CM700/Nighthawk Dropping Internet + DoS/WLAN access rejected spam

[whatisgoingon]

All of these problems began showing in the logs a few minutes after updating to V1.2.0.24_1.0.1.  My internet has been disconnecting multiple times a day (modem loses connection).

In the logs I see:

1. Multiple [DoS attack: ACK Scan] from various IP's.

2. Multiple [WLAN access rejected: incorrect security] from my iPhone's MAC address

3. Multiple [WLAN access rejected: incorrect security] from 16 different unknown MAC addresses (a little concerned about this)

I can post the log if necessary but it's very long (6 days worth).  Attached is a picture of the unknown MAC addresses that have been rapidly trying to connect to my wifi (which has a password).

[DarrenM]

Not in the router logs but the logs of the modem do you seen any T3 or T4 timeouts?

DarrenM

[whatisgoingon]

I never knew I could login to the modem like this so I'm a bit unfamiliar with the data.  Unfortunately, I recently rebooted the modem to regain internet connection which seems to have cleared the logs.  I do see:

No Ranging Response received - T3 time-out

MIMO Event MIMO: Stored MIMO=-1 post cfg file MIMO=-1

Downstream

Channel	Lock Status	Modulation	Channel ID	Frequency	Power	SNR	Correctables	UnCorrectables
1	Locked	QAM 256	17	603000000 Hz	-7.7 dBmV	37.3 dB	0	0
2	Locked	QAM 256	18	609000000 Hz	-7.7 dBmV	37.3 dB	0	0
3	Locked	QAM 256	19	615000000 Hz	-7.2 dBmV	37.3 dB	0	0
4	Locked	QAM 256	20	621000000 Hz	-7.4 dBmV	37.3 dB	0	0
5	Locked	QAM 256	21	627000000 Hz	-8.0 dBmV	37.3 dB	0	0
6	Locked	QAM 256	22	633000000 Hz	-8.2 dBmV	36.6 dB	7	0
7	Locked	QAM 256	23	639000000 Hz	-7.7 dBmV	37.6 dB	7	0
8	Locked	QAM 256	24	645000000 Hz	-8.2 dBmV	37.3 dB	0	0
9	Locked	QAM 256	25	651000000 Hz	-8.2 dBmV	37.3 dB	0	0
10	Locked	QAM 256	26	657000000 Hz	-8.2 dBmV	36.6 dB	0	0
11	Locked	QAM 256	27	663000000 Hz	-8.2 dBmV	37.3 dB	0	0
12	Locked	QAM 256	28	669000000 Hz	-7.7 dBmV	37.3 dB	0	0
13	Locked	QAM 256	29	675000000 Hz	-7.2 dBmV	37.3 dB	0	0
14	Locked	QAM 256	30	681000000 Hz	-7.2 dBmV	37.6 dB	0	0
15	Locked	QAM 256	31	687000000 Hz	-7.2 dBmV	37.3 dB	0	0
16	Locked	QAM 256	32	693000000 Hz	-7.2 dBmV	37.3 dB	6	0
17	Not Locked	N/A	N/A	0 Hz	0.0 dBmV	0.0 dB	0	0
18	Not Locked	N/A	N/A	0 Hz	0.0 dBmV	0.0 dB	0	0
19	Not Locked	N/A	N/A	0 Hz	0.0 dBmV	0.0 dB	0	0
20	Not Locked	N/A	N/A	0 Hz	0.0 dBmV	0.0 dB	0	0
21	Not Locked	N/A	N/A	0 Hz	0.0 dBmV	0.0 dB	0	0
22	Not Locked	N/A	N/A	0 Hz	0.0 dBmV	0.0 dB	0	0
23	Not Locked	N/A	N/A	0 Hz	0.0 dBmV	0.0 dB	0	0
24	Not Locked	N/A	N/A	0 Hz	0.0 dBmV	0.0 dB	0	0
25	Not Locked	N/A	N/A	0 Hz	0.0 dBmV	0.0 dB	0	0
26	Not Locked	N/A	N/A	0 Hz	0.0 dBmV	0.0 dB	0	0
27	Not Locked	N/A	N/A	0 Hz	0.0 dBmV	0.0 dB	0	0
28	Not Locked	N/A	N/A	0 Hz	0.0 dBmV	0.0 dB	0	0
29	Not Locked	N/A	N/A	0 Hz	0.0 dBmV	0.0 dB	0	0
30	Not Locked	N/A	N/A	0 Hz	0.0 dBmV	0.0 dB	0	0
31	Not Locked	N/A	N/A	0 Hz	0.0 dBmV	0.0 dB	0	0
32	Not Locked	N/A	N/A	0 Hz	0.0 dBmV	0.0 dB	0	0

Upstream

Channel	Lock Status	US Channel Type	Channel ID	Symbol Rate	Frequency	Power
1	Locked	ATDMA	2	5120 Ksym/sec	30100000 Hz	54.5 dBmV
2	Not Locked	N/A	Unknown	0 Ksym/sec	0 Hz	0.0 dBmV
3	Not Locked	N/A	Unknown	0 Ksym/sec	0 Hz	0.0 dBmV
4	Not Locked	N/A	Unknown	0 Ksym/sec	0 Hz	0.0 dBmV
5	Not Locked	N/A	Unknown	0 Ksym/sec	0 Hz	0.0 dBmV
6	Not Locked	N/A	Unknown	0 Ksym/sec	0 Hz	0.0 dBmV
7	Not Locked	N/A	Unknown	0 Ksym/sec	0 Hz	0.0 dBmV
8	Not Locked	N/A	Unknown	0 Ksym/sec	0 Hz	0.0 dBmV

54.5 dBmV seems very high compared to the downstream values or is that normal?

Thanks for the help.

[whatisgoingon]

Just experienced another drop in internet.  Before it would fix itself but now it seems I need to do a full restart to get the internet working.  I was able to grab the log before restarting.

Modem Logs:

Jul 31 2018 07:08:17 Critical (3) Unicast Ranging Received Abort Response - initializing MAC
Jul 31 2018 07:08:17 Critical (3) Unicast Ranging Received Abort Response - initializing MAC
Jul 31 2018 07:08:17 Critical (3) Unicast Ranging Received Abort Response - initializing MAC
Jul 31 2018 07:08:17 Critical (3) Unicast Ranging Received Abort Response - initializing MAC
Jul 31 2018 07:08:17 Critical (3) Unicast Ranging Received Abort Response - initializing MAC
Jul 31 2018 07:08:17 Critical (3) Unicast Ranging Received Abort Response - initializing MAC
Jul 31 2018 07:08:17 Critical (3) Unicast Ranging Received Abort Response - initializing MAC
Jul 31 2018 07:08:17 Critical (3) No Ranging Response received - T3 time-out
Jul 31 2018 07:08:46 Critical (3) Unicast Ranging Received Abort Response - initializing MAC
Jul 31 2018 07:08:47 Critical (3) No Ranging Response received - T3 time-out
Jul 31 2018 07:09:31 Critical (3) Unicast Ranging Received Abort Response - initializing MAC
Jul 31 2018 07:09:31 Critical (3) No Ranging Response received - T3 time-out
Jul 31 2018 07:10:04 Critical (3) Unicast Ranging Received Abort Response - initializing MAC
Jul 31 2018 07:10:04 Critical (3) No Ranging Response received - T3 time-out
Jul 31 2018 07:10:45 Critical (3) Unicast Ranging Received Abort Response - initializing MAC
Jul 31 2018 07:10:45 Critical (3) No Ranging Response received - T3 time-out
Jul 31 2018 07:11:17 Critical (3) Unicast Ranging Received Abort Response - initializing MAC
Jul 31 2018 07:11:17 Critical (3) No Ranging Response received - T3 time-out
Jul 31 2018 07:11:47 Critical (3) Unicast Ranging Received Abort Response - initializing MAC
Jul 31 2018 07:11:47 Critical (3) No Ranging Response received - T3 time-out
Jul 31 2018 07:12:23 Critical (3) Unicast Ranging Received Abort Response - initializing MAC
Jul 31 2018 07:12:24 Critical (3) No Ranging Response received - T3 time-out
Jul 31 2018 07:12:55 Critical (3) Unicast Ranging Received Abort Response - initializing MAC
Jul 31 2018 07:12:56 Critical (3) No Ranging Response received - T3 time-out
Jul 31 2018 07:13:40 Critical (3) Unicast Ranging Received Abort Response - initializing MAC
Jul 31 2018 07:13:40 Critical (3) No Ranging Response received - T3 time-out
Jul 31 2018 07:14:20 Critical (3) Unicast Ranging Received Abort Response - initializing MAC
Jul 31 2018 07:14:20 Critical (3) No Ranging Response received - T3 time-out
Jul 31 2018 07:15:02 Critical (3) Unicast Ranging Received Abort Response - initializing MAC
Jul 31 2018 07:15:02 Critical (3) No Ranging Response received - T3 time-out
Jul 31 2018 07:15:42 Critical (3) Unicast Ranging Received Abort Response - initializing MAC
Jul 31 2018 07:15:42 Critical (3) No Ranging Response received - T3 time-out
Jul 31 2018 07:16:11 Critical (3) Unicast Ranging Received Abort Response - initializing MAC
Jul 31 2018 07:16:12 Critical (3) No Ranging Response received - T3 time-out
Jul 31 2018 07:17:04 Critical (3) Unicast Ranging Received Abort Response - initializing MAC
Jul 31 2018 07:17:05 Critical (3) No Ranging Response received - T3 time-out
Jul 31 2018 07:17:36 Critical (3) Unicast Ranging Received Abort Response - initializing MAC
Jul 31 2018 07:17:36 Critical (3) No Ranging Response received - T3 time-out
Jul 31 2018 07:18:28 Critical (3) Unicast Ranging Received Abort Response - initializing MAC
Jul 31 2018 07:18:28 Critical (3) No Ranging Response received - T3 time-out

And here are some of the router logs.  The logs were empty up until July 20th when I upgraded to the latest firmware, except for one event in May. Not sure if this is a coincidence or not.  This is from the same time as the modem log (router time is behind 3 hours).  Note that this is how the logs look even when I'm not having issues.  The other day it seemed to be allowing access to my phone every 5 minutes.

[Access Control] Device [MY-PC] with MAC address [MAC] is allowed to acc Tuesday, July 31,2018 04:31:49          

[Access Control] Device [MY-PC] with MAC address [MAC] is allowed to acc Tuesday, July 31,2018 04:30:34          

[Access Control] Device [MY-PC] with MAC address [MAC] is allowed to acc Tuesday, July 31,2018 04:29:17          

[Internet connected] IP address: xxx.xxx.xxx.xx Tuesday, July 31,2018 04:28:47          

[Internet disconnected] Tuesday, July 31,2018 04:28:04          

[Access Control] Device [MY-PC] with MAC address [MAC] is allowed to acc Tuesday, July 31,2018 04:28:02          

[Access Control] Device [MY-PC] with MAC address [MAC] is allowed to acc Tuesday, July 31,2018 04:26:35          

[Access Control] Device [MY-PC] with MAC address [MAC] is allowed to acc Tuesday, July 31,2018 04:25:19          

[Access Control] Device [MY-PC] with MAC address [MAC] is allowed to acc Tuesday, July 31,2018 04:23:58          

[Access Control] Device [MY-PC] with MAC address [MAC] is allowed to acc Tuesday, July 31,2018 04:22:41          

[Access Control] Device [MY-PC] with MAC address [MAC] is allowed to acc Tuesday, July 31,2018 04:21:09          

[Internet connected] IP address: xxx.xxx.xxx.xx Tuesday, July 31,2018 04:20:09          

[Access Control] Device [MY-PC] with MAC address [MAC] is allowed to acc Tuesday, July 31,2018 04:19:52          

[Internet disconnected] Tuesday, July 31,2018 04:19:02          

[Access Control] Device [MY-PC] with MAC address [MAC] is allowed to acc Tuesday, July 31,2018 04:18:35          

[Access Control] Device [MY-PC] with MAC address [MAC] is allowed to acc Tuesday, July 31,2018 04:17:14          

[Access Control] Device [MY-PC] with MAC address [MAC] is allowed to acc Tuesday, July 31,2018 04:15:57          

[Access Control] Device [MY-PC] with MAC address [MAC] is allowed to acc Tuesday, July 31,2018 04:14:41          

[Access Control] Device [MY-PC] with MAC address [MAC] is allowed to acc Tuesday, July 31,2018 04:13:22          

[Access Control] Device [MY-PC] with MAC address [MAC] is allowed to acc Tuesday, July 31,2018 04:12:05          

[Access Control] Device [MY-PC] with MAC address [MAC] is allowed to acc Tuesday, July 31,2018 04:10:49          

[Access Control] Device [MY-PC] with MAC address [MAC] is allowed to acc Tuesday, July 31,2018 04:09:25          

[Access Control] Device [MY-PC] with MAC address [MAC] is allowed to acc Tuesday, July 31,2018 04:08:07          

[Access Control] Device [MY-PC] with MAC address [MAC] is allowed to acc Tuesday, July 31,2018 04:06:50

[DarrenM]

Yes you have alot of timeouts this is typically a connection issue with the ISP something could of happened to the lines or the cable box out in your neighborhood you will want to have a ISP tech come check the levels and maybe investigate your area.

DarrenM