NETGEAR is aware of a growing number of phone and online scams. To learn how to stay safe click here.

Forum Discussion

tcarvin's avatar
tcarvin
Aspirant
Nov 13, 2020

R7000 - Very frequent disconnects and Self2WAN ICMP type b Detected

Nighthawk R7000

 

Firmware Version
V1.0.9.88_10.2.88

 

We have been having recent problems with the internet going up and down like a yoyo. I can see in the router logs lots of connections, and disconnects.  And frequently one or more "Self2WAN ICMP type b Detected" right after.

 

[Internet connected] IP address: XX.XX.XX.XX, Friday, Nov 13,2020 10:05:39
[Self2WAN ICMP type b Detected!] To prevent from revealing router's activity, this packet is droppe Friday, Nov 13,2020 10:00:59
[Time synchronized with NTP server] Friday, Nov 13,2020 10:00:39
[Internet connected] IP address: XX.XX.XX.XX, Friday, Nov 13,2020 10:00:39
[Internet disconnected] Friday, Nov 13,2020 10:00:35
[Internet connected] IP address: 192.168.254.10, Friday, Nov 13,2020 10:00:21
[Internet connected] IP address: 192.168.254.10, Friday, Nov 13,2020 10:00:06
[Internet connected] IP address: 192.168.254.10, Friday, Nov 13,2020 09:59:50
[Internet connected] IP address: 192.168.254.10, Friday, Nov 13,2020 09:59:35
[Internet connected] IP address: 192.168.254.10, Friday, Nov 13,2020 09:59:20
[DHCP IP: (192.168.1.6)] to MAC address 58:82:A8:4B:0C:5E, Friday, Nov 13,2020 09:59:14
[Internet connected] IP address: 192.168.254.10, Friday, Nov 13,2020 09:59:05
[Internet connected] IP address: 192.168.254.10, Friday, Nov 13,2020 09:58:50
[Internet connected] IP address: 192.168.254.10, Friday, Nov 13,2020 09:58:35
[Internet connected] IP address: 192.168.254.10, Friday, Nov 13,2020 09:58:19
[Internet connected] IP address: 192.168.254.10, Friday, Nov 13,2020 09:58:05
[Internet disconnected] Friday, Nov 13,2020 09:57:54
[Internet connected] IP address: XX.XX.XX.XX, Friday, Nov 13,2020 09:57:18
[DHCP IP: (192.168.1.20)] to MAC address 98:01:A7:9A:E7:CB, Friday, Nov 13,2020 09:56:11
[Time synchronized with NTP server] Friday, Nov 13,2020 09:52:18
[Internet connected] IP address: XX.XX.XX.XX, Friday, Nov 13,2020 09:52:18
[Admin login] from source 192.168.1.12, Friday, Nov 13,2020 09:51:18
[Admin login] from source 192.168.1.12, Friday, Nov 13,2020 09:51:03
[Time synchronized with NTP server] Friday, Nov 13,2020 09:47:18
[Internet connected] IP address: XX.XX.XX.XX, Friday, Nov 13,2020 09:47:17
[DHCP IP: (192.168.1.2)] to MAC address D4:12:43:D2:18:FA, Friday, Nov 13,2020 09:43:51
[Self2WAN ICMP type b Detected!] To prevent from revealing router's activity, this packet is droppe Friday, Nov 13,2020 09:43:03
[Self2WAN ICMP type b Detected!] To prevent from revealing router's activity, this packet is droppe Friday, Nov 13,2020 09:42:47
[Self2WAN ICMP type b Detected!] To prevent from revealing router's activity, this packet is droppe Friday, Nov 13,2020 09:42:31
[Self2WAN ICMP type b Detected!] To prevent from revealing router's activity, this packet is droppe Friday, Nov 13,2020 09:42:19
[Time synchronized with NTP server] Friday, Nov 13,2020 09:42:19
[Self2WAN ICMP type b Detected!] To prevent from revealing router's activity, this packet is droppe Friday, Nov 13,2020 09:42:18
[Internet connected] IP address: XX.XX.XX.XX, Friday, Nov 13,2020 09:42:18
[Internet disconnected] Friday, Nov 13,2020 09:42:14
[Internet connected] IP address: 192.168.254.10, Friday, Nov 13,2020 09:41:54
[Internet connected] IP address: 192.168.254.10, Friday, Nov 13,2020 09:41:39
[Internet connected] IP address: 192.168.254.10, Friday, Nov 13,2020 09:41:25
[Internet connected] IP address: 192.168.254.10, Friday, Nov 13,2020 09:41:10
[Internet connected] IP address: 192.168.254.10, Friday, Nov 13,2020 09:40:55
[Internet connected] IP address: 192.168.254.10, Friday, Nov 13,2020 09:40:40
[Internet connected] IP address: 192.168.254.10, Friday, Nov 13,2020 09:40:25
[Internet connected] IP address: 192.168.254.10, Friday, Nov 13,2020 09:40:10
[Internet connected] IP address: 192.168.254.10, Friday, Nov 13,2020 09:39:55
[Internet connected] IP address: 192.168.254.10, Friday, Nov 13,2020 09:39:41
[Internet disconnected] Friday, Nov 13,2020 09:39:29

 

Even in places where there is no disconnect I see connects every 5 minutes:

 

[Time synchronized with NTP server] Friday, Nov 13,2020 09:05:14
[Internet connected] IP address: XX.XX.XX.XX, Friday, Nov 13,2020 09:05:14
[Time synchronized with NTP server] Friday, Nov 13,2020 09:00:14
[Internet connected] IP address: XX.XX.XX.XX, Friday, Nov 13,2020 09:00:14
[Time synchronized with NTP server] Friday, Nov 13,2020 08:55:14
[Internet connected] IP address: XX.XX.XX.XX, Friday, Nov 13,2020 08:55:13
[Time synchronized with NTP server] Friday, Nov 13,2020 08:50:14
[Internet connected] IP address: XX.XX.XX.XX, Friday, Nov 13,2020 08:50:14
[Time synchronized with NTP server] Friday, Nov 13,2020 08:45:14
[Internet connected] IP address: XX.XX.XX.XX, Friday, Nov 13,2020 08:45:13
[Time synchronized with NTP server] Friday, Nov 13,2020 08:40:14
[Internet connected] IP address: XX.XX.XX.XX, Friday, Nov 13,2020 08:40:14
[Time synchronized with NTP server] Friday, Nov 13,2020 08:35:14
[Internet connected] IP address: XX.XX.XX.XX, Friday, Nov 13,2020 08:35:14

 

The XX is the IP from my ISP. I have the R7000 acting as a router, and the box from Frontier setup to act as a modem only (it passes the ISP IP to the R7000, has WIFI off, etc). This setup has been working for several years.

 

When this first happened, my son claims it was a caused my DDOS related to some xbox game (apparently that is a way folks cheat now)? Not sure if I beieve what he is saying in that regard.

 

Any ideas? 

2 Replies

  • tcarvin's avatar
    tcarvin
    Aspirant
    Nov 13, 2020

    A brief update, I just saw this in the log now too:

     

    [Time synchronized with NTP server] Friday, Nov 13,2020 13:07:09
    [Internet connected] IP address: XX.XX.XX.XX, Friday, Nov 13,2020 13:07:09
    [DoS attack: Smurf] (4) attack packets in last 20 sec from ip [XX.XX.XX.XX], Friday, Nov 13,2020 13:03:14
    [DoS attack: Smurf] (5) attack packets in last 20 sec from ip [XX.XX.XX.XX], Friday, Nov 13,2020 13:02:21
    [Time synchronized with NTP server] Friday, Nov 13,2020 13:02:09
    [Internet connected] IP address: XX.XX.XX.XX, Friday, Nov 13,2020 13:02:08

     

    And again, XX is my WAN IP.

    • tcarvin's avatar
      tcarvin
      Aspirant
      Nov 13, 2020

      One last snippet, in addition to the "Smurf" attack, there is also a "FIN Scan" one.  I don't know if these are related to the "Internet Connected" every 5 minutes or not.

       

      [Time synchronized with NTP server] Friday, Nov 13,2020 13:26:59
      [Internet connected] IP address: XX.XX.XX.XX, Friday, Nov 13,2020 13:26:58
      [Admin login] from source 192.168.1.2, Friday, Nov 13,2020 13:26:44
      [DHCP IP: (192.168.1.11)] to MAC address 98:01:A7:9A:E7:CB, Friday, Nov 13,2020 13:26:00
      [Time synchronized with NTP server] Friday, Nov 13,2020 13:21:58
      [Internet connected] IP address: XX.XX.XX.XX, Friday, Nov 13,2020 13:21:58
      [DHCP IP: (192.168.1.10)] to MAC address 84:AB:1A:34:AB:C2, Friday, Nov 13,2020 13:19:40
      [DHCP IP: (192.168.1.9)] to MAC address F6:C2:E4:B0:8A:F1, Friday, Nov 13,2020 13:19:29
      [Time synchronized with NTP server] Friday, Nov 13,2020 13:17:46
      [DoS attack: FIN Scan] (3) attack packets in last 20 sec from ip [13.225.198.114], Friday, Nov 13,2020 13:17:43
      [Admin login] from source 192.168.1.2, Friday, Nov 13,2020 13:17:20
      [Admin login] from source 192.168.1.2, Friday, Nov 13,2020 13:17:05
      [DoS attack: FIN Scan] (1) attack packets in last 20 sec from ip [13.225.198.114], Friday, Nov 13,2020 13:17:02