Internet Disconnects

[KCarroll]

I am using a DM200 modem connected to a Netgear wifi router and all of a sudden my internet will now disconnect for apparently no reason. I use CenturyLink as my ISP and after talking to their tech support they assured me my connection was fine and the problem is with the Netgear modem. I can get it working again by shutting down all of my wifi devices and then power cycling my modem and router. While this seems to be working for now I'm at a loss as to why this started all of a sudden. Anyone have any suggestions for a fix? The modem is about 8 months old. Thanks in advance!

[DarrenM]

What are you seeing in the modem event log when the drop happens?

DarrenM

[KCarroll]

Not sure what I'm looking for but here's what's in my log today:

[admin login] from source 192.168.5.10, Wednesday, February 28, 2018 18:38:46
[DHCP IP: 192.168.5.10] to MAC address 6c:71:d9:f3:20:a3, Wednesday, February 28, 2018 18:01:08
[DHCP IP: 192.168.5.5] to MAC address a0:cc:2b:bf:0a:46, Wednesday, February 28, 2018 17:26:43
[DHCP IP: 192.168.5.7] to MAC address 00:19:9d:be:f7:cb, Wednesday, February 28, 2018 17:20:01
[DHCP IP: 192.168.5.5] to MAC address a0:cc:2b:bf:0a:46, Wednesday, February 28, 2018 05:20:20
[DHCP IP: 192.168.5.7] to MAC address 00:19:9d:be:f7:cb, Wednesday, February 28, 2018 05:19:59
[DHCP IP: 192.168.5.6] to MAC address 00:19:9d:ba:92:4d, Wednesday, February 28, 2018 05:19:53
[DHCP IP: 192.168.5.5] to MAC address a0:cc:2b:bf:0a:46, Tuesday, February 27, 2018 21:42:29
[Time synchronized with NTP server] Tuesday, February 27, 2018 21:36:52
[DHCP IP: 192.168.5.5] to MAC address a0:cc:2b:bf:0a:46, Tuesday, February 27, 2018 21:33:28
[DHCP IP: 192.168.5.7] to MAC address 00:19:9d:be:f7:cb, Tuesday, February 27, 2018 21:06:25
[DHCP IP: 192.168.5.5] to MAC address a0:cc:2b:bf:0a:46, Tuesday, February 27, 2018 17:42:49
[DHCP IP: 192.168.5.3] to MAC address cc:6d:a0:c3:04:0f, Tuesday, February 27, 2018 13:04:07
[DHCP IP: 192.168.5.2] to MAC address c8:ff:28:da:4b:30, Tuesday, February 27, 2018 09:38:09
[DHCP IP: 192.168.5.5] to MAC address a0:cc:2b:bf:0a:46, Tuesday, February 27, 2018 01:15:00
[DHCP IP: 192.168.5.3] to MAC address cc:6d:a0:c3:04:0f, Tuesday, February 27, 2018 01:05:16
[DHCP IP: 192.168.5.5] to MAC address a0:cc:2b:bf:0a:46, Monday, February 26, 2018 23:35:52
[ 4545.770000] [DoS Attack: SYN/ACK Scan] from source: 54.37.201.53, port 8000, Monday, February 26, 2018 22:50:18
[DHCP IP: 192.168.5.5] to MAC address a0:cc:2b:bf:0a:46, Monday, February 26, 2018 22:49:13
[  401.420000] nf_conntrack: automatic helper assignment is deprecated and it will be removed soon. Use the iptables CT target t
[DHCP IP: 192.168.5.2] to MAC address c8:ff:28:da:4b:30, Monday, February 26, 2018 21:38:09
[DHCP IP: 192.168.5.5] to MAC address a0:cc:2b:bf:0a:46, Monday, February 26, 2018 21:37:35
[DHCP IP: 192.168.5.2] to MAC address c8:ff:28:da:4b:30, Monday, February 26, 2018 21:37:24
[DHCP IP: 192.168.5.3] to MAC address cc:6d:a0:c3:04:0f, Monday, February 26, 2018 21:37:07
[DHCP IP: 192.168.5.2] to MAC address c8:ff:28:da:4b:30, Monday, February 26, 2018 21:37:05
[Time synchronized with NTP server] Monday, February 26, 2018 21:36:48
[Initialized, firmware version: V1.0.0.44]

Just noticed the DoS attack . . .

Today I have not noticed any interruptions.

Thanks again,

Kirk

[DarrenM]

The dos attack could be a false report but other than that the logs look fine do you notice at certain times of the day the disconnects happen or maybe when a certain device connects to your router?

DarrenM

[KCarroll]

It seems to be random. The weird thing is that I could have a connection to Netflix but then wouldn't be able to connect my laptop or vice versa. Sometimes I can reconnect if I disable WiFi and then re-enable and then do a network search but most of the time I'll have to power cycle. My modem always shows green lights during these occurrences. I do note that there is a firmware update available for the modem but I'm always hesitant to do this - I'm afraid it won't work at all if I update. Should I install the firmware update?

I checked my log again and found this:

Tuesday, March 06, 2018 21:10:05
[ 7641.790000] [DoS Attack: RST Scan] from source: 72.167.18.239, port 80, Tuesday, March 06, 2018 18:25:01
[ 5370.790000] [DoS Attack: RST Scan] from source: 72.167.18.239, port 80, Tuesday, March 06, 2018 17:47:10
[ 4923.580000] [DoS Attack: RST Scan] from source: 72.167.18.239, port 80, Tuesday, March 06, 2018 17:39:42
[ 4452.690000] [DoS Attack: ACK Scan] from source: 157.240.18.19, port 443, Tuesday, March 06, 2018 17:31:52
[ 4451.940000] [DoS Attack: ACK Scan] from source: 157.240.18.19, port 443, Tuesday, March 06, 2018 17:31:51
[ 4444.230000] [DoS Attack: RST Scan] from source: 72.167.18.239, port 80, Tuesday, March 06, 2018 17:31:43
[ 4355.220000] [DoS Attack: ACK Scan] from source: 157.240.18.19, port 443, Tuesday, March 06, 2018 17:30:14
[ 4355.180000] [DoS Attack: ACK Scan] from source: 157.240.18.19, port 443, Tuesday, March 06, 2018 17:30:14
[ 4333.930000] [DoS Attack: ACK Scan] from source: 157.240.18.19, port 443, Tuesday, March 06, 2018 17:29:53
[ 4332.280000] [DoS Attack: ACK Scan] from source: 157.240.18.19, port 443, Tuesday, March 06, 2018 17:29:51
[ 4303.330000] [DoS Attack: ACK Scan] from source: 13.33.252.108, port 443, Tuesday, March 06, 2018 17:29:22
[DHCP IP: 192.168.5.4] to MAC address a0:cc:2b:bf:0a:46, Tuesday, March 06, 2018 17:26:03
[ 1706.240000] [DoS Attack: NULL Scan] from source: 162.254.192.36, port 80, Tuesday, March 06, 2018 16:46:05
[ 1698.380000] [DoS Attack: NULL Scan] from source: 162.254.192.45, port 80, Tuesday, March 06, 2018 16:45:57
[ 1690.030000] [DoS Attack: NULL Scan] from source: 162.254.192.45, port 80, Tuesday, March 06, 2018 16:45:49
[DHCP IP: 192.168.5.3] to MAC address cc:6d:a0:c3:04:0f, Tuesday, March 06, 2018 16:45:02
[ 1364.870000] [DoS Attack: RST Scan] from source: 72.167.18.239, port 80, Tuesday, March 06, 2018 16:40:24
[ 1283.410000] [DoS Attack: NULL Scan] from source: 162.254.192.47, port 80, Tuesday, March 06, 2018 16:39:02
[ 1269.000000] [DoS Attack: NULL Scan] from source: 162.254.192.47, port 80, Tuesday, March 06, 2018 16:38:48
[ 1062.370000] [DoS Attack: RST Scan] from source: 72.167.18.239, port 80, Tuesday, March 06, 2018 16:35:21
[ 1061.430000] [DoS Attack: RST Scan] from source: 72.167.18.239, port 80, Tuesday, March 06, 2018 16:35:20
[  801.790000] [DoS Attack: ACK Scan] from source: 162.254.192.47, port 80, Tuesday, March 06, 2018 16:31:01
[  800.790000] [DoS Attack: ACK Scan] from source: 162.254.192.47, port 80, Tuesday, March 06, 2018 16:31:00
[  799.790000] [DoS Attack: ACK Scan] from source: 162.254.192.47, port 80, Tuesday, March 06, 2018 16:30:59
[  798.790000] [DoS Attack: ACK Scan] from source: 162.254.192.47, port 80, Tuesday, March 06, 2018 16:30:58
[  797.800000] [DoS Attack: ACK Scan] from source: 162.254.192.47, port 80, Tuesday, March 06, 2018 16:30:57
[  796.790000] [DoS Attack: ACK Scan] from source: 162.254.192.47, port 80, Tuesday, March 06, 2018 16:30:56
[  795.800000] [DoS Attack: ACK Scan] from source: 162.254.192.47, port 80, Tuesday, March 06, 2018 16:30:55
[  794.790000] [DoS Attack: ACK Scan] from source: 162.254.192.47, port 80, Tuesday, March 06, 2018 16:30:54
[  793.790000] [DoS Attack: ACK Scan] from source: 162.254.192.47, port 80, Tuesday, March 06, 2018 16:30:53
[  792.790000] [DoS Attack: ACK Scan] from source: 162.254.192.47, port 80, Tuesday, March 06, 2018 16:30:52
[  622.810000] [DoS Attack: ACK Scan] from source: 13.33.252.33, port 443, Tuesday, March 06, 2018 16:28:02
[  611.110000] [DoS Attack: ACK Scan] from source: 13.33.252.55, port 443, Tuesday, March 06, 2018 16:27:50
[  521.590000] [DoS Attack: ACK Scan] from source: 157.240.18.5, port 443, Tuesday, March 06, 2018 16:26:20
[  453.440000] [DoS Attack: RST Scan] from source: 72.167.18.239, port 80, Tuesday, March 06, 2018 16:25:12

What the heck?