6 0
      17 Not Locked N/A N/A 0 Hz 0.0 dBmV 0.0 dB 0 0
      18 Not Locked N/A N/A 0 Hz 0.0 dBmV 0.0 dB 0 0
      19 Not Locked N/A N/A 0 Hz 0.0 dBmV 0.0 dB 0 0
      20 Not Locked N/A N/A 0 Hz 0.0 dBmV 0.0 dB 0 0
      21 Not Locked N/A N/A 0 Hz 0.0 dBmV 0.0 dB 0 0
      22 Not Locked N/A N/A 0 Hz 0.0 dBmV 0.0 dB 0 0
      23 Not Locked N/A N/A 0 Hz 0.0 dBmV 0.0 dB 0 0
      24 Not Locked N/A N/A 0 Hz 0.0 dBmV 0.0 dB 0 0
      25 Not Locked N/A N/A 0 Hz 0.0 dBmV 0.0 dB 0 0
      26 Not Locked N/A N/A 0 Hz 0.0 dBmV 0.0 dB 0 0
      27 Not Locked N/A N/A 0 Hz 0.0 dBmV 0.0 dB 0 0
      28 Not Locked N/A N/A 0 Hz 0.0 dBmV 0.0 dB 0 0
      29 Not Locked N/A N/A 0 Hz 0.0 dBmV 0.0 dB 0 0
      30 Not Locked N/A N/A 0 Hz 0.0 dBmV 0.0 dB 0 0
      31 Not Locked N/A N/A 0 Hz 0.0 dBmV 0.0 dB 0 0
      32 Not Locked N/A N/A 0 Hz 0.0 dBmV 0.0 dB 0 0

       

      Upstream

      Channel Lock Status US Channel Type Channel ID Symbol Rate Frequency Power
      1 Locked ATDMA 2 5120 Ksym/sec 30100000 Hz 54.5 dBmV
      2 Not Locked N/A Unknown 0 Ksym/sec 0 Hz 0.0 dBmV
      3 Not Locked N/A Unknown 0 Ksym/sec 0 Hz 0.0 dBmV
      4 Not Locked N/A Unknown 0 Ksym/sec 0 Hz 0.0 dBmV
      5 Not Locked N/A Unknown 0 Ksym/sec 0 Hz 0.0 dBmV
      6 Not Locked N/A Unknown 0 Ksym/sec 0 Hz 0.0 dBmV
      7 Not Locked N/A Unknown 0 Ksym/sec 0 Hz 0.0 dBmV
      8 Not Locked N/A Unknown 0 Ksym/sec 0 Hz 0.0 dBmV

       

      54.5 dBmV seems very high compared to the downstream values or is that normal?

       

      Thanks for the help.

      • whatisgoingon's avatar
        whatisgoingon
        Aspirant
        Jul 31, 2018

        Just experienced another drop in internet.  Before it would fix itself but now it seems I need to do a full restart to get the internet working.  I was able to grab the log before restarting.

         

        Modem Logs:

        Jul 31 2018 07:08:17 Critical (3) Unicast Ranging Received Abort Response - initializing MAC
        Jul 31 2018 07:08:17 Critical (3) Unicast Ranging Received Abort Response - initializing MAC
        Jul 31 2018 07:08:17 Critical (3) Unicast Ranging Received Abort Response - initializing MAC
        Jul 31 2018 07:08:17 Critical (3) Unicast Ranging Received Abort Response - initializing MAC
        Jul 31 2018 07:08:17 Critical (3) Unicast Ranging Received Abort Response - initializing MAC
        Jul 31 2018 07:08:17 Critical (3) Unicast Ranging Received Abort Response - initializing MAC
        Jul 31 2018 07:08:17 Critical (3) Unicast Ranging Received Abort Response - initializing MAC
        Jul 31 2018 07:08:17 Critical (3) No Ranging Response received - T3 time-out
        Jul 31 2018 07:08:46 Critical (3) Unicast Ranging Received Abort Response - initializing MAC
        Jul 31 2018 07:08:47 Critical (3) No Ranging Response received - T3 time-out
        Jul 31 2018 07:09:31 Critical (3) Unicast Ranging Received Abort Response - initializing MAC
        Jul 31 2018 07:09:31 Critical (3) No Ranging Response received - T3 time-out
        Jul 31 2018 07:10:04 Critical (3) Unicast Ranging Received Abort Response - initializing MAC
        Jul 31 2018 07:10:04 Critical (3) No Ranging Response received - T3 time-out
        Jul 31 2018 07:10:45 Critical (3) Unicast Ranging Received Abort Response - initializing MAC
        Jul 31 2018 07:10:45 Critical (3) No Ranging Response received - T3 time-out
        Jul 31 2018 07:11:17 Critical (3) Unicast Ranging Received Abort Response - initializing MAC
        Jul 31 2018 07:11:17 Critical (3) No Ranging Response received - T3 time-out
        Jul 31 2018 07:11:47 Critical (3) Unicast Ranging Received Abort Response - initializing MAC
        Jul 31 2018 07:11:47 Critical (3) No Ranging Response received - T3 time-out
        Jul 31 2018 07:12:23 Critical (3) Unicast Ranging Received Abort Response - initializing MAC
        Jul 31 2018 07:12:24 Critical (3) No Ranging Response received - T3 time-out
        Jul 31 2018 07:12:55 Critical (3) Unicast Ranging Received Abort Response - initializing MAC
        Jul 31 2018 07:12:56 Critical (3) No Ranging Response received - T3 time-out
        Jul 31 2018 07:13:40 Critical (3) Unicast Ranging Received Abort Response - initializing MAC
        Jul 31 2018 07:13:40 Critical (3) No Ranging Response received - T3 time-out
        Jul 31 2018 07:14:20 Critical (3) Unicast Ranging Received Abort Response - initializing MAC
        Jul 31 2018 07:14:20 Critical (3) No Ranging Response received - T3 time-out
        Jul 31 2018 07:15:02 Critical (3) Unicast Ranging Received Abort Response - initializing MAC
        Jul 31 2018 07:15:02 Critical (3) No Ranging Response received - T3 time-out
        Jul 31 2018 07:15:42 Critical (3) Unicast Ranging Received Abort Response - initializing MAC
        Jul 31 2018 07:15:42 Critical (3) No Ranging Response received - T3 time-out
        Jul 31 2018 07:16:11 Critical (3) Unicast Ranging Received Abort Response - initializing MAC
        Jul 31 2018 07:16:12 Critical (3) No Ranging Response received - T3 time-out
        Jul 31 2018 07:17:04 Critical (3) Unicast Ranging Received Abort Response - initializing MAC
        Jul 31 2018 07:17:05 Critical (3) No Ranging Response received - T3 time-out
        Jul 31 2018 07:17:36 Critical (3) Unicast Ranging Received Abort Response - initializing MAC
        Jul 31 2018 07:17:36 Critical (3) No Ranging Response received - T3 time-out
        Jul 31 2018 07:18:28 Critical (3) Unicast Ranging Received Abort Response - initializing MAC
        Jul 31 2018 07:18:28 Critical (3) No Ranging Response received - T3 time-out

         

        And here are some of the router logs.  The logs were empty up until July 20th when I upgraded to the latest firmware, except for one event in May. Not sure if this is a coincidence or not.  This is from the same time as the modem log (router time is behind 3 hours).  Note that this is how the logs look even when I'm not having issues.  The other day it seemed to be allowing access to my phone every 5 minutes.

         

        [Access Control] Device [MY-PC] with MAC address [MAC] is allowed to acc Tuesday, July 31,2018 04:31:49          

        [Access Control] Device [MY-PC] with MAC address [MAC] is allowed to acc Tuesday, July 31,2018 04:30:34          

        [Access Control] Device [MY-PC] with MAC address [MAC] is allowed to acc Tuesday, July 31,2018 04:29:17          

        [Internet connected] IP address: xxx.xxx.xxx.xx Tuesday, July 31,2018 04:28:47          

        [Internet disconnected] Tuesday, July 31,2018 04:28:04          

        [Access Control] Device [MY-PC] with MAC address [MAC] is allowed to acc Tuesday, July 31,2018 04:28:02          

        [Access Control] Device [MY-PC] with MAC address [MAC] is allowed to acc Tuesday, July 31,2018 04:26:35          

        [Access Control] Device [MY-PC] with MAC address [MAC] is allowed to acc Tuesday, July 31,2018 04:25:19          

        [Access Control] Device [MY-PC] with MAC address [MAC] is allowed to acc Tuesday, July 31,2018 04:23:58          

        [Access Control] Device [MY-PC] with MAC address [MAC] is allowed to acc Tuesday, July 31,2018 04:22:41          

        [Access Control] Device [MY-PC] with MAC address [MAC] is allowed to acc Tuesday, July 31,2018 04:21:09          

        [Internet connected] IP address: xxx.xxx.xxx.xx Tuesday, July 31,2018 04:20:09          

        [Access Control] Device [MY-PC] with MAC address [MAC] is allowed to acc Tuesday, July 31,2018 04:19:52          

        [Internet disconnected] Tuesday, July 31,2018 04:19:02          

        [Access Control] Device [MY-PC] with MAC address [MAC] is allowed to acc Tuesday, July 31,2018 04:18:35          

        [Access Control] Device [MY-PC] with MAC address [MAC] is allowed to acc Tuesday, July 31,2018 04:17:14          

        [Access Control] Device [MY-PC] with MAC address [MAC] is allowed to acc Tuesday, July 31,2018 04:15:57          

        [Access Control] Device [MY-PC] with MAC address [MAC] is allowed to acc Tuesday, July 31,2018 04:14:41          

        [Access Control] Device [MY-PC] with MAC address [MAC] is allowed to acc Tuesday, July 31,2018 04:13:22          

        [Access Control] Device [MY-PC] with MAC address [MAC] is allowed to acc Tuesday, July 31,2018 04:12:05          

        [Access Control] Device [MY-PC] with MAC address [MAC] is allowed to acc Tuesday, July 31,2018 04:10:49          

        [Access Control] Device [MY-PC] with MAC address [MAC] is allowed to acc Tuesday, July 31,2018 04:09:25          

        [Access Control] Device [MY-PC] with MAC address [MAC] is allowed to acc Tuesday, July 31,2018 04:08:07          

        [Access Control] Device [MY-PC] with MAC address [MAC] is allowed to acc Tuesday, July 31,2018 04:06:50