NETGEAR is aware of a growing number of phone and online scams. To learn how to stay safe click here.

Forum Discussion

fimpowde's avatar
fimpowde
Aspirant
Jan 07, 2021

R7450 keeps dropping internet connection

I have the Nighthawk R7450 router (firmware v1.2.0.76_1.0.1) for about 6 months now, this problem has been going on since i got the router, and i am totally confused on it.  Prior to installing this new router, i had a 10yr old Apple Airport Express that never showed this issue.

 

Like a lot of other people these days, i am working from home, which means VPN into the corporate network all day to work.  Use windows10 with Cisco Anyconnect, nothing fancy - tried being wired or wireless - same results.  Basically, over the course of the day my Cisco VPN drops and restarts for seemingly no reason until I look at the log on the Nighthawk Router (see below). Tthe VPN auto=reconnects, but during the ~1min of drop/reconnect i lose my video and voice to the corporate world - kind of pain when its during a video conference.  Also when others in the house streaming a video off our local SAN on the home network, NO issues during these times, but streaming from Netflix or others will cause a buffering or restart of the streaming application.

 

Here is.a cut/paste below of the log - these DoS attack's coinside with the dropping of my VPN - how do i stop this?  I went to Optimum (cable provider) and got a new internet modem to get a new IP, and it reduced the issue in frequency, but not eliminated.  Also this is just a snip-it of the log - these happen probably 100 times in 24 hrs.

 

DHCP IP: (192.168.1.29)] to MAC address 04:1E:64:F0:56:B6 Thursday, January 07,2021 14:45:46
[DHCP IP: (192.168.1.25)] to MAC address 78:4F:43:A6:C7:84 Thursday, January 07,2021 14:45:37
[DoS attack: ACK Scan] from source: 23.41.190.48:443 Thursday, January 07,2021 14:37:20
[DoS attack: ACK Scan] from source: 23.41.190.48:443 Thursday, January 07,2021 14:34:13
[DHCP IP: (192.168.1.5)] to MAC address 24:62:AB:33:4B:99 Thursday, January 07,2021 14:32:12
[DoS attack: ACK Scan] from source: 34.194.215.242:443 Thursday, January 07,2021 14:30:46
[DoS attack: ACK Scan] from source: 34.194.215.242:443 Thursday, January 07,2021 14:30:16
[DoS attack: ACK Scan] from source: 151.101.210.114:443 Thursday, January 07,2021 14:27:06
[DoS attack: ACK Scan] from source: 216.58.193.131:443 Thursday, January 07,2021 14:26:01
[DoS attack: ACK Scan] from source: 3.222.225.80:443 Thursday, January 07,2021 14:25:20
[DoS attack: ACK Scan] from source: 161.97.95.36:443 Thursday, January 07,2021 14:23:08

Any suggestions would be much appreciated - not sure what else in the configuration or setup i could add to help here - let me know if you need more information - but most everything is default, no remote management or remote connection into my home network.  Thank you

5 Replies

  • michaelkenward's avatar
    michaelkenward
    Guru - Experienced User
    Jan 08, 2021

    Netgear's firmware is great at creating false reports of DoS attacks. Many of them are no such thing.

     

    Search - NETGEAR Communities – DoS attacks

     

    Use Whois.net to see who is behind some of them and you may find that they are from places like Facebook, Google, even your ISP.

     

    Here is a useful tool for that task:

     

    IPNetInfo: Retrieve IP Address Information from WHOIS servers

     

    If these events are slowing down your router, that may be because it is using up processor time as it writes the events to your logs. Anything that uses processor power – event logging, QoS management, traffic metering – may cause slowdowns. Disable logging of DoS attacks and see if that reduces the problem. This does not prevent the router from protecting you from the outside world.

     

    • fimpowde's avatar
      fimpowde
      Aspirant
      Jan 08, 2021

      Thank you very much for the reply - i went in this morning and changed the logging on the Nighthawk - looks like the default was log everything because all the boxes were checked - so i reduced that to ONLY log for:

      - Connections to the Web-baswed interface of this router

      - Router Operations

      - Port Forwarding / Port Triggering

      - Wireless Access

      - Turn off wireless signal by schedule

       

      Changed the logging to this at about 8am EST, at 845a my VPN bounced again and the logs show this:

      DHCP IP: (192.168.1.13)] to MAC address 3C:6A:A7:72:E8:DB Friday, January 08,2021 07:45:58
      [DHCP IP: (192.168.1.13)] to MAC address 3C:6A:A7:72:E8:DB Friday, January 08,2021 07:45:57
      [DHCP IP: (192.168.1.13)] to MAC address 3C:6A:A7:72:E8:DB Friday, January 08,2021 07:45:50
      [DHCP IP: (192.168.1.15)] to MAC address 82:77:6B:43:F3:A8 Friday, January 08,2021 07:44:33
      [DHCP IP: (192.168.1.30)] to MAC address F2:08:97:FC:12:EA Friday, January 08,2021 07:43:30
      [DHCP IP: (192.168.1.42)] to MAC address C6:E9:D5:D6:EA:CE Friday, January 08,2021 07:40:10

       

      The 1.13 address is that of my Windows10 work machine with the Anyconnect VPN being bounced on its connection somehow.  But do not know why this is happening.  So the logging is reduced, but problem still happening