Nighthawk R7000 needs frequent reboots

Running: V1.0.11.116_10.2.100

First, Sorry that this got to long. Please feel free to ignore and not read the whole thing.
I just wanted to relay my experience and how I have the router behaving very well now.

________________________________________________________________________

So I have been plagued with this stupid problem to the point of where I started to look for a different router.

But I'm holding off because I seem to have the router cooperating a lot more by doing a couple of things every day or two, that seem to keep it operating just fine now.

I haven't HAD TO reboot it in a couple of weeks or so! THAT'S PROGRESS!

So first, let me say, I think that ONE of the major problems with this router and its firmware versions, is that it does not handle massive traffic very well, EVEN THOUGHT IT'S A 'GAMING" router.

For my gaming server (which I no longer run or bother with), I had a bunch of ports forwarded to my server's static IP.
Being that these particular ports are well known for the environment I was running, there were constant attacks by :

Russia

China

and a few other countries where reporting bad actors was useless.

At one point, so that I wouldn't have to totally remove all the redirects, I just put in a fake IP that went no where on my network, so that any attacks to any of those port ranges would just go to that fake IP.

I also set up huge ranges to redirect attacks to there as well...
THAT WAS A MISTAKE!!!! That's because the router would STILL try to process the requests rather than just ignoring them.

I would notice my entire network starting to grind to a halt , so I'd check the logs and see hundreds of attacks, trying to get into my server. From Remote Desktop attempts to DoS attacks to port hammering, etc.

I'd have to reboot my router and the modem that connects me to my ISP.
Doing so would get me a new external IP as well as clear the cache in the router.
I would also clear the logs, apply and refresh to clean that up.

Sometimes, I couldn't even log into the router and I would have to power cycle it.

I still have some ports open for my security cameras so that I can access away from home.

But with that, I still had the router choke up every couple of days.

I finally decided to REMOVE ALL PORT FORWARDING except for my cameras. Those are vital.

Well that settled things down A LOT!

However, then I would see those same countries trying to access my cameras.

So for those, I tightened up their passwords. At least it won't be easy for those BOZOS to monitor my cams.

But still, the router was not stable. Sure, it was a lot more stable, but I still had to reboot every few days!

To troubleshoot this problem, I have a Command Prompt constantly pinning google.com -t.
When the router would start to get wonky, I'd see packets dropping from the ping.... INTERESTING.

Sure enough, in the logs, I would see attacks, including still, DoS attacks.

But something still didn't seem right.

So then, I added another command prompt window and constantly piinged the router's internal IP.
I wanted to see if pinging outside my network to the internet would fail, but internal pinging was ok.

Sometimes, this was the case ,but other times, more often, when one would start dropping packets, so would the other! HMMMMM

So then, I powered up my laboratory computer, which sits right beside the router and is wired directly into it. This computer does NOT go through anything else, no switches, nothing.
I also ran a command prompt, pinging the router as well.

Now, with 3 pings being monitored, I could get a better visual on where the breakdown is happening.

So now here is where I found what is in fact one of the biggest problems with this dammed router.

THE LOGS! Yes! THE FREAK'N LOGS!

What I discovered that as the log file increased in size, is when the router would start to get wonky!

I could see dropped packets on the external ping, then drops on this machine that pings the router (but it goes through switches). But sometimes, the Lab computer wasn't seeing drops!

But then, I'd start seeing drops on the connected Lab computer.

I started monitoring the logs closer but nothing unexpected was seen.

I did notice, however, that the drops were right around the time that the attackers were trying to get connected to the ports that I did have open.

But at other times, even with that, there was no issues.

I got into the habit of clearing the logs so I would get a clear picture each time.

It's then that I noticed, when I cleared the logs, within seconds, the dropping of packets stopped and the router settled back down!

I've seen this kind of file corruption in older software, but I would have thought that in 2020/2021 there would be much better routines to keep caching in check.

So, very long story short,

- remove any port forwarding that you do not NEED

- do not set up huge ranges of ports to forward to a fake IP (if you don't forward ports, the router will just ignore requests to ports not listed)

- clear the log daily (at least to confirm if this solves the problem).