CAX80 keeps rebooting

[milad6387]

"One main issue that would cause a reboot is that the ISP signal has stopped or signal on the line is degraded. Remember the CAX80 will auto reboot if ANY signal on the line  becomes bad or the signal completely stops for any reason."

But if it is a ISP signal issue, then we should be seeing it when we go to .5, however, it appears that most people (including myself, so far) have not experienced these issues on .5. So I just don't see how that could be a ISP signal issue.

[FURRYe38]

Anything is possible when it comes to ISP signals. Others have also not seen with with v.7 as well. Including me. 

Users can either downgrade the FW or use v.7 however again, I would check with the ISP and signals on the line as mentioned. Any of the suggestions are there to help identify what else could cause the problem. 

If you still experience problems ever all this, users will need to contact NG support and open a support ticket. 

[tfc3000]

I already had Comcast visit a few days ago. They confirmed there are no signal issues or issues in general. Somebody else earlier on this thread also had Comcast come out and confirm. This is not an ISP issue, it's a firmware issue.

I opened a support ticket and referenced this thread. Perhaps if everyone else on this thread did the same we will get a fix sooner?

Tickets can be opened here: https://my.netgear.com/support/contact.aspx

[kP206]

Netgear pls fix this issue. I can't do my school work online because the modem reboots whenever it feels like it. 😞 

[milad6387]

I tried to do this, however, it says my support has expired. I can only "search knowledgebase" or "visit a community". Is that true? They won't even open a ticket if you don't have tech support purchase. That is so dumb for an in-warranty hardware product.

Those of you who still have support. Are you able to open a ticket so we can get helped out?

Tickets can be opened here: https://my.netgear.com/support/contact.aspx

[jg62]

 Have same issue with fw  v 2.1.3.7 causing reboots and then loss of admin creds and then [DoS attack] LAND Attack SPT:2190 DPT:2190 errors in the log. This is a very expensive device and so it should be fixed asap as most of us work from home for at least part of the time and so waiting long term for a fix on hardware that is still under warranty in my case is unacceptable.

I upgrade to this for the newer wifi standard and its claim to give better home coverage, but have connections dropping on far side of of a modest 2100 sqft home.all the time. Has been a real disappointment from the start and so I wish I had returned it when I could have but not 7 months in, so stuck with expensive below par gear.

[milad6387]

@jg62 : Do you have technical support remaining for your device? I suggest calling in or going online (https://my.netgear.com/support/contact.aspx) and opening a ticket.

This way we can get some more attention on this.

If you go online, you can reference this community post.

Thanks.

[jg62]

I did report the issue and their advice was to lower the WAN MTU from the default 1500 by increments of 8, hit apply wait 5 minutes  then reboot. I tried it and no joy. $500 brick.

support case# 46119752, but now I can't even see the support case under my profile, but they want me to buy a support contract since I'm past the 90 free support, Glad I wrote the casd number down incase they claim it never happened, SMH.

[tamanaco]

As I review some of the recent posts/threads with CAX80 rebooting issues, the problem appears to be across all/most ISPs (Xfinity, Comcast and Spectrum) and the issue surfaced at about the same time as the reports in this community show. The common component in all the reports is the CAX80s with similar issues: - DoS Attacks messages on the log and the sudden appearance of a new firmware available notice when there's none. - Coincidence?  I might be wrong... but this time I don't believe that the recent CAX80 rebooting issue is being caused by ISP's signal issue.

[Moreno279]

My warranty was only for one year. So I no longer have tech support available but I was able to open a ticket. They said if I called back that I would need to purchase some kind of extended warranty. So how do we solve this problem ?

[kinghq1]

@FURRYe38 I'm going to have to disagree about the Auto reboot on any signal issue.  Every other month my Downlink light starts to blink and I see multiple links that are not locked and the Router has never rebooted automatically.

In looking at my log, I see that the initial Firmware update was initiated Nov 2021

As you can see, there are no DoS attacks before this.  However, I DO see DoS attacks starting shortly afterwards:

AND the IP Address is NOT a DoS Attack, not sure why the Router labels it as such.  When I do an IP Lookup it reports:

AND I show my IP Address as the one listed as the Source of the DoS attack.  SO those who posted about the DoS attack, look at the IP and determine if it is YOUR IP from your ISP.  But this still points back to an issue with Firmware .7 since the DoS attacks didn't start logging until AFTER .7 was updated to the Router.  Either way, the issue is almost definitely with the firmware.

SO again, HOW can we stop the Router Firmware from being auto updated?  AND why did it start on or about 11 Jun 22, why not way back in Nov. when the update was pushed . . .

[kinghq1]

Alright, downgraded again to .5

Performed a factory reset, unplugged for 1 minute and then went through setup.  I guess we'll see what happens . . .

[commodon]

Since downgrading to v2.1.3.5 I have not experienced any random reboots. Nor had I observed any DOS "LAND Atack" events in the Log.

Last night when I went to bed, I was still running v2.1.3.5 so I anticipated this was to continue. I was wrong.

When I awoke this morning and looked at the UI to see if any reboots occurred in the middle of the night, I discovered my router upgraded to firmware v2.1.3.7.

Looking closer at the Log it reflects the router upgraded its firmware to v.2.1.3.7 at approximately 1:20am. After the upgrade the Log reflects twenty or so DOS "LAND Attack" events involving port 2190 and a few DOS "NULL Attack" events.

Then at approximately 3:40am the router does a reboot and has since recorded another thirty plus DOS "LAND Attack" events involving port 2190 in the log.

Obviously, I am not pleased.

Being extremely familiar with Internet security and network security for thirty years, I find it highly improbable and very unlikely my network is experiencing a LAND attack. Especially whereas others are reporting LAND attacks with the SAME port number all of sudden after upgrading the firmware.

For reference a LAND attack is often a human (user) generated attack, designed with the intention of causing a Denial of Service (DoS). It involves the user injecting traffic into the network with the source IP and destination IP addresses being the same as well as choosing a port number (1-65535) to be used as the source and destination ports. The fact this attack is being recorded by multiple persons with the same port number (2190) is highly indicative this event is being generated by the router itself.

In all likelihood there is something wrong with firmware v.2.1.3.7

[tamanaco]

After the CAX80 running .7 rebooted itself at  ~3:30am this morning... besides the "[DoS attack] LAND Attack SPT:2190 DPT:2190" messages in the log I'm also getting  a bunch of "[DoS attack] DoSPortScan PROTO:Icmp" log messages.

[FURRYe38]

Would NOT be a FW issue if your getting DOS attacked. You'll need to discuss this with your ISP. 
Do a who is look up on WAN IP addresses to see where they are coming from. 

If your seeing locked channels not working well or downlink issues on  the modem. This is a ISP signal line issue. ISP needs to check this. 

All this  seem to be a recent problem that has appeared for some. v.7 has been out for a while now. 

---

@kinghq1 wrote:

@FURRYe38 I'm going to have to disagree about the Auto reboot on any signal issue.  Every other month my Downlink light starts to blink and I see multiple links that are not locked and the Router has never rebooted automatically.

In looking at my log, I see that the initial Firmware update was initiated Nov 2021

As you can see, there are no DoS attacks before this.  However, I DO see DoS attacks starting shortly afterwards:

AND the IP Address is NOT a DoS Attack, not sure why the Router labels it as such.  When I do an IP Lookup it reports:

AND I show my IP Address as the one listed as the Source of the DoS attack.  SO those who posted about the DoS attack, look at the IP and determine if it is YOUR IP from your ISP.  But this still points back to an issue with Firmware .7 since the DoS attacks didn't start logging until AFTER .7 was updated to the Router.  Either way, the issue is almost definitely with the firmware.

SO again, HOW can we stop the Router Firmware from being auto updated?  AND why did it start on or about 11 Jun 22, why not way back in Nov. when the update was pushed . . .

---

[tfc3000]

Seems like firmware version .7 is incorrectly labelling DOS attacks. Unsure if this has anything to do with the router reboots. It could just be two separate unrelated issues.

When I was on firmware version .7. I saw many DOS attacks and the router was rebooting throughout the day.

After downgrading to .5 I have seen zero DOS attacks and the router has stopped rebooting.

@FURRYe38 there is clearly an issue with firmware version .7

[FURRYe38]

Something to report to NG support then. https://my.netgear.com/support/contact.aspx

Again this seem to have just appeared for some and some of us have not seen this. This maybe particular to some ISPs as well. 

I've had my CAX80 loaded with v.7 since day one over 3 months ago and been working as expected. I just removed it a couple of weeks ago and now using a CM2000. 

Otherwise use what works. 

[tfc3000]

@olympos1625 per your previous question. Several people on this thread have confirmed the issue resolves when downgrading to firmware version 2.1.3.5. BUT the router auto-updates to 2.1.3.7 within 24 hours, so that is not a long term fix.

Can we please get an update from Netgear? I tried opening a support ticket and got no response. I tried calling the support line and just got stuck on hold for 1 hour.

Next step will be to form a class action lawsuit with my lawyers for loss of earning caused by the disconnects during work calls.

Hi Guys,

 

Good day!

 

Welcome to NETGEAR Community!

 

We are sorry to hear about your experience with the latest firmware update. Does anyone able to isolate the issue by downgrading the firmware?

 

Please do not hesitate to let me know if you need further assistance. 

 

Regards,

 

Oliver

Community Team

[milad6387]

Circling back on this, I was on version .5 for approximately 34 hours without any issues. Then overnight the firmware was upgraded to .7 again and my router has rebooted a number of times already.

This seems to be in line with everyone else.

I will go back to .5, but that will probably just last 1-2 nights.

Is anyone from NG seeing these issues?

[tfc3000]

I called NG support and spent about 2 hours on hold / being moved around different departments. I was then told a Level 2 Engineer would call me within 30 minutes. They called me 4 hours later. Saying NG will send a new CAX80 but there are none in stock so they will call back in 2 days to get my address.

Given it appears to be a firmware issue I doubt the new device will fix the issue.

Nice work NG support 🤡 🤡 🤡

[Omnitron]

Something worth trying:

- Log into the router, and change [Cable Connection] --> [Starting Frequency] to the value it is/was set to (for you) back in 2.1.3.5. In my case for Xfinity at least, it's 405MHz in 2.1.3.5 and 507MHz in 2.1.3.7. 

Personal experience:

- I reverted to 2.1.3.5, did a full reset (by pinhole), followed the full "New Setup Wizard" afterwards (which I believe pulls updated setup data from your ISP). I got 1 single disconnection the following morning, and it had reverted to 2.1.3.7, but I have not had any disconnects since -- 31 hours and counting.

[milad6387]

But maybe they know they broke the CAX80 with the firmware update. It worries me that we may all need new CAX80?

Which brings up the question: My support has expired, by my unit is still under warranty. But how the heck do they know that they need to send me a replacement unit if they don't troubleshoot it first. Seems odd.

-Milad

[kinghq1]

@FURRYe38 did you not read my ENTIRE thread?  I said that the DoS attack in the log is originating from MY IP address, not an outside address.  The IP Xfinity has assigned to ME and these DO NOT occur under .5 FW, so you are VERY mistaken in stating that it is NOT an FW issue.

Now then, my firmware has been updated again and since @FURRYe38 stated previously, the ISP does NOT update the Router firmware, this is most definitely an NG issue that THEY need to address.  For one, they need to bring BACK the option to disable auto updates.  Removing this was probably one of the stupidest things NG could have done.  And agree with others, if NG replaces the CAX80 with another CAX80, how do we know we won't have the same issue?  Fix the Firmware.

If someone else has another 2Gbps router with built in WiFi manufacturer at this point I'm willing to try.  Just sucks cause I got this special from NG before it was even on the Market.

[kP206]

I downgraded my firmware on my CAX80 and Comcast decided at 2:15am to automatically update the firmware without my permission. As a customer we should have the right to choose what we do with it. How did I pay an extreme amount of money for something that's worthless to me right about now. You claim to save money on modem rentals, at this point I want to rent a modem, so I wouldn't have to deal with poor company practices. Do you even test the firmware before release??? I can't even speak to someone without paying money for tech support. And its the problem you caused. Yea, I'm heading down to Comcast first thing in the morning and renting a modem now. I could care less for wifi 6. You have truly wasted my time and money trouble shooting this DOS LAND ATTACK CRASH. I hope there is a class action lawsuit on NG. No wonder why the Arlo Camera team left you guys. I will be switching everything over to Cisco business from here on out. I will reach out to all the YouTubers and give them feedback on how NG won't do anything about this firmware problem. Just like what Linus Tech did to NEWEGG.COM 

[tamanaco]

I can also report that running firmware v2.1.3.5 on my CAX80 stops the DoS Attacks messages in the log. The router runs fine on .v2.1.3.5 until Netgear pushes v2.1.3.7 overnight. No ISP signal issues... my Internet speeds are better than what the ISP provisioned them for.  From that point on the DoS Attacks messages return. Netgear needs to provide a firmware that  fixes the DoS Attacks issue + gives the user an option to opt out of automatic firmware updates or stop the Netgear firmware server from pushing the  v2.1.3.7 update as it is broken. (Netgear can put firmware v2.1.3.7 on their firmware download page for those that want to update to it)