NETGEAR is aware of a growing number of phone and online scams. To learn how to stay safe click here.

Forum Discussion

Y2kcurt's avatar
Y2kcurt
Guide
Mar 28, 2025
Solved

Nighthawk CAX80 Intermittent internet disconnections

I am hoping someone can help. My Xfinity internet intermittently completely drops out, on both ethernet connections and Wifi, on avg, about 2-3 times per hour. However it will sometimes go a few hours without it happening at all. When it is stable, it works great (great down/up speeds, ping time, no latency, no packet loss). But when it drops, it completely drops. I am typically alerted due to either being on a zoom call and it losing connection or my nest cameral will send an alert that it lost connection. Once connection is lost, it reconnects almost immediately.

 

I have done all of the following troubleshooting. I am using a  Netgear Nighthawk CAX80 Modem/Router with my main computer directly wired to the modem. 

 

1) Replaced Modem with a new modem

2) Replaced all ethernet cables

3) Replaced access points (2) 

4) Tried on multiple computers

5) Replaced cable that goes from Xfinity box on side of my house to the Modem 

6) Ensured modem firmware was up to date

 

 

Currently on firmware v5.1.1.8

 

I have run a network stability monitor to track stability over time and it identified the spikes with the internet outages.  I have reviewed the Modem logs and I have identified a pattern where the modem logs a "(DOS attack) ACK scan" every time an outage occurs, with the inbound IP address changing fairly frequently (not coming from the same IP every time) (see screen shot below). I have researched that specific log entry and the consensus is, if it were a typical DOS attack, it wouldnt say "scan" and it would be ongoing, not just once every 30 minutes. In addition, all the Nighthawk forums say they are more than likely "false positives" where the modem identifies certain activity as a DOS, when it really is normal activity from certain websites or services. 

 

I am completely out of ideas on how to resolve, any other thoughts or direction would be greatly appreciated. Thanks 

 

 

 

  • Y2kcurt's avatar
    Y2kcurt
    Apr 03, 2025

    As a follow up and to close out this thread in case anyone else has similar issues, we finally identified the root cause and resolved the issue. The coax line from the cable provider (comcast) that goes from a box in my neighbors yard to my house was bad and needed to be replaced (which required running it underground). Once replaced all of the issues identified in this thread were resolved. 

     

    Thanks for your help! 

17 Replies

    • Y2kcurt's avatar
      Y2kcurt
      Guide
      Mar 29, 2025
      DescriptionCountLast OccurrenceTargetSource
      [DHCP IP: 192.168.1.48] to MAC address 44:67:55:26:c8:d82Fri Mar 28 19:19:59 2025192.168.1.48:00.0.0.0:0
      [login] from source 192.168.1.921Fri Mar 28 19:18:02 2025192.168.1.1:80192.168.1.92:53375
      [DHCP IP: 192.168.1.48] to MAC address 44:67:55:26:c8:d81Fri Mar 28 19:17:59 2025192.168.1.48:00.0.0.0:0
      [DHCP IP: 192.168.1.216] to MAC address 18:b4:30:69:c7:e71Fri Mar 28 19:17:56 2025192.168.1.216:00.0.0.0:0
      [DoS attack] ACK scan SPT:443 DPT:389483Fri Mar 28 19:17:53 202576.154.153.101:3894835.212.178.254:443
      [DHCP IP: 192.168.1.196] to MAC address 82:a0:e8:6b:42:d91Fri Mar 28 19:17:46 2025192.168.1.196:00.0.0.0:0
      [WLAN access rejected: incorrect security] from MAC 18:b4:30:69:c7:e71Fri Mar 28 19:17:28 20250.0.0.0:00.0.0.0:0
      [DHCP IP: 192.168.1.53] to MAC address d0:3f:27:b7:e8:431Fri Mar 28 19:17:06 2025192.168.1.53:00.0.0.0:0
      [DHCP IP: 192.168.1.48] to MAC address 44:67:55:26:c8:d82Fri Mar 28 19:16:59 2025192.168.1.48:00.0.0.0:0
      [DHCP IP: 192.168.1.68] to MAC address e8:9f:80:39:21:f21Fri Mar 28 19:15:57 2025192.168.1.68:00.0.0.0:0
      [DHCP IP: 192.168.1.187] to MAC address 80:0c:f9:c1:0c:011Fri Mar 28 19:15:37 2025192.168.1.187:00.0.0.0:0
      [DHCP IP: 192.168.1.48] to MAC address 44:67:55:26:c8:d81Fri Mar 28 19:14:59 2025192.168.1.48:00.0.0.0:0
      [DHCP IP: 192.168.1.176] to MAC address 44:bb:3b:04:e7:501Fri Mar 28 19:14:57 2025192.168.1.176:00.0.0.0:0
      [DoS attack] ACK scan SPT:5223 DPT:531092Fri Mar 28 19:14:50 202576.154.153.101:5310917.57.144.102:5223
      [DHCP IP: 192.168.1.13] to MAC address 60:38:e0:ea:f3:d11Fri Mar 28 19:14:37 2025192.168.1.13:00.0.0.0:0
      [DHCP IP: 192.168.1.48] to MAC address 44:67:55:26:c8:d81Fri Mar 28 19:13:59 2025192.168.1.48:00.0.0.0:0
      [DHCP IP: 192.168.1.127] to MAC address 58:ef:68:dc:91:dd1Fri Mar 28 19:13:57 2025192.168.1.127:00.0.0.0:0
      [DHCP IP: 192.168.1.107] to MAC address 64:16:66:40:21:cb2Fri Mar 28 19:13:21 2025192.168.1.107:00.0.0.0:0
      [DHCP IP: 192.168.1.48] to MAC address 44:67:55:26:c8:d81Fri Mar 28 19:12:59 2025192.168.1.48:00.0.0.0:0
      [DHCP IP: 192.168.1.189] to MAC address 70:bc:10:65:9b:b61Fri Mar 28 19:12:23 2025192.168.1.189:00.0.0.0:0
      [DHCP IP: 192.168.1.216] to MAC address 18:b4:30:69:c7:e71Fri Mar 28 19:12:20 2025192.168.1.216:00.0.0.0:0
      [DHCP IP: 192.168.1.102] to MAC address d8:28:c9:8a:57:441Fri Mar 28 19:12:09 2025192.168.1.102:00.0.0.0:0
      [DHCP IP: 192.168.1.48] to MAC address 44:67:55:26:c8:d81Fri Mar 28 19:11:58 2025192.168.1.48:00.0.0.0:0
      [WLAN access rejected: incorrect security] from MAC 18:b4:30:69:c7:e71Fri Mar 28 19:11:55 20250.0.0.0:00.0.0.0:0
      [DHCP IP: 192.168.1.145] to MAC address 98:17:3c:0b:03:bc1Fri Mar 28 19:11:08 2025192.168.1.145:00.0.0.0:0
      [DHCP IP: 192.168.1.212] to MAC address 60:38:e0:49:8d:411Fri Mar 28 19:11:05 2025192.168.1.212:00.0.0.0:0
      [DHCP IP: 192.168.1.219] to MAC address 14:91:82:49:6b:fd1Fri Mar 28 19:11:02 2025192.168.1.219:00.0.0.0:0
      [DHCP IP: 192.168.1.48] to MAC address 44:67:55:26:c8:d81Fri Mar 28 19:10:58 2025192.168.1.48:00.0.0.0:0
      [DHCP IP: 192.168.1.134] to MAC address 78:28:ca:31:67:2c1Fri Mar 28 19:10:56 2025192.168.1.134:00.0.0.0:0
      [DHCP IP: 192.168.1.71] to MAC address 60:38:e0:46:9a:351Fri Mar 28 19:10:30 2025192.168.1.71:00.0.0.0:0
      [DHCP IP: 192.168.1.48] to MAC address 44:67:55:26:c8:d81Fri Mar 28 19:09:58 2025192.168.1.48:00.0.0.0:0
      [DHCP IP: 192.168.1.216] to MAC address 18:b4:30:69:c7:e71Fri Mar 28 19:09:43 2025192.168.1.216:00.0.0.0:0
      [DHCP IP: 192.168.1.127] to MAC address 58:ef:68:dc:91:dd1Fri Mar 28 19:09:39 2025192.168.1.127:00.0.0.0:0
      [WLAN access rejected: incorrect security] from MAC 18:b4:30:69:c7:e71Fri Mar 28 19:09:15 20250.0.0.0:00.0.0.0:0
      [DHCP IP: 192.168.1.48] to MAC address 44:67:55:26:c8:d81Fri Mar 28 19:08:58 2025192.168.1.48:00.0.0.0:0
      [DHCP IP: 192.168.1.27] to MAC address d0:03:df:b5:2a:881Fri Mar 28 19:08:20 2025192.168.1.27:00.0.0.0:0
      [DHCP IP: 192.168.1.48] to MAC address 44:67:55:26:c8:d82Fri Mar 28 19:07:58 2025192.168.1.48:00.0.0.0:0
      [DHCP IP: 192.168.1.19] to MAC address ca:6a:10:23:36:9c1Fri Mar 28 19:06:16 2025192.168.1.19:00.0.0.0:0
      [DHCP IP: 192.168.1.216] to MAC address 18:b4:30:69:c7:e71Fri Mar 28 19:06:07 2025192.168.1.216:00.0.0.0:0
      [DHCP IP: 192.168.1.48] to MAC address 44:67:55:26:c8:d81Fri Mar 28 19:05:58 2025192.168.1.48:00.0.0.0:0
      [WLAN access rejected: incorrect security] from MAC 18:b4:30:69:c7:e71Fri Mar 28 19:05:38 20250.0.0.0:00.0.0.0:0
      [DHCP IP: 192.168.1.48] to MAC address 44:67:55:26:c8:d82Fri Mar 28 19:04:58 2025192.168.1.48:00.0.0.0:0
      [DHCP IP: 192.168.1.216] to MAC address 18:b4:30:69:c7:e71Fri Mar 28 19:03:30 2025192.168.1.216:00.0.0.0:0
      [DHCP IP: 192.168.1.105] to MAC address 50:c7:bf:03:e8:791Fri Mar 28 19:03:07 2025192.168.1.105:00.0.0.0:0
      [WLAN access rejected: incorrect security] from MAC 18:b4:30:69:c7:e71Fri Mar 28 19:03:02 20250.0.0.0:00.0.0.0:0
      [DHCP IP: 192.168.1.48] to MAC address 44:67:55:26:c8:d82Fri Mar 28 19:02:58 2025192.168.1.48:00.0.0.0:0
      [WLAN access rejected: incorrect security] from MAC 90:48:6c:1c:6f:cc1Fri Mar 28 19:01:13 20250.0.0.0:00.0.0.0:0
      [DHCP IP: 192.168.1.154] to MAC address 90:48:6c:1c:6f:cc1Fri Mar 28 19:01:13 2025192.168.1.154:00.0.0.0:0
      [DHCP IP: 192.168.1.145] to MAC address 98:17:3c:0b:03:bc1Fri Mar 28 19:01:09 2025192.168.1.145:00.0.0.0:0
      [DHCP IP: 192.168.1.48] to MAC address 44:67:55:26:c8:d81Fri Mar 28 19:00:58 2025192.168.1.48:00.0.0.0:0
      [DHCP IP: 192.168.1.216] to MAC address 18:b4:30:69:c7:e71Fri Mar 28 19:00:53 2025192.168.1.216:00.0.0.0:0
      [DHCP IP: 192.168.1.154] to MAC address 90:48:6c:1c:6f:cc1Fri Mar 28 19:00:51 2025192.168.1.154:00.0.0.0:0
      [WLAN access rejected: incorrect security] from MAC 18:b4:30:69:c7:e71Fri Mar 28 19:00:25 20250.0.0.0:00.0.0.0:0
      [DHCP IP: 192.168.1.48] to MAC address 44:67:55:26:c8:d81Fri Mar 28 18:59:58 2025192.168.1.48:00.0.0.0:0
      [DoS attack] ACK scan SPT:443 DPT:371322Fri Mar 28 18:59:15 202576.154.153.101:3713252.37.185.175:443
      [DHCP IP: 192.168.1.48] to MAC address 44:67:55:26:c8:d81Fri Mar 28 18:58:58 2025192.168.1.48:00.0.0.0:0
      [DHCP IP: 192.168.1.127] to MAC address 58:ef:68:dc:91:dd1Fri Mar 28 18:58:51 2025192.168.1.127:00.0.0.0:0
      [DHCP IP: 192.168.1.216] to MAC address 18:b4:30:69:c7:e71Fri Mar 28 18:58:11 2025192.168.1.216:00.0.0.0:0
      [DHCP IP: 192.168.1.48] to MAC address 44:67:55:26:c8:d81Fri Mar 28 18:57:58 2025192.168.1.48:00.0.0.0:0
      [WLAN access rejected: incorrect security] from MAC 18:b4:30:69:c7:e71Fri Mar 28 18:57:42 20250.0.0.0:00.0.0.0:0
      [DHCP IP: 192.168.1.216] to MAC address 18:b4:30:69:c7:e71Fri Mar 28 18:57:37 2025192.168.1.216:00.0.0.0:0
      [DHCP IP: 192.168.1.48] to MAC address 44:67:55:26:c8:d81Fri Mar 28 18:56:58 2025192.168.1.48:00.0.0.0:0
      [DoS attack] ACK scan SPT:8883 DPT:648582Fri Mar 28 18:56:16 202576.154.153.101:6485840.112.221.115:8883
      • Y2kcurt's avatar
        Y2kcurt
        Guide
        Mar 29, 2025

        Cable Diagnostic

        Status: Good

        Action: Your setup looks fine. If you are still experience an internet issue, the Netgear Cable Knowledge Base can provide additional troubleshooting info.

        Internet Access: Good

        Downstream Status: Good

        Downstream Power Level: Good

        Downstream SNR: Good

        Upstream Status: Good

        Upstream Power Level: Good


        Current time: Fri Mar 28 18:30:41 2025

        Startup Procedure
        Acquire Downstream Channel: 633 MHz Locked
        Connectivity State: OK Operational
        Boot State: OK Operational
        Security: Enabled BPI+


        Downstream Bonded Channels
        Channel LockedStatus Modulation ChannelID Frequency Power SNR Correctables Uncorrectables
        1 Locked 256 QAM 44 633000000 Hz 2.1 dBmV 42.8 dB 24100 15287
        2 Locked 256 QAM 13 447000000 Hz 1.2 dBmV 44 dB 118447 61264
        3 Locked 256 QAM 14 453000000 Hz 1.4 dBmV 44.1 dB 113631 58881
        4 Locked 256 QAM 15 459000000 Hz 1.5 dBmV 44.2 dB 19507 17886
        5 Locked 256 QAM 16 465000000 Hz 1.3 dBmV 42.7 dB 90210 44731
        6 Locked 256 QAM 17 471000000 Hz 1.2 dBmV 43.1 dB 105298 52698
        7 Locked 256 QAM 18 477000000 Hz 1.7 dBmV 43.9 dB 17133 19245
        8 Locked 256 QAM 19 483000000 Hz 1.5 dBmV 43.8 dB 73610 35490
        9 Locked 256 QAM 20 489000000 Hz 1.3 dBmV 39 dB 110055 53740
        10 Locked 256 QAM 21 495000000 Hz 1.6 dBmV 39.4 dB 19793 20373
        11 Locked 256 QAM 22 501000000 Hz 1.7 dBmV 41.6 dB 57749 26718
        12 Locked 256 QAM 23 507000000 Hz 1.5 dBmV 44 dB 94021 46138
        13 Locked 256 QAM 24 513000000 Hz 1.5 dBmV 44 dB 16139 20462
        14 Locked 256 QAM 25 519000000 Hz 1.6 dBmV 43.5 dB 41380 20494
        15 Locked 256 QAM 26 525000000 Hz 1.9 dBmV 43.7 dB 89840 41973
        16 Locked 256 QAM 27 531000000 Hz 2.2 dBmV 44.2 dB 15096 22179
        17 Locked 256 QAM 28 537000000 Hz 1.9 dBmV 43.9 dB 34506 17484
        18 Locked 256 QAM 29 543000000 Hz 1.6 dBmV 43.8 dB 79241 37505
        19 Locked 256 QAM 30 549000000 Hz 2 dBmV 44.1 dB 15740 24750
        20 Locked 256 QAM 31 555000000 Hz 2.1 dBmV 43.3 dB 23964 13263
        21 Locked 256 QAM 32 561000000 Hz 1.8 dBmV 34.4 dB 86410 37744
        22 Locked 256 QAM 33 567000000 Hz 2 dBmV 40.9 dB 15352 23496
        23 Locked 256 QAM 34 573000000 Hz 2.4 dBmV 41.8 dB 15978 10824
        24 Locked 256 QAM 35 579000000 Hz 2.1 dBmV 43.7 dB 51016 26882
        25 Locked 256 QAM 36 585000000 Hz 2.3 dBmV 43.3 dB 12672 23423
        26 Locked 256 QAM 37 591000000 Hz 2.4 dBmV 41.2 dB 12255 10048
        27 Locked 256 QAM 38 597000000 Hz 2.3 dBmV 41.4 dB 38860 21116
        28 Locked 256 QAM 39 603000000 Hz 2.3 dBmV 42.6 dB 12794 22524
        29 Locked 256 QAM 40 609000000 Hz 2.3 dBmV 43.2 dB 10299 9237
        30 Locked 256 QAM 41 615000000 Hz 1.9 dBmV 43.6 dB 31678 18808
        31 Locked 256 QAM 42 621000000 Hz 2.3 dBmV 43.6 dB 12017 20904
        32 Locked 256 QAM 43 627000000 Hz 2.5 dBmV 43.5 dB 8399 8338


        Upstream Bonded Channels
        Channel LockedStatus ChannelType ChannelID SymbolRate Frequency Power
        1 Locked ATDMA 20 5120 Ksym/sec 35600000 Hz 41.0 dBmV
        2 Locked ATDMA 18 5120 Ksym/sec 22800000 Hz 41.0 dBmV
        3 Locked ATDMA 19 5120 Ksym/sec 29200000 Hz 41.0 dBmV
        4 Locked ATDMA 17 5120 Ksym/sec 16400000 Hz 41.0 dBmV
        5 Not Locked Unknown 0 0 0 0.0
        6 Not Locked Unknown 0 0 0 0.0
        7 Not Locked Unknown 0 0 0 0.0
        8 Not Locked Unknown 0 0 0 0.0


        Downstream OFDM Channels
        Channel LockedStatus ProfileID ChannelID Frequency Power SNR/MER ActiveSubcarrier Unerror Correctable Uncorrectable
        1 Locked 0 ,1 ,2 ,3 193 722000000 Hz 3.38 dBmV 43.5 dB 328 ~ 3767 1703976097 450254190 330749
        2 Locked 0 ,1 ,2 ,3 194 957000000 Hz 4.08 dBmV 43.6 dB 148 ~ 3947 1746128284 325347540 103554


        Upstream OFDMA Channels
        Channel LockedStatus ProfileID ChannelID Frequency Power
        1 Not Locked 0 0 0 Hz 0 dBmV
        2 Not Locked 0 0 0 Hz 0 dBmV