DGND3700v2 + switches: ethernet network goes down after few minutes

[GuiM]

Good Day,

I just set up a Gigabit network with a Netgear DGND3700 v2 modem/router and 2 unmanaged switches of 5 ports each (the switches are the exact same models: DLink DGS-1005S).

Switch 1 is connected directly behind the Netgear router (port 2 on the Netgear), and with 1 PC, 1 VOIP phone and 1 printer on the other end.

Switch 2 is connected directly behind the Netgear router (port 3 on the Netgear), and with 2 PCs on the other end.

Everything works fine for 5-10 minutes and then my ethernet network goes down (but the wireless is ok).

Could there be a conflict between the 2 switches? Or is it because the Netgear router cannot handle both of them? Is there a way to make this work? I cannot believe I can't have 2 small switches behind my Network router, there must be a solution which did not come to my mind...

Thanks for your help!

William 

[GuiM]

Hi there!

I did some more tests as follows:

- I unplugged switch 1 and only tried a partial network with switch 2: it worked without any issue for about an hour

- I then unplugged switch 2 and replaced it with switch 1: I could net get any IP on the end PCs.

- I unplugged both switches and plugged one after the other, and plugged the cable in the following order: router, PC1, PC2: my ethernet is working and I get an automatic IP on all machines

- I turned the switch off and on again, with all cable still plugged in: I got my ethernet up and running on both switches.

- I just plugged both switches on again but with less devices (1PC on switch 1 and 2 PC on switch 2): my network is up and running for now...

[Babylon5]

So given the statements in your last post, do you still have an issue?

If I include the switches built into routers/APs, I have about 12 switches distributed around my house, and all I really have to be careful of is that I don’t inadvertently create a loop.

[GuiM]

Thanks for your answer.

I am still doing some tests with a limited number of attached devices for now. It seems to be working with both switches connected and only 3 PCs (2 +1). But I am afraid that the problem may appear again as soon as I plug all remaining devices.

Regarding the loop, I am confident there is no loop: 7 cables in total, 5 devices (3 PCs, 1 IP phone and 1 printer) + 2 cables to the router. The network is not so sophisticated hence I am not worried about a possible loop...

[GuiM]

Hi there!

After more investigation, I found the problem was not coming from the switch but from another source, which I am still trying to identify.

The router seems to be freezing on a regular basis when connected to the internet, but seems to be stable when offline. It happens very randomly (it can work perfectly for a full week and then freeze every 10 minutes or so on the following week).

Unfortunately, most of the time when it freezes, the only way to be able to access it again is to reboot it (which means I would lose the log).

Fortunately, I managed to get the log today showing that it froze for about 10 minutes, then reinitiated came up again with the DHCP address. Here is the log since the previous reboot till it froze again and went back online:

[UPnP set event:AddPortMapping] from source 10.0.0.101 Tuesday, October 13,2015 15:57:18        
[UPnP set event:AddPortMapping] from source 10.0.0.101 Tuesday, October 13,2015 15:57:17        
[DoS attack: ACK Scan] from source: 173.193.230.112:443 Tuesday, October 13,2015 15:57:12        
[admin login] from source 10.0.0.101 Tuesday, October 13,2015 15:57:11        
[DHCP IP: (10.0.0.101)] to MAC address 10:4A:7D:2C:5B:B4 Tuesday, October 13,2015 15:57:04        
[DoS attack: RST Scan] from source: 108.160.172.237:443 Tuesday, October 13,2015 15:46:28        
[DoS attack: RST Scan] from source: 108.160.172.237:443 Tuesday, October 13,2015 15:46:06        
[DoS attack: ACK Scan] from source: 95.131.122.232:443 Tuesday, October 13,2015 15:46:03        
[DoS attack: RST Scan] from source: 216.58.223.46:443 Tuesday, October 13,2015 15:45:07        
[DoS attack: RST Scan] from source: 216.58.223.46:443 Tuesday, October 13,2015 15:33:06        
[DoS attack: RST Scan] from source: 104.16.29.235:443 Tuesday, October 13,2015 15:25:50        
[DoS attack: RST Scan] from source: 212.83.173.232:443 Tuesday, October 13,2015 15:22:13        
[DoS attack: RST Scan] from source: 159.122.19.136:443 Tuesday, October 13,2015 15:17:51        
[DoS attack: RST Scan] from source: 159.122.19.136:443 Tuesday, October 13,2015 15:17:11        
[DoS attack: RST Scan] from source: 159.122.19.136:443 Tuesday, October 13,2015 15:16:25        
[DoS attack: ACK Scan] from source: 23.60.187.42:80 Tuesday, October 13,2015 15:14:36        
[DoS attack: RST Scan] from source: 108.160.172.237:443 Tuesday, October 13,2015 15:13:40        
[DoS attack: ACK Scan] from source: 185.31.18.196:80 Tuesday, October 13,2015 15:13:23        
[DoS attack: ACK Scan] from source: 41.168.8.171:80 Tuesday, October 13,2015 15:12:41        
[DoS attack: RST Scan] from source: 108.160.172.193:443 Tuesday, October 13,2015 15:09:23        
[DoS attack: RST Scan] from source: 23.60.181.253:443 Tuesday, October 13,2015 15:08:15        
[DoS attack: ACK Scan] from source: 23.60.187.42:80 Tuesday, October 13,2015 15:06:26        
[DoS attack: ACK Scan] from source: 23.60.187.42:80 Tuesday, October 13,2015 15:05:57        
[DoS attack: ACK Scan] from source: 196.11.125.148:443 Tuesday, October 13,2015 14:54:38        
[DoS attack: RST Scan] from source: 108.160.172.225:443 Tuesday, October 13,2015 14:52:33        
[DoS attack: RST Scan] from source: 212.83.173.232:443 Tuesday, October 13,2015 14:49:10        
[DoS attack: RST Scan] from source: 108.160.172.237:443 Tuesday, October 13,2015 14:45:54        
[DoS attack: RST Scan] from source: 108.160.172.237:443 Tuesday, October 13,2015 14:45:31        
[DoS attack: ACK Scan] from source: 58.59.8.143:8446 Tuesday, October 13,2015 14:33:18        
[DoS attack: RST Scan] from source: 104.16.31.235:443 Tuesday, October 13,2015 14:29:46        
[DoS attack: ACK Scan] from source: 108.160.167.162:443 Tuesday, October 13,2015 14:27:04        
[DoS attack: ACK Scan] from source: 108.160.170.50:443 Tuesday, October 13,2015 14:26:39        
[DoS attack: ACK Scan] from source: 108.160.167.162:443 Tuesday, October 13,2015 14:25:04        
[DoS attack: ACK Scan] from source: 65.55.68.120:443 Tuesday, October 13,2015 14:24:19        
[DoS attack: ACK Scan] from source: 52.0.253.254:443 Tuesday, October 13,2015 14:23:55        
[DoS attack: ACK Scan] from source: 165.165.47.18:443 Tuesday, October 13,2015 14:23:24        
[DoS attack: ACK Scan] from source: 108.160.167.162:443 Tuesday, October 13,2015 14:23:04        
[DoS attack: ACK Scan] from source: 165.165.47.18:443 Tuesday, October 13,2015 14:22:43        
[DoS attack: ACK Scan] from source: 23.60.181.253:80 Tuesday, October 13,2015 14:22:23        
[DoS attack: RST Scan] from source: 216.58.223.46:443 Tuesday, October 13,2015 14:22:02        
[DoS attack: ACK Scan] from source: 165.165.47.18:443 Tuesday, October 13,2015 14:21:50        
[DoS attack: ACK Scan] from source: 165.165.47.18:443 Tuesday, October 13,2015 14:21:00        
[DoS attack: ACK Scan] from source: 108.160.170.50:443 Tuesday, October 13,2015 14:20:38        
[DoS attack: ACK Scan] from source: 157.56.53.46:12350 Tuesday, October 13,2015 14:20:17        
[DoS attack: RST Scan] from source: 108.160.172.237:443 Tuesday, October 13,2015 14:20:10        
[DoS attack: ACK Scan] from source: 91.190.218.66:443 Tuesday, October 13,2015 14:19:52        
[DoS attack: RST Scan] from source: 108.160.172.237:443 Tuesday, October 13,2015 14:19:28        
[DoS attack: ACK Scan] from source: 108.160.167.162:443 Tuesday, October 13,2015 14:19:03        
[DoS attack: ACK Scan] from source: 159.122.19.141:443 Tuesday, October 13,2015 14:18:33        
[DoS attack: ACK Scan] from source: 159.122.19.141:443 Tuesday, October 13,2015 14:18:09        
[Time synchronized with NTP server time-g.netgear.com] Tuesday, October 13,2015 14:17:33        
[DoS attack: ACK Scan] from source: 159.122.19.133:443 Tuesday, October 13,2015 14:17:26        
[DoS attack: ACK Scan] from source: 31.13.90.2:443 Tuesday, October 13,2015 14:16:52        
[DHCP IP: (10.0.0.100)] to MAC address 2C:8A:72:A9:83:AD Tuesday, October 13,2015 14:16:32        
[DoS attack: ACK Scan] from source: 216.58.223.36:443 Tuesday, October 13,2015 14:16:28        
[DoS attack: ACK Scan] from source: 216.58.223.36:443 Tuesday, October 13,2015 14:16:28        
[Internet connected] IP address: 105.224.78.8 Tuesday, October 13,2015 14:16:22        
[DSL: Up] Tuesday, October 13,2015 14:16:17         
[Initialized, firmware version: V1.1.00.23_1.00.23 ] Tuesday, October 13,2015 14:15:23  

So, it seems that my router is flooded by "DOS attacks" but after doing some research, it seems this comes from "Dropped traffic". Could that be the cause of my modem freezing on a regular basis? What can I do to prevent it from freezing again?

Any idea?

---

[Babylon5]

It’s interesting that they are mostly sourced from the same port 443, but other than that I would say that they are too infrequent to be a targeted DoS attack.

Does your router pick up a new public IP address each time you power cycle it? If so then I would expect your log to be different each time also.

[GuiM]

Hi there!

I am not sure that the router picks up a new public IP address everytime but I am very frustrated at the moment because my ehternet network keep going down while the Wifi and Internet are still working fine:

[admin login] from source 10.0.0.108 Friday, October 16,2015 10:14:06         
[DoS attack: RST Scan] from source: 212.83.173.232:443 Friday, October 16,2015 10:14:01         
[DHCP IP: (10.0.0.108)] to MAC address 10:4A:7D:2C:5B:B4 Friday, October 16,2015 10:13:59         
[DoS attack: ACK Scan] from source: 52.0.252.72:443 Friday, October 16,2015 10:13:44         
[DoS attack: ACK Scan] from source: 157.56.116.206:12350 Friday, October 16,2015 10:12:13         
[DoS attack: ACK Scan] from source: 157.56.116.206:12350 Friday, October 16,2015 10:11:52         
[DoS attack: ACK Scan] from source: 157.56.53.40:12350 Friday, October 16,2015 10:11:28         
[DoS attack: ACK Scan] from source: 91.190.218.60:12350 Friday, October 16,2015 10:11:05         
[DoS attack: ACK Scan] from source: 65.55.68.119:443 Friday, October 16,2015 10:10:41         
[DoS attack: ACK Scan] from source: 134.170.0.215:443 Friday, October 16,2015 10:10:06         
[DoS attack: RST Scan] from source: 216.58.223.46:443 Friday, October 16,2015 10:09:59         
[DoS attack: ACK Scan] from source: 52.0.252.72:443 Friday, October 16,2015 10:09:44         
[UPnP set event:AddPortMapping] from source 10.0.0.106 Friday, October 16,2015 10:09:14         
[UPnP set event:AddPortMapping] from source 10.0.0.106 Friday, October 16,2015 10:09:13         
[DoS attack: ACK Scan] from source: 52.0.252.6:443 Friday, October 16,2015 10:08:50         
[DoS attack: ACK Scan] from source: 52.0.252.6:443 Friday, October 16,2015 10:08:04         
[DoS attack: ACK Scan] from source: 158.85.58.120:443 Friday, October 16,2015 10:07:41         
[DoS attack: ACK Scan] from source: 199.16.156.21:443 Friday, October 16,2015 10:07:03         
[DoS attack: ACK Scan] from source: 216.58.223.46:80 Friday, October 16,2015 10:06:22         
[DoS attack: ACK Scan] from source: 158.85.58.120:443 Friday, October 16,2015 10:05:33         
[DoS attack: ACK Scan] from source: 108.160.167.39:443 Friday, October 16,2015 10:05:09         
[Time synchronized with NTP server time-g.netgear.com] Friday, October 16,2015 10:05:06         
[UPnP set event:AddPortMapping] from source 10.0.0.108 Friday, October 16,2015 10:04:46         
[DoS attack: ACK Scan] from source: 217.146.1.2:5938 Friday, October 16,2015 10:04:45         
[UPnP set event:AddPortMapping] from source 10.0.0.108 Friday, October 16,2015 10:04:45         
[DoS attack: ACK Scan] from source: 37.252.253.3:80 Friday, October 16,2015 10:04:21         
[DoS attack: ACK Scan] from source: 217.146.13.5:5938 Friday, October 16,2015 10:04:20         
[Internet connected] IP address: 105.224.78.233 Friday, October 16,2015 10:04:18         
[DHCP IP: (10.0.0.108)] to MAC address 10:4A:7D:2C:5B:B4 Friday, October 16,2015 10:04:14         
[DHCP IP: (10.0.0.107)] to MAC address 2C:54:CF:C8:C5:0D Friday, October 16,2015 10:04:14         
[DSL: Up] Friday, October 16,2015 10:04:12          
[DHCP IP: (10.0.0.106)] to MAC address 8C:FA:BA:43:76:AB Friday, October 16,2015 10:04:05         
[USB device attached] The USB storage device <My Book 1130    > (<U Drive>) is attache Friday, October 16,2015 10:04:03         
[DHCP IP: (10.0.0.104)] to MAC address 10:4A:7D:2C:5B:B4 Friday, October 16,2015 10:04:02         
[DHCP IP: (10.0.0.101)] to MAC address 2C:8A:72:A9:83:AD Friday, October 16,2015 10:04:01         
[DHCP IP: (10.0.0.100)] to MAC address 20:47:47:1A:0B:6D Friday, October 16,2015 10:03:44         
[Initialized, firmware version: V1.1.00.23_1.00.23 ] Friday, October 16,2015 10:03:17 

I don't see where this is coming from, there is no loop in the network, all attached devices were working fine  2 weeks ago but for some reasons, since last week, the ethernet keeps going down... Any idea?

[GuiM]

Please note that the log I copies on my previous post was copied from the routeur while the ethernet was down (I logged as admin from Wifi).

[Babylon5]

There are some UPnP events in that listing, are you intentionally using UPnP, do you have any applications that you know are making use of it? If not then you could try disabling UPnP and wait until something on your computer complains. If you find that it is legitimate but the application has the option to use set port numbers instead of UPnP then try that instead and set up the appropriate forwarding rules.

[GuiM]

Hello Andy,

Thanks for your feedback, I will try your suggestion and see what happens.

[GuiM]

Hi there,

I disabled the UPnP as suggested but did not notice many changes on my network. My ethernet network is still going down on a regular basis. Here is the log from this morning after the ethernet was down: 

[DoS attack: RST Scan] from source: 216.58.223.46:443 Monday, November 02,2015 11:04:48        
[admin login] from source 10.0.0.106 Monday, November 02,2015 11:04:04        
[DoS attack: RST Scan] from source: 216.58.223.46:443 Monday, November 02,2015 11:02:01        
[DoS attack: RST Scan] from source: 159.122.19.198:443 Monday, November 02,2015 11:00:21        
[DoS attack: RST Scan] from source: 52.2.209.217:80 Monday, November 02,2015 10:59:10        
[DoS attack: RST Scan] from source: 216.58.223.36:443 Monday, November 02,2015 10:55:53        
[DoS attack: RST Scan] from source: 104.16.46.187:443 Monday, November 02,2015 10:54:41        
[DoS attack: RST Scan] from source: 54.200.35.42:443 Monday, November 02,2015 10:54:19        
[DoS attack: RST Scan] from source: 212.83.173.232:443 Monday, November 02,2015 10:49:48        
[DoS attack: RST Scan] from source: 159.122.19.180:443 Monday, November 02,2015 10:43:34        
[DoS attack: RST Scan] from source: 159.122.19.198:443 Monday, November 02,2015 10:39:03        
[DoS attack: ACK Scan] from source: 108.160.163.97:443 Monday, November 02,2015 10:34:34        
[DoS attack: RST Scan] from source: 108.160.172.193:443 Monday, November 02,2015 10:33:24        
[DoS attack: ACK Scan] from source: 64.4.26.155:80 Monday, November 02,2015 10:32:06        
[DoS attack: ACK Scan] from source: 108.160.163.97:443 Monday, November 02,2015 10:31:01        
[DHCP IP: (10.0.0.103)] to MAC address B0:83:FE:9B:1D:25 Monday, November 02,2015 10:29:27        
[DHCP IP: (10.0.0.102)] to MAC address F8:BC:12:67:AC:CD Monday, November 02,2015 10:29:24        
[DHCP IP: (10.0.0.103)] to MAC address B0:83:FE:9B:1D:25 Monday, November 02,2015 10:29:23        
[DoS attack: RST Scan] from source: 108.160.172.193:443 Monday, November 02,2015 10:28:48        
[DoS attack: RST Scan] from source: 108.160.172.237:443 Monday, November 02,2015 10:25:22        
[DoS attack: RST Scan] from source: 23.60.181.253:443 Monday, November 02,2015 10:23:02        
[DoS attack: RST Scan] from source: 108.160.172.225:443 Monday, November 02,2015 10:15:31        
[DoS attack: ACK Scan] from source: 108.160.163.97:443 Monday, November 02,2015 10:12:58        
[DoS attack: RST Scan] from source: 216.58.223.36:443 Monday, November 02,2015 10:11:33        
[DoS attack: RST Scan] from source: 108.160.172.193:443 Monday, November 02,2015 10:09:58        
[DoS attack: ACK Scan] from source: 95.131.122.232:443 Monday, November 02,2015 09:57:48        
[DoS attack: ACK Scan] from source: 66.96.147.111:465 Monday, November 02,2015 09:57:03        
[DoS attack: RST Scan] from source: 54.69.20.58:443 Monday, November 02,2015 09:54:57        
[DoS attack: ACK Scan] from source: 173.203.36.104:80 Monday, November 02,2015 09:51:04        
[DoS attack: RST Scan] from source: 104.16.49.187:443 Monday, November 02,2015 09:28:25        
[DoS attack: ACK Scan] from source: 166.62.118.110:80 Monday, November 02,2015 09:25:54        
[DoS attack: RST Scan] from source: 52.10.77.154:443 Monday, November 02,2015 09:23:00        
[DoS attack: RST Scan] from source: 23.60.181.253:443 Monday, November 02,2015 09:22:11        
[DoS attack: RST Scan] from source: 108.160.172.205:443 Monday, November 02,2015 09:17:14        
[DoS attack: RST Scan] from source: 108.160.172.237:443 Monday, November 02,2015 09:16:52        
[DoS attack: RST Scan] from source: 212.83.173.232:443 Monday, November 02,2015 09:15:15        
[DoS attack: RST Scan] from source: 108.160.172.193:443 Monday, November 02,2015 09:14:06        
[DoS attack: ACK Scan] from source: 17.110.250.23:443 Monday, November 02,2015 09:04:10        
[DoS attack: ACK Scan] from source: 41.203.18.189:80 Monday, November 02,2015 09:03:46        
[DoS attack: RST Scan] from source: 216.58.223.36:443 Monday, November 02,2015 08:59:46        
[DoS attack: ACK Scan] from source: 66.96.147.111:465 Monday, November 02,2015 08:57:07        
[DoS attack: RST Scan] from source: 108.160.172.237:443 Monday, November 02,2015 08:44:35        
[DoS attack: ACK Scan] from source: 99.192.240.99:80 Monday, November 02,2015 08:43:56        
[DoS attack: ACK Scan] from source: 99.192.240.99:80 Monday, November 02,2015 08:43:31        
[DoS attack: RST Scan] from source: 99.192.240.99:80 Monday, November 02,2015 08:42:58        
[DoS attack: ACK Scan] from source: 41.185.21.123:80 Monday, November 02,2015 08:40:13        
[DoS attack: RST Scan] from source: 104.16.46.187:443 Monday, November 02,2015 08:39:26        
[DoS attack: ACK Scan] from source: 99.192.240.99:80 Monday, November 02,2015 08:39:01        
[DoS attack: ACK Scan] from source: 99.192.240.99:80 Monday, November 02,2015 08:37:31        
[DoS attack: ACK Scan] from source: 99.192.240.99:80 Monday, November 02,2015 08:37:09        
[DoS attack: ACK Scan] from source: 99.192.240.99:80 Monday, November 02,2015 08:32:26        
[DoS attack: RST Scan] from source: 108.160.172.225:443 Monday, November 02,2015 08:14:49        
[DoS attack: RST Scan] from source: 108.160.172.237:443 Monday, November 02,2015 08:13:54        
[DoS attack: ACK Scan] from source: 95.128.74.83:80 Monday, November 02,2015 08:13:45        
[DoS attack: ACK Scan] from source: 54.231.14.41:80 Monday, November 02,2015 08:12:56        
[DoS attack: RST Scan] from source: 212.83.173.232:443 Monday, November 02,2015 08:08:51        
[DoS attack: ACK Scan] from source: 68.232.35.182:443 Monday, November 02,2015 08:07:44        
[DoS attack: ACK Scan] from source: 68.232.35.182:443 Monday, November 02,2015 08:06:59        
[DoS attack: ACK Scan] from source: 68.232.35.182:443 Monday, November 02,2015 08:06:36        
[DoS attack: ACK Scan] from source: 197.221.14.220:80 Monday, November 02,2015 08:06:06        
[DoS attack: ACK Scan] from source: 64.4.26.155:80 Monday, November 02,2015 08:03:18        
[DHCP IP: (10.0.0.104)] to MAC address 2C:8A:72:A9:83:AD Monday, November 02,2015 08:02:51        
[DHCP IP: (10.0.0.104)] to MAC address 2C:8A:72:A9:83:AD Monday, November 02,2015 08:02:43        
[DHCP IP: (10.0.0.104)] to MAC address 2C:8A:72:A9:83:AD Monday, November 02,2015 08:02:40        
[DHCP IP: (10.0.0.104)] to MAC address 2C:8A:72:A9:83:AD Monday, November 02,2015 08:02:37        
[DHCP IP: (10.0.0.104)] to MAC address 2C:8A:72:A9:83:AD Monday, November 02,2015 08:02:37        
[DHCP IP: (10.0.0.104)] to MAC address 2C:8A:72:A9:83:AD Monday, November 02,2015 08:02:21        
[DHCP IP: (10.0.0.104)] to MAC address 2C:8A:72:A9:83:AD Monday, November 02,2015 08:02:19        
[DHCP IP: (10.0.0.104)] to MAC address 2C:8A:72:A9:83:AD Monday, November 02,2015 08:02:14        
[DoS attack: RST Scan] from source: 216.58.223.46:443 Monday, November 02,2015 08:01:07        
[DoS attack: RST Scan] from source: 182.50.136.239:80 Monday, November 02,2015 08:00:24        
[DHCP IP: (10.0.0.103)] to MAC address B0:83:FE:9B:1D:25 Monday, November 02,2015 08:00:08        
[DoS attack: RST Scan] from source: 108.160.172.193:443 Monday, November 02,2015 07:59:51        
[DoS attack: ACK Scan] from source: 41.234.167.116:17370 Monday, November 02,2015 07:57:31        
[DoS attack: RST Scan] from source: 182.50.136.239:80 Monday, November 02,2015 07:57:09        
[DHCP IP: (10.0.0.107)] to MAC address 20:47:47:1A:0B:6D Monday, November 02,2015 07:55:50        
[DHCP IP: (10.0.0.106)] to MAC address 10:4A:7D:2C:5B:B4 Monday, November 02,2015 07:55:47        
[DHCP IP: (10.0.0.104)] to MAC address 2C:8A:72:A9:83:AD Monday, November 02,2015 07:53:18        
[DHCP IP: (10.0.0.101)] to MAC address EC:85:2F:98:88:D0 Monday, November 02,2015 07:37:39        
[DoS attack: RST Scan] from source: 108.160.172.225:443 Monday, November 02,2015 07:30:43        
[Time synchronized with NTP server time-g.netgear.com] Monday, November 02,2015 07:27:53        
[DHCP IP: (10.0.0.102)] to MAC address F8:BC:12:67:AC:CD Monday, November 02,2015 07:27:00        
[DHCP IP: (10.0.0.109)] to MAC address 00:00:74:AC:11:F1 Monday, November 02,2015 07:25:53        
[DHCP IP: (10.0.0.100)] to MAC address 8C:FA:BA:43:76:AB Monday, November 02,2015 07:24:34        
[Internet connected] IP address: 105.224.79.102 Monday, November 02,2015 07:24:13        
[DSL: Up] Monday, November 02,2015 07:24:08         
[USB device attached] The USB storage device <My Book 1130    > (<U Drive>) is attache Monday, November 02,2015 07:23:57        
[DHCP IP: (10.0.0.105)] to MAC address 7C:2F:80:67:48:29 Monday, November 02,2015 07:23:32        
[Initialized, firmware version: V1.1.00.23_1.00.23 ] Monday, November 02,2015 07:23:15 

I see some activity on the DHCP server but do not understand why or where it is coming from...

Any idea?

Thanks

[Babylon5]

For the DHCP messages. All that you need to do is check the devices on you LAN to see if they have a corresponding MAC. You could also run a network scanning tool e.g. https://www.softperfect.com/products/networkscanner/ is one I regularly use but there are many others. This might help you to identify devices and create a record of their MAC addresses.

For the DoS attacks, they are too infrequent to be the cause of an issue, but you could contact your ISP and ask them to investigate. You could also ask your ISP to change your public IP address, which may or may not help. Those DoS attacks appear too infrequent to be targeted at you specifically, so if your ISP user-base in general is being attacked then changing the public IP may make little difference.

[GuiM]

Hello Andy,

I did not have the opportunity to install this software (no admin rights) but I did some other tests:

- I by passed the switches by plugging the computers (2) directly into the router and the printer (I left the other devices unplugged)

- in total, I have 3 PCs connected, 2 via Ethernet and 1 over Wifi, + 1 3in1 printer connected via ethernet

I tried to unplug the DSL line to see if the network would be more stable without internet, the ethernet network also went down. I unplugged the printer, the ethernet network went down.

About an hour ago, I rebooted the router with only 3 computers connected (2 ethernet + 1 wifi) but withotu the DSL line. My ethernet network went down within 1 or 2 minutes.

Interestingly, I rebooted the modem again, same configuration. It stayed up for about 20 minutes withut DSL and the moment I plugged my DSL, the ethernet went down within 1-2 minutes ,strange!!!

I do not know what to think...

[Babylon5]

Your description seems to suggest a hardware issue to me, maybe earthing issues somewhere? Disconnecting the DSL line from a router should have no effect on the LAN side, apart from the obvious inability to access the Internet.