NETGEAR is aware of a growing number of phone and online scams. To learn how to stay safe click here.
Forum Discussion
Solved
Nighthawk X6 - Model R8000 INTERNET repetitive disconnects with no log
Hi my router worked well after the last firmware update some months ago. Firmware V1.0.4.12_10.1.46 . Then about 10 days ago it has started disconnecting very frequently and repetitively, and reconne...
Hi, thanks James. I did install it earlier today.
I imagine that it must be related to the security issues in the news.
supposed to allow auto update of the firmware too.
Hopefully all goes well and keeps hackers at bay.....
But also this morning I had the visit of my 3rd technician and I am hopeful it is going to be finally working well.
First technician did some connections tightening and changes and changed my modem to another thomson. Not better five minutes after he left
I went to mediacom shop the next day to get another modem, arris, better.
2 days later second technician was helpful finding out and telling me there was a capacity problem sometimes (that appears in logs at the provider) and that he was going to ask to be looked at.
Then nothing happened during 2 weeks and still internet often bad.
No news about capacity increase when I was asking and it did look like problem was still too present to be only that.
Called and complained last week and Surprise: Third technician rings at the door this morning today.
I think he did a good job, very methodical, replaced some cables that were dammaged from ?rabbits, checked every connection and splitter. changed several. Noticed also I was using a ethernet cable from modem to wifi that was maybe a limiting factor in the speeds and not related to the drop we think
Very happy with him. Very hopeful. No issue for the last 12 hours and I saw the firmware and updated.
So modems might be more or less performant with a bad signal but I think 2 main factors to my problems have been
-coax dammaged and connections loose or deficient (hopefully all fixed for the moment)
-maybe capaicity
To have an increased capacity provider must do increase of capacity and it might not happen soon but I will be challenging them if problem
Also I have a 8 channel modem, might go and buy a 16 channel one. Hearing it could help.
If I think about the technicians I have had,I have seen others and none was as professional as the one today I think and I had given up on a TV problem (frozen frames) on TV for the last 2 years, getting worse last 2 moths while internet also underwent issues leading to this post.
Will check whether it improved or still happens.
Pretty thankful to the technician of this morning also I have learned a lot thanks to talking to them and this chat. Thankful to this chat too.
Note the packet cable log of my modem is off by 5hours but I think all log lines are there
example it says 18:08 for 13:08 (1:08PM)
NGbaby wrote:
Note the packet cable log of my modem is off by 5hours but I think all log lines are there
example it says 18:08 for 13:08 (1:08PM)
You probably never set the TIMEZONE as it defaults to the west coast of the US. Go to the ADVANCED tab, open SECURITY, select SCHEDULE, and you'll find the setting on the bottom of the page.
Looks more like a bug. And is on the router where I don't see I can do anything but display. Thanks though.
This is the list of modems supported by mediacom.
any comment vs my router nighthawk X6 R8000
or maybe I post another topic?
Best buy recommends
https://www.bestbuy.com/site/shop/cable-modems-for-mediacom
maybe what functionalities are recommended / available
if we can't talk about a model
we have TV cable
and my son plays on xbox
plus I am concerned about security
Thanks!
NGbaby wrote:
This is the list of modems supported by mediacom.
any comment vs my router nighthawk X6 R8000
or maybe I post another topic?
Best buy recommends
https://www.bestbuy.com/site/shop/cable-modems-for-mediacom
maybe what functionalities are recommended / available
if we can't talk about a model
we have TV cable
and my son plays on xbox
plus I am concerned about security
Thanks!
Spectrum has a better list to decide which to get, http://support.brighthouse.com/Article/Use-Own-Modem-With-Hsi-Service-9109/, it lists the SPEED they can be used up to.
The BestBuy list doesn't match the MediaCare though?
You'd really have to go through the INDIVIDUAL devices, as you see they only list if they have a Phone and wireless, and if wireless, the speeds. Assuming you don't want to replace the R8000 then don't worry about wireless, but don't get one that has wireless. Still, you have to check both for the PUMA 6 chipset (really don't want to buy one of those), see http://www.overclock.net/forum/18049-network-hardware/1618653-do-not-buy-these-modems-all-puma6-based-they-all-defective-no-real-fix-sight.html for a list that may not even be complete, and the rated speed of what you are looking at. An 32x4 (or 32 channels are best, models are 8x4, 16x4, and 24x4 as well) has generally higher speed capability (Best Buy shows that info).
To me the Mediacom list looks outdated as well?
About all you can do is check the links to the modems and make a choice, but I'd wait until Sunday myself at least. Again, if you need the Phone feature, your choices are really limited.
NGbaby wrote:
we have TV cable
and my son plays on xbox
plus I am concerned about security
Thanks!
Cable TV has nothing to do with Internet or the Internet modem. A different connection.
Security, well, that can play into this.
If the ISP supplies the modem, that is their responsibility to update the modem is there is a security firmware release. Your modem behind it you own the responsibility. That an any security you put on devices.
It gets 'sticky' if you OWN the modem though. Some IPS's might take 'control' of the modem and handle ALL updates, so do not. Ask MediaCom.
A combo modem/router might be another problem for you as well. You might need an update for the router function (new flash) but the ISP may not allow it to be installed... you'd have to talk to Mediacom about this before buying.
One last thing to consider. Just think about this PRESENT problem... if you owned the modem MediaCom would have tested to see if the Internet was reaching the modem and the line was good and told you it was YOUR problem. Possible they might have done more, but if they did they'd send someone out who would just check the lines, NOT the modem probably. Are you equiped to handle this? You might be buying a new modem and discovering it didn't fix the problem. At best you could return the new modem, possibly paying mailing fees, a restocking fee, or both?
Only you can make this decision. But Cable TV or Security of the modem (unless you buy one) isn't an issue.
Michael and Irvsp would like to thank you very much for your help. I have learned a lot and discovered the modem as a potential problem and a solution.
Now I am touching wood because since I tightened we have been having at least an hour now without any drop and any MTA log etc...
Connections did not look loose but them might have been.
And if not the solution I will be more ready to follow up with the technician.
Yes it seems the phone hook up is very limitating.
I ll keep you posted after this evening. my son is playing with friends on the xbox and any issue will be immediately detected.
It happened again.
Strangely just when I brought an ipod inside the house and it requested a dhcp. Same ipod that requested dhcp multiple times today while it was failing. bizzarre.
Well it happened again a lot.
And everytime there was a DHCP issue.
So given the fact that the router is the DHCP server not so sure anymore the problem is the thomson modem.
maybe it is the Netgear R8000 router or / and maybe some devices?
I have blocked some devices not absolutely needed tonight to try to decrease the load. or turned off their wifi.
But even blocked the devices request dhcps.
I will reboot the router .
maybe I will end up resetting to factory default too when time tomorrow
Just how are you determining that it is a DHCP request that is causing dropped Internet?
I'd think any device attempting to connect is first looked against the blocked device list? If on the list it is blocked? It should never be assigned an IP Address, and therefore not use DHCP server?
I also don't understand the connection between the router's DHCP server and T3 and T4 timeouts on the modem?
Does your LOG actually show the BLOCKED device connecting?
Turn on WIRELESS ACCESS on the LOG function, that will put entries in the log when any wireless device connects.
Not saying there can't be a problem with your router, just that it doesn't make sense to me? The router can not cause a problem with the modem from what I know, although there have been some reports of a failing router putting a voltage on the modem to router cable that caused problems, but even that didn't make sense to me?
If you do not use the modem/router from the isp as a router you may be able to get a modem only with the telephone service but without a router. It is possible that the modem from your isp is out of data and can not be used with their service anymore.
I have done the factiry reset.
Not sure about any impact but done.
Now looking at the signal on the modem as a clue.
Night has been quiet but the drops could come back.
The technician is due this afternoon
Signal to noise ration might be to low
if time I would try to tweek the connections around to see if any improvement.
Else ready for the technician
RF Parameters - Downstream Channel Frequency Power Signal to Noise Ratio Modulation 1 117.0 MHz -4.3 dBmV 36.5 dB 256 QAM 2 111.0 MHz -4.8 dBmV 36.6 dB 256 QAM 3 123.0 MHz -3.7 dBmV 36.6 dB 256 QAM 4 129.0 MHz -3.0 dBmV 37.2 dB 256 QAM 5 147.0 MHz -3.0 dBmV 37.2 dB 256 QAM 6 153.0 MHz -3.6 dBmV 37.3 dB 256 QAM 7 159.0 MHz -3.9 dBmV 37.2 dB 256 QAM 8 165.0 MHz -4.7 dBmV 37.2 dB 256 QAM RF Parameters - Upstream Channel Frequency Power Upstream Data Rate Modulation 1 28.0 MHz 51.3 dBmV 5120 Ksym/sec 64 QAM 2 35.0 MHz 52.8 dBmV 5120 Ksym/sec 64 QAM 3 0.0 MHz 0.0 dBmV 0 Ksym/sec QPSK 4 0.0 MHz 0.0 dBmV 0 Ksym/sec QPSK
NGbaby wrote:
I have done the factiry reset.
Not sure about any impact but done.
Now looking at the signal on the modem as a clue.
Night has been quiet but the drops could come back.
The technician is due this afternoon
Signal to noise ration might be to low
if time I would try to tweek the connections around to see if any improvement.
Else ready for the technician
RF Parameters - Downstream Channel Frequency Power Signal to Noise Ratio Modulation 1 117.0 MHz -4.3 dBmV 36.5 dB 256 QAM 2 111.0 MHz -4.8 dBmV 36.6 dB 256 QAM 3 123.0 MHz -3.7 dBmV 36.6 dB 256 QAM 4 129.0 MHz -3.0 dBmV 37.2 dB 256 QAM 5 147.0 MHz -3.0 dBmV 37.2 dB 256 QAM 6 153.0 MHz -3.6 dBmV 37.3 dB 256 QAM 7 159.0 MHz -3.9 dBmV 37.2 dB 256 QAM 8 165.0 MHz -4.7 dBmV 37.2 dB 256 QAM RF Parameters - Upstream Channel Frequency Power Upstream Data Rate Modulation 1 28.0 MHz 51.3 dBmV 5120 Ksym/sec 64 QAM 2 35.0 MHz 52.8 dBmV 5120 Ksym/sec 64 QAM 3 0.0 MHz 0.0 dBmV 0 Ksym/sec QPSK 4 0.0 MHz 0.0 dBmV 0 Ksym/sec QPSK The Upstream for channel 1 and 2 seems high from a video on youtube about amps for cable modems most say people who use them say over 50dbmv is high and the lower too mid 40's is the range they seem want to get too.
From what they say a high Upstream power on the modem can cause problems with your internet connection.
Went down again.
still looking at the model signal for clues
but on top of that there were DDOs attacks that totally ruined us during 10 minutes
but this time It went down terribly 3 times in 6 minutes (and ruined my son's game on xbox)
and at the ery same time there were DDoS attacks
The modem log is full again and I can't copy paste
but there were 3 MTA resets at 11:51 11:53 and 11:55
[UPnP set event: Public_UPNP_C3] from source 192.168.1.60, Sunday, May 06,2018 12:00:50
[DoS attack: FIN Scan] attack packets in last 20 sec from ip [23.35.204.141], Sunday, May 06,2018 11:56:40
[DoS attack: FIN Scan] attack packets in last 20 sec from ip [23.35.207.10], Sunday, May 06,2018 11:56:37
[DoS attack: FIN Scan] attack packets in last 20 sec from ip [23.35.204.15], Sunday, May 06,2018 11:56:37
[DoS attack: FIN Scan] attack packets in last 20 sec from ip [23.35.204.141], Sunday, May 06,2018 11:56:37
[DoS attack: ACK Scan] attack packets in last 20 sec from ip [23.35.204.141], Sunday, May 06,2018 11:56:34
[DoS attack: FIN Scan] attack packets in last 20 sec from ip [23.10.240.216], Sunday, May 06,2018 11:56:33
[UPnP set event: Public_UPNP_C3] from source 192.168.1.60, Sunday, May 06,2018 11:55:52
[UPnP set event: Public_UPNP_C3] from source 192.168.1.60, Sunday, May 06,2018 11:55:27
[UPnP set event: Public_UPNP_C3] from source 192.168.1.60, Sunday, May 06,2018 11:53:58
[UPnP set event: Public_UPNP_C3] from source 192.168.1.60, Sunday, May 06,2018 11:53:33
[DoS attack: FIN Scan] attack packets in last 20 sec from ip [35.186.224.62], Sunday, May 06,2018 11:52:11
[UPnP set event: Public_UPNP_C3] from source 192.168.1.60, Sunday, May 06,2018 11:51:49
[UPnP set event: Public_UPNP_C3] from source 192.168.1.60, Sunday, May 06,2018 11:49:48Basic Status
Basic LAN
Thanks William
Your comments are interesting about the upstream channels.
no Youtube video
but I suspect the Xbox of my son playing Fortnite.
I have looked up the ip address
The DDos attacks of thise morning came from Akamai technology and from Google.
What can I do about that?
Baseline my son is not playing anymore on xbox.
Funnily there seems to be only one upstream channel on, not sure what it means.
Basic Status
Basic LAN
If you note between the two postings of the UPSTREAM parameter's that the second does NOT have #2, and the modem is probably trying to correct that by rebooting or initializing. Could very well be the cause.
Here is a link on power and SNR (Signal to Noise Ratio) that might be of interest, http://www.motorolacable.com/documents/CableConnection.pdf.
Another thing on the modem is to look at the CORRECTEDS and UNCORRECTABLES and that CAN be large numbers. I've attached my modem's screenshot of those. No matter how many you have, they should not large compared to the Octets, a miniscule amount.
Too many DoS Attacks though can shutdown the router for 20 seconds if from the same IP Address I think? Might want to Google "how to stop ddos attacks on netgear router" to see more on this. However, you will find Googling any DoS Attack that a majority will be Netgear routers. I suspect the routers are giving FALSE POSITIVES. I get them quite often, and many different forms. When I check the IP Addresses they are usually some site I go to, like Amazon, or Akmai (sp?) which most sites use for Advertising/cookies. I attribute it to the router dropping a bit here or there or was in a busy state to handle it. Could be the modem 'thought' it corrected a TCP/IP packet and sent it to the router and router thought it was bad? I just don't know, but I ignore those.
By the way, the System Uptime is how many hours have passed since the MODEM rebooted... That could have even been when no one was using the Internet, a little over 10PM last night?
Thanks. I rebooted he modem yesterday at 10PM.
About DDos attacks, lately they have been from akamai and google.
I have had some from exotic places too, but not recently that I have noticed.
I have googled in the past but not found effective answers.
Maybe they induce an traffic overload , like the DHCP assignment.
Sure when the modem fails it is more when it works than when it does not.
I'll ak the technician about the upstream channel disappearance.
Maybe I'' reboot myself to see whether the second one comes back.
I'll look at your links thanks.
replying to Irvsp
Thanks
I am not sure about the dhcp and the blocked behaviour.
I am sure i have the wireless access flagged and I see the dhcp / ip assignments
example
DHCP IP: (192.168.1.50)] to MAC address xxxx, Sunday, May 06,2018 11:01:52
Does an ip address gets assigned if first access and access control on with block every new?
I will try to observe with the opportunity I have recently done a factiory so I see my devices trying to connect.
there might be 2 kinds of block behavious
the initial
the return
I use the block feature very often on genie app to block my son from playing or chatting
I think in that case the device gets an ip when reconecting while being blocked
To make things a little more special I also assign ips to the devices so I identiy quiclky if knowm or not and whose kid / parent it is.
I don't know much about dhcp. why would a device request / obtain once 10 times in a row in few minutes.
when does a device request / obtain a new one.
I may need to study a little to be more educated.
did you share a link about it?
Thanks
Here is the link to one of the videos dealing with the issue https://www.youtube.com/watch?v=kxarSx0rQ9M
I hope this helps.
As far as 'blocked devices' getting an IP Address, I can't really say? Logic says they should not under any circumstances? That doesn't mean what the router might do? I 'googled' if a blocked MAC address can get an IP Address and can NOT find anything about that, not a single link?
Now if you are using TIME to block, it is possible it is on the LAN and when the time hits, it might be logging it blocked it?
As for seeing multiple entries of getting IP Addresses, I see it SPECIFICALLY with my wife's PC that is at 192.168.1.40 (I too assign the PC specific IP Address so I know I can always get to this even if 'sharing' doesn't work well (which does happen). For instance:
[Time synchronized with NTP server] Friday, May 04,2018 19:09:46 [Internet connected] IP address: 67.8.xx.xx, Friday, May 04,2018 19:09:45 [DHCP IP: (192.168.1.40)] to MAC address 08:BD:43:A5:8C:AA, Friday, May 04,2018 18:57:50 [DHCP IP: (192.168.1.40)] to MAC address 08:BD:43:A5:8C:AA, Friday, May 04,2018 18:57:38 [DHCP IP: (192.168.1.30)] to MAC address F8:B1:56:DD:6A:5B, Friday, May 04,2018 18:30:51 [DHCP IP: (192.168.1.40)] to MAC address 08:BD:43:A5:8C:AA, Friday, May 04,2018 17:45:15 [Time synchronized with NTP server] Friday, May 04,2018 17:43:40 [Internet connected] IP address: 67.8.xx.xx, Friday, May 04,2018 17:43:39
See different time, and one 18 seconds apart...
[DHCP IP: (192.168.1.40)] to MAC address 08:BD:43:A5:8C:AA, Friday, May 04,2018 13:34:28 [Time synchronized with NTP server] Friday, May 04,2018 13:24:23 [Internet connected] IP address: 67.8.xx.xx, Friday, May 04,2018 13:24:22 [DHCP IP: (192.168.1.40)] to MAC address 08:BD:43:A5:8C:AA, Friday, May 04,2018 12:48:15 [DHCP IP: (192.168.1.40)] to MAC address 08:BD:43:A5:8C:AA, Friday, May 04,2018 12:10:51 [DHCP IP: (192.168.1.40)] to MAC address 08:BD:43:A5:8C:AA, Friday, May 04,2018 12:10:38 [DHCP IP: (192.168.1.40)] to MAC address 08:BD:43:A5:8C:AA, Friday, May 04,2018 12:00:52 [DHCP IP: (192.168.1.40)] to MAC address 08:BD:43:A5:8C:AA, Friday, May 04,2018 12:00:31 [Time synchronized with NTP server] Friday, May 04,2018 11:58:25 [Internet connected] IP address: 67.8.xx.xx, Friday, May 04,2018 11:58:24
Some more...
I for the LIFE of me can NOT resolve why this happens. I checked when she wakes up here computer (which goes to sleep, and if sleeping long enough I know the USB wireless adapter seems to disconnect as when she does wake up the computer sometimes the Wireless Connectoid on the Systray shows no connection momentarily) and NEVER correlate those actions to log entries? I don't think it is Windows causing this, and if you run IPCONFIG /ALL you should see LEASE times of 24 hours:
Lease Obtained. . . . . . . . . . : Sunday, May 6, 2018 3:27:23 PM
Lease Expires . . . . . . . . . . : Monday, May 7, 2018 3:27:23 PMThe above is for MY machine, I was out and came back in and woke it up. So it got a NEW LEASE it seems. This PC is hard wired, and it does correlate the time of the DHCP lease to the LOG:
[DHCP IP: (192.168.1.30)] to MAC address F8:B1:56:DD:6A:5B, Sunday, May 06,2018 15:27:23
I sort of have a feeling that for WIRELESS it is different? Possibly it checks periodically to see if it is still connected OR it sense it has lost the IP Address and reestablishes it? Still, I can not reconcile all the DHCP entries in the log to any PC operations.
Secondly, I 'believe' that LOGGING is a very WEAK point in NG's routers. You can't log everything easily. It is possible some logging (like DoS attacks) are completely wrong or incomplete (I've seen ones that clearly have missing letters in what was logged). I'm sort of thinking in this case it isn't a DHCP request/assignment, but the Wireless device waking up and asking the router if it still has the same IP Address and the router logged that as a DHCP request. That goes back to the method old DIALUP and even Cable systems control the DHCP given out. They have a limited pool, and in DialUp of course once you hang up your IP Address is put back into the available pool. Cable, different story, always on unless you power down the modem. Still, Cable uses a server with a limited number of IP Addresses assigned to an area. Let's say 254 addresses. However it is NOT cost effective for them to have a node for only 254 customers. They know not everyone uses the computer at the same time, so for arguements sake lets say they assign 300 users to that node. Now when 254 are in use and no one has disconnected or let the LEASE (24 to 36 hours are normal with a RENEW usually done in 1/2 that time) expire they will look at the LAST TIME USE, and the oldest time last used will be dropped and given that IP Addresss. However, this IS rare. When it does happen the ISP knows it needs to split the node and create a new one.
So what does all this have to do with anything? The PC doesn't really know for sure where the DHCP server is? Under whose control either, so when it comes back to 'life' it will check if it is still its IP Address probably. If it were given away it would get a new one. If you are using a declared IP Address (Static) then as LONG as it is NOT within the POOL of available DHCP IP Addresses (you can set the size of the pool in the router and the highest number should be below the declares fixed IP address or conversely, the lowest number above the last fixed IP Address you used. Other wise you could have conflicts on the address and someone could lose Internet connections.
NGbaby wrote:
I have looked up the ip address
The DDos attacks of thise morning came from Akamai technology and from Google.
What can I do about that?
Ignore them. They are a "feature" of Netgear's wonky logging system. It flags up legitimate traffic as DDos attacks.
Amazon, Google, ISPs, they all turn up in those halls of fame from time to time. If you have some time to spare, search this forum for DDos and "false positive".
The good news is that because they are flagged up they have done no harm to your system.
Possible that the usb wifi adaptor is shutting down if not used for a while when the computer goes a sleep, not sure if it is a laptop or not a laptop would turn off unneeded devices to save battery life when a sleep. Power management settings in windows and the settings of the devices driver software can play in when and if the device shuts down at specific time or even. My does the same thing the wifi usb adaptor must wake up and log back on the wifi network.
William10a, true that can shut it down and cause this. However in my situation that should 'not' happen.
Not only the USB adapters Properties set NOT to allow the computer to turn it off to save power (this is a desktop also) but you must also do the same for both the ROOT and GENERIC USB HUBS... those going off will take down the adapter as well.
All I can figure it the adapter s/w (this is a NG A6200 AC adapter) knows the PC is coming out of sleep and checks to see if the IP Address is still good? Happened on the R7000 and now the R8000. I think logging on both routers leave a lot to be desired, but I suspect it isn't the top of a list NG worries about?
Logging issues have been going on for a while and you are correct Netgear is not worry about the issue either they have other issues to handle which still need attention.
