× Introducing the Orbi 970 Series Mesh System with WiFi 7 technology. For more information visit the NETGEAR Press Room.
Orbi WiFi 7 RBE973
Reply

WNR2000v4 keeps changing internal ip address

Anonymous_fan
Aspirant

WNR2000v4 keeps changing internal ip address

Hi there,

 

Since a while I have a strange problem with my WNR2000v4. Every now and again the router changes the internal ip address of itself. The standard/default ip address is 192.168.1.1 but for some reason the router changes it to 10.0.0.1. According to the notice it is because of problems with my internet provider. If it happens I have to manually change it again to the correct internal ip address.

 

My setup is very simple, the internet signal is coming into my home received by my modem (ubee) and then it is given to the WNR2000v4 model of netgear. I do not know the ip address of the modem or how it works but my external ip is in the 94.*.*.* range. So it seems to me that there have to be no problems at all.

 

Kind regards,

 

Anonymous

Message 1 of 44

Accepted Solutions
Anonymous_fan
Aspirant

Re: WNR2000v4 keeps changing internal ip address

Hi Andy,

 

I have some more information on this subject from my ISP community. It is a rough translation with google translate, I hope you understand it.

 

This seemingly "strange phenomenon" can be explained. What I can say at this stage is that both parties have no guilt here. This phenomenon stems from two requirements that a manufacturer must meet when NAT is used with the product. See https://tools.ietf.org/html/rfc4787#section-4.4 for details.

Why you can see this at a modem reset is because the RF interface of the modem is not connected yet to the CMTS. As a result, the DHCP server of the modem itself is active until there is a connection to the CMTS. The WAN interface of your router detects a link down / up event and then try again to obtain an IP address. The WAN interface from your router will then receive a private IP from the modem of the same sequence which is then used your router at that time. The modem does not know that your router uses internally the same private IP range. This clearly presents a problem and configure your router responds correctly by itself with another private IP range. Why is the DHCP server of the modem active when there is no connection to the CMTS? Because you still can logon to the management interface of the modem.

Manufacturers must implement one of the following two things to make it work.

All traffic between internal / exterene clients correct translation and forwarding. This is difficult because you need a solution such as Session Traversal Utilities for NAT server. If the two clients are the same ISP who does double NAT, you are also dependent on the correct NAT hairpinning implementation of the ISP router.

The second solution is automatically ensure that the internal and external IP ranges do not overlap / are identical.

Manufacturers logically opt for the second easy solution. How can you solve this problem permanently? If your local network eg. 192.168.0.0 Class C network can be used eg. Set your router to use IP network 192.168.1.0.

View solution in original post

Message 41 of 44

All Replies
Babylon5
NETGEAR Employee Retired

Re: WNR2000v4 keeps changing internal ip address

What is the model number of your Ubee modem please? If the Netgear router detects an IP address at the WAN port which would conflict with its LAN subnet it will automatically change the LAN subnet to avoid a conflict, and allow the LAN to continue to function. So if the LAN subnet is 192.168.1.x then it would seem that the router has detected the same subnet on the WAN side. This will typically happen where the modem is also a router, very common with DSL ISPs, and sometimes Cable ISPs also. If you do have a modem/router combo, then it is normally advisable to set the modem to Bridged Mode. If you know the model number of the model run an Internet search on ‘model number Bridged Mode’ and if it is a modem/router then there’s a good chance that the answer to your issue will be there.
Message 2 of 44
Anonymous_fan
Aspirant

Re: WNR2000v4 keeps changing internal ip address

Hi Andy, No, it is not a combo. It is just a modem. My ISP does have combo's but I do not want one. I rather have control of things, hehe. Well anyway, sorry for the late answer. I had a RSS feed enabled but it seems not to be working or NetGear is blocking VPN connections. I will check the model number in the morning since it is night time at the moment of writing. I live in the netherlands. Also, subnets are not IP addresses. It is a mask ranging from 255.0.0.0 to 255.255.255.255. And NAT is enabled. Out of curiosity, could this also be caused by a DDOS attack? My ISP had one yesterday on its DNS servers and it seems they having them again today. Also, if I check the logs I see terms like DDOS. Now I come to think of it, I had never this problem but since I check for firmware updates/upgrades I have this problem. I can't be sure though. the version I'm using is 1.0.0.60. Anyway, thanks for looking into this 🙂
Message 3 of 44
Anonymous_fan
Aspirant

Re: WNR2000v4 keeps changing internal ip address

Hi Andy,

 

I have checked the modem and it is an Ubee EVM3200 modem. I also googled the model and it seems I can not login to it, as I would with a router. So just a modem I quess.

Message 4 of 44
Babylon5
NETGEAR Employee Retired

Re: WNR2000v4 keeps changing internal ip address

This might be of interest; http://www.foolwithatool.nl/hardware/setup-passthrough-mode-for-ubee-evw3200-wifi-modem-router/ Not quite the same model number though. If you log into the WNR2000 admin pages and look at the router status, what does it show for the WAN (Internet) IP address? Just found this also; http://boards.portforward.com/viewtopic.php?f=4&t=22066
Message 5 of 44
Anonymous_fan
Aspirant

Re: WNR2000v4 keeps changing internal ip address

Hi Andy,

 

The links are very educating but not very useful. At the first link I can see a internal ip address, when I try to connect to it then it turn up nothing. So I am assuming that it is really a modem and not a router. Also, the passthrough mode or whatever it is called,  is not supported anymore. If you really want to go to passthrough mode then I need to call my ISP. But I'll doubt that this is possible because there is no router in there. And even if there was, the article states that the router portion of the modem is not used anymore.

 

The second link about portforwarding is done on the Netgear router not on the modem. I do use portforwarding though.

 

I do not see a status of some kind so I can only see the installation of my ISP. I will post this in the next message since it would be more then 20.000 chars.

Message 6 of 44
Anonymous_fan
Aspirant

Re: WNR2000v4 keeps changing internal ip address

nternetinstallatie
 

     

 
Accountnaam  (indien vereist)
Domeinnaam  (indien vereist)
IP-adres
Dynamisch opvragen bij Internet Provider
Statisch IP-adres gebruiken
IP-adres94.213.*.*
IP-subnetmasker255.255.254.0
IP-adres gateway94.213.182.1
Adres domeinnaamserver (DNS)
Automatisch opvragen bij Internet Provider
Deze DNS-servers gebruiken
Primaire DNS8.8.8.8
Secundaire DNS8.8.4.4
Derde DNS. . .
MAC-adres van de router
Standaard adres gebruiken
MAC-adres van de computer gebruiken
Dit MAC-adres gebruiken
Message 7 of 44
Anonymous_fan
Aspirant

Re: WNR2000v4 keeps changing internal ip address

This is the log of the netgear router:

 

[admin login] from source 192.168.1.2, Thursday, August 20, 2015 10:00:52
[admin login] from source 192.168.1.2, Thursday, August 20, 2015 09:50:34
[LAN access from remote] from 115.231.222.14:64316 to 192.168.1.7:8080, Thursday, August 20, 2015 09:40:29
[DoS Attack: SYN/ACK Scan] from source: 59.26.71.187, port 25569, Thursday, August 20, 2015 09:17:04
[DHCP IP: 192.168.1.9] to MAC address dc:d3:21:09:fb:4d, Thursday, August 20, 2015 09:14:07
[LAN access from remote] from 115.231.222.14:64316 to 192.168.1.7:8080, Thursday, August 20, 2015 09:09:32
[DoS Attack: TCP/UDP Chargen] from source: 74.82.47.29, port 44185, Thursday, August 20, 2015 09:05:27
[DHCP IP: 192.168.1.9] to MAC address dc:d3:21:09:fb:4d, Thursday, August 20, 2015 08:42:10
[LAN access from remote] from 115.231.222.14:64316 to 192.168.1.7:8080, Thursday, August 20, 2015 08:40:11
[LAN access from remote] from 123.151.149.222:22204 to 192.168.1.10:80, Thursday, August 20, 2015 08:27:12
[LAN access from remote] from 46.172.71.251:57291 to 192.168.1.10:80, Thursday, August 20, 2015 08:19:17
[LAN access from remote] from 115.231.222.14:64316 to 192.168.1.7:8080, Thursday, August 20, 2015 08:09:55
[DHCP IP: 192.168.1.10] to MAC address e0:cb:ee:c0:6d:3b, Thursday, August 20, 2015 07:57:59
[LAN access from remote] from 115.231.222.14:3787 to 192.168.1.7:8080, Thursday, August 20, 2015 07:40:03
[LAN access from remote] from 115.231.222.14:64316 to 192.168.1.7:8080, Thursday, August 20, 2015 07:40:02
[DoS Attack: SYN/ACK Scan] from source: 5.196.120.46, port 7777, Thursday, August 20, 2015 07:27:14
[LAN access from remote] from 115.231.222.14:64316 to 192.168.1.7:8080, Thursday, August 20, 2015 07:10:12
[LAN access from remote] from 169.229.3.90:41590 to 192.168.1.10:80, Thursday, August 20, 2015 07:09:41
[LAN access from remote] from 77.247.181.162:41590 to 192.168.1.10:80, Thursday, August 20, 2015 07:08:21
[LAN access from remote] from 96.44.189.100:41590 to 192.168.1.10:80, Thursday, August 20, 2015 07:08:09
[LAN access from remote] from 96.47.226.20:41590 to 192.168.1.10:80, Thursday, August 20, 2015 07:08:09
[LAN access from remote] from 109.163.234.7:41590 to 192.168.1.10:80, Thursday, August 20, 2015 07:08:09
[LAN access from remote] from 141.212.121.192:41590 to 192.168.1.10:80, Thursday, August 20, 2015 07:08:09
[LAN access from remote] from 128.232.110.28:41590 to 192.168.1.10:80, Thursday, August 20, 2015 07:07:37
[DoS Attack: SYN/ACK Scan] from source: 5.196.120.46, port 7777, Thursday, August 20, 2015 06:57:41
[LAN access from remote] from 115.231.222.14:64316 to 192.168.1.7:8080, Thursday, August 20, 2015 06:40:11
[DHCP IP: 192.168.1.9] to MAC address dc:d3:21:09:fb:4d, Thursday, August 20, 2015 06:26:15
[DHCP IP: 192.168.1.2] to MAC address 1c:6f:65:2d:f1:c6, Thursday, August 20, 2015 06:21:59
[LAN access from remote] from 61.231.7.125:3447 to 192.168.1.7:8080, Thursday, August 20, 2015 06:14:04
[LAN access from remote] from 61.231.7.125:12200 to 192.168.1.7:8080, Thursday, August 20, 2015 06:13:10
[LAN access from remote] from 115.231.222.14:3501 to 192.168.1.7:8080, Thursday, August 20, 2015 05:41:06
[LAN access from remote] from 115.231.222.14:64316 to 192.168.1.7:8080, Thursday, August 20, 2015 05:41:02
[DHCP IP: 192.168.1.9] to MAC address dc:d3:21:09:fb:4d, Thursday, August 20, 2015 05:14:55
[LAN access from remote] from 115.231.222.14:4546 to 192.168.1.7:8080, Thursday, August 20, 2015 05:12:16
[LAN access from remote] from 115.231.222.14:64316 to 192.168.1.7:8080, Thursday, August 20, 2015 05:12:15
[LAN access from remote] from 115.231.222.14:4299 to 192.168.1.7:8080, Thursday, August 20, 2015 04:42:09
[LAN access from remote] from 115.231.222.14:64316 to 192.168.1.7:8080, Thursday, August 20, 2015 04:42:08
[DHCP IP: 192.168.1.10] to MAC address e0:cb:ee:c0:6d:3b, Thursday, August 20, 2015 04:38:50
[DoS Attack: SYN/ACK Scan] from source: 195.64.185.10, port 80, Thursday, August 20, 2015 04:22:08
[LAN access from remote] from 115.231.222.14:2626 to 192.168.1.7:8080, Thursday, August 20, 2015 04:12:21
[LAN access from remote] from 115.231.222.14:64316 to 192.168.1.7:8080, Thursday, August 20, 2015 04:12:21
[LAN access from remote] from 37.203.214.106:41239 to 192.168.1.10:80, Thursday, August 20, 2015 04:09:51
[DoS Attack: TCP/UDP Echo] from source: 185.82.203.159, port 45616, Thursday, August 20, 2015 04:03:08
[LAN access from remote] from 115.231.222.14:2085 to 192.168.1.7:8080, Thursday, August 20, 2015 03:42:05
[LAN access from remote] from 115.231.222.14:64316 to 192.168.1.7:8080, Thursday, August 20, 2015 03:42:05
[LAN access from remote] from 115.231.222.14:2028 to 192.168.1.7:8080, Thursday, August 20, 2015 03:12:08
[LAN access from remote] from 115.231.222.14:64316 to 192.168.1.7:8080, Thursday, August 20, 2015 03:12:00
[LAN access from remote] from 45.33.4.91:58004 to 192.168.1.10:80, Thursday, August 20, 2015 03:09:19
[LAN access from remote] from 115.231.222.14:1574 to 192.168.1.7:8080, Thursday, August 20, 2015 02:41:57
[LAN access from remote] from 115.231.222.14:64316 to 192.168.1.7:8080, Thursday, August 20, 2015 02:41:57
[DHCP IP: 192.168.1.9] to MAC address dc:d3:21:09:fb:4d, Thursday, August 20, 2015 02:29:21
[DHCP IP: 192.168.1.9] to MAC address dc:d3:21:09:fb:4d, Thursday, August 20, 2015 02:25:07
[DHCP IP: 192.168.1.9] to MAC address dc:d3:21:09:fb:4d, Thursday, August 20, 2015 02:15:52
[LAN access from remote] from 115.231.222.14:1759 to 192.168.1.7:8080, Thursday, August 20, 2015 02:11:24
[LAN access from remote] from 115.231.222.14:64316 to 192.168.1.7:8080, Thursday, August 20, 2015 02:11:23
[DoS Attack: SYN/ACK Scan] from source: 195.64.185.10, port 80, Thursday, August 20, 2015 01:55:50
[LAN access from remote] from 115.231.222.14:1032 to 192.168.1.7:8080, Thursday, August 20, 2015 01:40:48
[LAN access from remote] from 115.231.222.14:64316 to 192.168.1.7:8080, Thursday, August 20, 2015 01:40:47
[LAN access from remote] from 89.248.160.196:21188 to 192.168.1.10:80, Thursday, August 20, 2015 01:26:21
[DHCP IP: 192.168.1.9] to MAC address dc:d3:21:09:fb:4d, Thursday, August 20, 2015 01:12:06
[LAN access from remote] from 115.231.222.14:3678 to 192.168.1.7:8080, Thursday, August 20, 2015 01:10:19
[LAN access from remote] from 115.231.222.14:64316 to 192.168.1.7:8080, Thursday, August 20, 2015 01:10:18
[DoS Attack: SYN/ACK Scan] from source: 181.114.18.22, port 25, Thursday, August 20, 2015 00:59:54
[LAN access from remote] from 115.231.222.14:2985 to 192.168.1.7:8080, Thursday, August 20, 2015 00:40:21
[LAN access from remote] from 115.231.222.14:64316 to 192.168.1.7:8080, Thursday, August 20, 2015 00:40:21
[DoS Attack: SYN/ACK Scan] from source: 198.50.130.178, port 6023, Thursday, August 20, 2015 00:29:24
[DoS Attack: SYN/ACK Scan] from source: 80.7.186.25, port 80, Thursday, August 20, 2015 00:14:44
[LAN access from remote] from 115.231.222.14:3518 to 192.168.1.7:8080, Thursday, August 20, 2015 00:10:36
[LAN access from remote] from 115.231.222.14:64316 to 192.168.1.7:8080, Thursday, August 20, 2015 00:10:36
[LAN access from remote] from 115.231.222.14:2852 to 192.168.1.7:8080, Wednesday, August 19, 2015 23:41:19
[LAN access from remote] from 115.231.222.14:64316 to 192.168.1.7:8080, Wednesday, August 19, 2015 23:41:18
[DHCP IP: 192.168.1.7] to MAC address 08:00:27:08:ff:ab, Wednesday, August 19, 2015 23:38:21
[LAN access from remote] from 115.231.222.14:64316 to 192.168.1.7:8080, Wednesday, August 19, 2015 23:11:10
[DoS Attack: SYN/ACK Scan] from source: 195.64.185.10, port 80, Wednesday, August 19, 2015 22:40:09
[LAN access from remote] from 115.231.222.14:4435 to 192.168.1.7:8080, Wednesday, August 19, 2015 22:39:53
[LAN access from remote] from 115.231.222.14:64316 to 192.168.1.7:8080, Wednesday, August 19, 2015 22:39:53
[DHCP IP: 192.168.1.9] to MAC address dc:d3:21:09:fb:4d, Wednesday, August 19, 2015 22:12:11
[LAN access from remote] from 115.231.222.14:64316 to 192.168.1.7:8080, Wednesday, August 19, 2015 22:10:23
[LAN access from remote] from 36.229.233.209:2549 to 192.168.1.7:8080, Wednesday, August 19, 2015 21:51:02
[LAN access from remote] from 36.229.233.209:12200 to 192.168.1.7:8080, Wednesday, August 19, 2015 21:49:54
[LAN access from remote] from 115.231.222.14:3102 to 192.168.1.7:8080, Wednesday, August 19, 2015 21:40:58
[LAN access from remote] from 115.231.222.14:64316 to 192.168.1.7:8080, Wednesday, August 19, 2015 21:40:57
[LAN access from remote] from 222.186.21.48:4885 to 192.168.1.7:8080, Wednesday, August 19, 2015 21:31:18
[DHCP IP: 192.168.1.9] to MAC address dc:d3:21:09:fb:4d, Wednesday, August 19, 2015 21:14:05
[LAN access from remote] from 115.231.222.14:2524 to 192.168.1.7:8080, Wednesday, August 19, 2015 21:11:58
[LAN access from remote] from 115.231.222.14:64316 to 192.168.1.7:8080, Wednesday, August 19, 2015 21:11:54
[DoS Attack: RST Scan] from source: 37.59.30.114, port 80, Wednesday, August 19, 2015 21:10:43
[DHCP IP: 192.168.1.9] to MAC address dc:d3:21:09:fb:4d, Wednesday, August 19, 2015 20:42:09
[LAN access from remote] from 115.231.222.14:4655 to 192.168.1.7:8080, Wednesday, August 19, 2015 20:41:24
[LAN access from remote] from 115.231.222.14:64316 to 192.168.1.7:8080, Wednesday, August 19, 2015 20:41:24
[DoS Attack: RST Scan] from source: 216.110.245.16, port 1256, Wednesday, August 19, 2015 20:40:06
[LAN access from remote] from 46.172.71.251:53263 to 192.168.1.10:80, Wednesday, August 19, 2015 20:35:33
[DHCP IP: 192.168.1.8] to MAC address 00:26:9e:c1:20:11, Wednesday, August 19, 2015 20:28:23
[Time synchronized with NTP server] Wednesday, August 19, 2015 20:17:44
[LAN access from remote] from 115.231.222.14:64316 to 192.168.1.7:8080, Wednesday, August 19, 2015 20:10:35
[LAN access from remote] from 199.203.59.118:32951 to 192.168.1.10:80, Wednesday, August 19, 2015 20:06:28
[LAN access from remote] from 115.231.222.14:2160 to 192.168.1.7:8080, Wednesday, August 19, 2015 19:38:58
[LAN access from remote] from 115.231.222.14:64316 to 192.168.1.7:8080, Wednesday, August 19, 2015 19:38:57
[DoS Attack: SYN/ACK Scan] from source: 195.64.185.10, port 80, Wednesday, August 19, 2015 19:09:47
[LAN access from remote] from 115.231.222.14:4698 to 192.168.1.7:8080, Wednesday, August 19, 2015 19:08:40
[LAN access from remote] from 115.231.222.14:64316 to 192.168.1.7:8080, Wednesday, August 19, 2015 19:08:40
[DHCP IP: 192.168.1.2] to MAC address 1c:6f:65:2d:f1:c6, Wednesday, August 19, 2015 18:44:04
[LAN access from remote] from 115.231.222.14:4463 to 192.168.1.7:8080, Wednesday, August 19, 2015 18:39:11
[LAN access from remote] from 115.231.222.14:64316 to 192.168.1.7:8080, Wednesday, August 19, 2015 18:39:11
[DHCP IP: 192.168.1.9] to MAC address dc:d3:21:09:fb:4d, Wednesday, August 19, 2015 18:26:13
[DoS Attack: RST Scan] from source: 221.186.120.130, port 56901, Wednesday, August 19, 2015 18:16:29
[LAN access from remote] from 115.231.222.14:1469 to 192.168.1.7:8080, Wednesday, August 19, 2015 18:08:42
[LAN access from remote] from 115.231.222.14:64316 to 192.168.1.7:8080, Wednesday, August 19, 2015 18:08:42
[LAN access from remote] from 88.202.224.162:35581 to 192.168.1.10:80, Wednesday, August 19, 2015 18:00:25
[DoS Attack: SYN/ACK Scan] from source: 188.165.200.195, port 19505, Wednesday, August 19, 2015 17:52:19
[LAN access from remote] from 37.203.214.106:45280 to 192.168.1.10:80, Wednesday, August 19, 2015 17:46:04
[LAN access from remote] from 115.231.222.14:2562 to 192.168.1.7:8080, Wednesday, August 19, 2015 17:37:54
[LAN access from remote] from 115.231.222.14:64316 to 192.168.1.7:8080, Wednesday, August 19, 2015 17:37:54

Part 2 is in the next message

Message 8 of 44
Anonymous_fan
Aspirant

Re: WNR2000v4 keeps changing internal ip address

[admin login] from source 192.168.1.2, Thursday, August 20, 2015 10:00:52
[admin login] from source 192.168.1.2, Thursday, August 20, 2015 09:50:34
[LAN access from remote] from 115.231.222.14:64316 to 192.168.1.7:8080, Thursday, August 20, 2015 09:40:29
[DoS Attack: SYN/ACK Scan] from source: 59.26.71.187, port 25569, Thursday, August 20, 2015 09:17:04
[DHCP IP: 192.168.1.9] to MAC address dc:d3:21:09:fb:4d, Thursday, August 20, 2015 09:14:07
[LAN access from remote] from 115.231.222.14:64316 to 192.168.1.7:8080, Thursday, August 20, 2015 09:09:32
[DoS Attack: TCP/UDP Chargen] from source: 74.82.47.29, port 44185, Thursday, August 20, 2015 09:05:27
[DHCP IP: 192.168.1.9] to MAC address dc:d3:21:09:fb:4d, Thursday, August 20, 2015 08:42:10
[LAN access from remote] from 115.231.222.14:64316 to 192.168.1.7:8080, Thursday, August 20, 2015 08:40:11
[LAN access from remote] from 123.151.149.222:22204 to 192.168.1.10:80, Thursday, August 20, 2015 08:27:12
[LAN access from remote] from 46.172.71.251:57291 to 192.168.1.10:80, Thursday, August 20, 2015 08:19:17
[LAN access from remote] from 115.231.222.14:64316 to 192.168.1.7:8080, Thursday, August 20, 2015 08:09:55
[DHCP IP: 192.168.1.10] to MAC address e0:cb:ee:c0:6d:3b, Thursday, August 20, 2015 07:57:59
[LAN access from remote] from 115.231.222.14:3787 to 192.168.1.7:8080, Thursday, August 20, 2015 07:40:03
[LAN access from remote] from 115.231.222.14:64316 to 192.168.1.7:8080, Thursday, August 20, 2015 07:40:02
[DoS Attack: SYN/ACK Scan] from source: 5.196.120.46, port 7777, Thursday, August 20, 2015 07:27:14
[LAN access from remote] from 115.231.222.14:64316 to 192.168.1.7:8080, Thursday, August 20, 2015 07:10:12
[LAN access from remote] from 169.229.3.90:41590 to 192.168.1.10:80, Thursday, August 20, 2015 07:09:41
[LAN access from remote] from 77.247.181.162:41590 to 192.168.1.10:80, Thursday, August 20, 2015 07:08:21
[LAN access from remote] from 96.44.189.100:41590 to 192.168.1.10:80, Thursday, August 20, 2015 07:08:09
[LAN access from remote] from 96.47.226.20:41590 to 192.168.1.10:80, Thursday, August 20, 2015 07:08:09
[LAN access from remote] from 109.163.234.7:41590 to 192.168.1.10:80, Thursday, August 20, 2015 07:08:09
[LAN access from remote] from 141.212.121.192:41590 to 192.168.1.10:80, Thursday, August 20, 2015 07:08:09
[LAN access from remote] from 128.232.110.28:41590 to 192.168.1.10:80, Thursday, August 20, 2015 07:07:37
[DoS Attack: SYN/ACK Scan] from source: 5.196.120.46, port 7777, Thursday, August 20, 2015 06:57:41
[LAN access from remote] from 115.231.222.14:64316 to 192.168.1.7:8080, Thursday, August 20, 2015 06:40:11
[DHCP IP: 192.168.1.9] to MAC address dc:d3:21:09:fb:4d, Thursday, August 20, 2015 06:26:15
[DHCP IP: 192.168.1.2] to MAC address 1c:6f:65:2d:f1:c6, Thursday, August 20, 2015 06:21:59
[LAN access from remote] from 61.231.7.125:3447 to 192.168.1.7:8080, Thursday, August 20, 2015 06:14:04
[LAN access from remote] from 61.231.7.125:12200 to 192.168.1.7:8080, Thursday, August 20, 2015 06:13:10
[LAN access from remote] from 115.231.222.14:3501 to 192.168.1.7:8080, Thursday, August 20, 2015 05:41:06
[LAN access from remote] from 115.231.222.14:64316 to 192.168.1.7:8080, Thursday, August 20, 2015 05:41:02
[DHCP IP: 192.168.1.9] to MAC address dc:d3:21:09:fb:4d, Thursday, August 20, 2015 05:14:55
[LAN access from remote] from 115.231.222.14:4546 to 192.168.1.7:8080, Thursday, August 20, 2015 05:12:16
[LAN access from remote] from 115.231.222.14:64316 to 192.168.1.7:8080, Thursday, August 20, 2015 05:12:15
[LAN access from remote] from 115.231.222.14:4299 to 192.168.1.7:8080, Thursday, August 20, 2015 04:42:09
[LAN access from remote] from 115.231.222.14:64316 to 192.168.1.7:8080, Thursday, August 20, 2015 04:42:08
[DHCP IP: 192.168.1.10] to MAC address e0:cb:ee:c0:6d:3b, Thursday, August 20, 2015 04:38:50
[DoS Attack: SYN/ACK Scan] from source: 195.64.185.10, port 80, Thursday, August 20, 2015 04:22:08
[LAN access from remote] from 115.231.222.14:2626 to 192.168.1.7:8080, Thursday, August 20, 2015 04:12:21
[LAN access from remote] from 115.231.222.14:64316 to 192.168.1.7:8080, Thursday, August 20, 2015 04:12:21
[LAN access from remote] from 37.203.214.106:41239 to 192.168.1.10:80, Thursday, August 20, 2015 04:09:51
[DoS Attack: TCP/UDP Echo] from source: 185.82.203.159, port 45616, Thursday, August 20, 2015 04:03:08
[LAN access from remote] from 115.231.222.14:2085 to 192.168.1.7:8080, Thursday, August 20, 2015 03:42:05
[LAN access from remote] from 115.231.222.14:64316 to 192.168.1.7:8080, Thursday, August 20, 2015 03:42:05
[LAN access from remote] from 115.231.222.14:2028 to 192.168.1.7:8080, Thursday, August 20, 2015 03:12:08
[LAN access from remote] from 115.231.222.14:64316 to 192.168.1.7:8080, Thursday, August 20, 2015 03:12:00
[LAN access from remote] from 45.33.4.91:58004 to 192.168.1.10:80, Thursday, August 20, 2015 03:09:19
[LAN access from remote] from 115.231.222.14:1574 to 192.168.1.7:8080, Thursday, August 20, 2015 02:41:57
[LAN access from remote] from 115.231.222.14:64316 to 192.168.1.7:8080, Thursday, August 20, 2015 02:41:57
[DHCP IP: 192.168.1.9] to MAC address dc:d3:21:09:fb:4d, Thursday, August 20, 2015 02:29:21
[DHCP IP: 192.168.1.9] to MAC address dc:d3:21:09:fb:4d, Thursday, August 20, 2015 02:25:07
[DHCP IP: 192.168.1.9] to MAC address dc:d3:21:09:fb:4d, Thursday, August 20, 2015 02:15:52
[LAN access from remote] from 115.231.222.14:1759 to 192.168.1.7:8080, Thursday, August 20, 2015 02:11:24
[LAN access from remote] from 115.231.222.14:64316 to 192.168.1.7:8080, Thursday, August 20, 2015 02:11:23
[DoS Attack: SYN/ACK Scan] from source: 195.64.185.10, port 80, Thursday, August 20, 2015 01:55:50
[LAN access from remote] from 115.231.222.14:1032 to 192.168.1.7:8080, Thursday, August 20, 2015 01:40:48
[LAN access from remote] from 115.231.222.14:64316 to 192.168.1.7:8080, Thursday, August 20, 2015 01:40:47
[LAN access from remote] from 89.248.160.196:21188 to 192.168.1.10:80, Thursday, August 20, 2015 01:26:21
[DHCP IP: 192.168.1.9] to MAC address dc:d3:21:09:fb:4d, Thursday, August 20, 2015 01:12:06
[LAN access from remote] from 115.231.222.14:3678 to 192.168.1.7:8080, Thursday, August 20, 2015 01:10:19
[LAN access from remote] from 115.231.222.14:64316 to 192.168.1.7:8080, Thursday, August 20, 2015 01:10:18
[DoS Attack: SYN/ACK Scan] from source: 181.114.18.22, port 25, Thursday, August 20, 2015 00:59:54
[LAN access from remote] from 115.231.222.14:2985 to 192.168.1.7:8080, Thursday, August 20, 2015 00:40:21
[LAN access from remote] from 115.231.222.14:64316 to 192.168.1.7:8080, Thursday, August 20, 2015 00:40:21
[DoS Attack: SYN/ACK Scan] from source: 198.50.130.178, port 6023, Thursday, August 20, 2015 00:29:24
[DoS Attack: SYN/ACK Scan] from source: 80.7.186.25, port 80, Thursday, August 20, 2015 00:14:44
[LAN access from remote] from 115.231.222.14:3518 to 192.168.1.7:8080, Thursday, August 20, 2015 00:10:36
[LAN access from remote] from 115.231.222.14:64316 to 192.168.1.7:8080, Thursday, August 20, 2015 00:10:36
[LAN access from remote] from 115.231.222.14:2852 to 192.168.1.7:8080, Wednesday, August 19, 2015 23:41:19
[LAN access from remote] from 115.231.222.14:64316 to 192.168.1.7:8080, Wednesday, August 19, 2015 23:41:18
[DHCP IP: 192.168.1.7] to MAC address 08:00:27:08:ff:ab, Wednesday, August 19, 2015 23:38:21
[LAN access from remote] from 115.231.222.14:64316 to 192.168.1.7:8080, Wednesday, August 19, 2015 23:11:10
[DoS Attack: SYN/ACK Scan] from source: 195.64.185.10, port 80, Wednesday, August 19, 2015 22:40:09
[LAN access from remote] from 115.231.222.14:4435 to 192.168.1.7:8080, Wednesday, August 19, 2015 22:39:53
[LAN access from remote] from 115.231.222.14:64316 to 192.168.1.7:8080, Wednesday, August 19, 2015 22:39:53
[DHCP IP: 192.168.1.9] to MAC address dc:d3:21:09:fb:4d, Wednesday, August 19, 2015 22:12:11
[LAN access from remote] from 115.231.222.14:64316 to 192.168.1.7:8080, Wednesday, August 19, 2015 22:10:23
[LAN access from remote] from 36.229.233.209:2549 to 192.168.1.7:8080, Wednesday, August 19, 2015 21:51:02
[LAN access from remote] from 36.229.233.209:12200 to 192.168.1.7:8080, Wednesday, August 19, 2015 21:49:54
[LAN access from remote] from 115.231.222.14:3102 to 192.168.1.7:8080, Wednesday, August 19, 2015 21:40:58
[LAN access from remote] from 115.231.222.14:64316 to 192.168.1.7:8080, Wednesday, August 19, 2015 21:40:57
[LAN access from remote] from 222.186.21.48:4885 to 192.168.1.7:8080, Wednesday, August 19, 2015 21:31:18
[DHCP IP: 192.168.1.9] to MAC address dc:d3:21:09:fb:4d, Wednesday, August 19, 2015 21:14:05
[LAN access from remote] from 115.231.222.14:2524 to 192.168.1.7:8080, Wednesday, August 19, 2015 21:11:58
[LAN access from remote] from 115.231.222.14:64316 to 192.168.1.7:8080, Wednesday, August 19, 2015 21:11:54
[DoS Attack: RST Scan] from source: 37.59.30.114, port 80, Wednesday, August 19, 2015 21:10:43
[DHCP IP: 192.168.1.9] to MAC address dc:d3:21:09:fb:4d, Wednesday, August 19, 2015 20:42:09
[LAN access from remote] from 115.231.222.14:4655 to 192.168.1.7:8080, Wednesday, August 19, 2015 20:41:24
[LAN access from remote] from 115.231.222.14:64316 to 192.168.1.7:8080, Wednesday, August 19, 2015 20:41:24
[DoS Attack: RST Scan] from source: 216.110.245.16, port 1256, Wednesday, August 19, 2015 20:40:06
[LAN access from remote] from 46.172.71.251:53263 to 192.168.1.10:80, Wednesday, August 19, 2015 20:35:33
[DHCP IP: 192.168.1.8] to MAC address 00:26:9e:c1:20:11, Wednesday, August 19, 2015 20:28:23
[Time synchronized with NTP server] Wednesday, August 19, 2015 20:17:44
[LAN access from remote] from 115.231.222.14:64316 to 192.168.1.7:8080, Wednesday, August 19, 2015 20:10:35
[LAN access from remote] from 199.203.59.118:32951 to 192.168.1.10:80, Wednesday, August 19, 2015 20:06:28
[LAN access from remote] from 115.231.222.14:2160 to 192.168.1.7:8080, Wednesday, August 19, 2015 19:38:58
[LAN access from remote] from 115.231.222.14:64316 to 192.168.1.7:8080, Wednesday, August 19, 2015 19:38:57
[DoS Attack: SYN/ACK Scan] from source: 195.64.185.10, port 80, Wednesday, August 19, 2015 19:09:47
[LAN access from remote] from 115.231.222.14:4698 to 192.168.1.7:8080, Wednesday, August 19, 2015 19:08:40
[LAN access from remote] from 115.231.222.14:64316 to 192.168.1.7:8080, Wednesday, August 19, 2015 19:08:40
[DHCP IP: 192.168.1.2] to MAC address 1c:6f:65:2d:f1:c6, Wednesday, August 19, 2015 18:44:04
[LAN access from remote] from 115.231.222.14:4463 to 192.168.1.7:8080, Wednesday, August 19, 2015 18:39:11
[LAN access from remote] from 115.231.222.14:64316 to 192.168.1.7:8080, Wednesday, August 19, 2015 18:39:11
[DHCP IP: 192.168.1.9] to MAC address dc:d3:21:09:fb:4d, Wednesday, August 19, 2015 18:26:13
[DoS Attack: RST Scan] from source: 221.186.120.130, port 56901, Wednesday, August 19, 2015 18:16:29
[LAN access from remote] from 115.231.222.14:1469 to 192.168.1.7:8080, Wednesday, August 19, 2015 18:08:42
[LAN access from remote] from 115.231.222.14:64316 to 192.168.1.7:8080, Wednesday, August 19, 2015 18:08:42
[LAN access from remote] from 88.202.224.162:35581 to 192.168.1.10:80, Wednesday, August 19, 2015 18:00:25
[DoS Attack: SYN/ACK Scan] from source: 188.165.200.195, port 19505, Wednesday, August 19, 2015 17:52:19
[LAN access from remote] from 37.203.214.106:45280 to 192.168.1.10:80, Wednesday, August 19, 2015 17:46:04
[LAN access from remote] from 115.231.222.14:2562 to 192.168.1.7:8080, Wednesday, August 19, 2015 17:37:54
[LAN access from remote] from 115.231.222.14:64316 to 192.168.1.7:8080, Wednesday, August 19, 2015 17:37:54
[DHCP IP: 192.168.1.9] to MAC address dc:d3:21:09:fb:4d, Wednesday, August 19, 2015 17:14:53
[LAN access from remote] from 115.231.222.14:4702 to 192.168.1.7:8080, Wednesday, August 19, 2015 17:07:21
[LAN access from remote] from 115.231.222.14:64316 to 192.168.1.7:8080, Wednesday, August 19, 2015 17:07:20
[DoS Attack: RST Scan] from source: 59.51.81.210, port 80, Wednesday, August 19, 2015 16:55:24
[DoS Attack: RST Scan] from source: 216.110.245.16, port 4898, Wednesday, August 19, 2015 16:43:12
[LAN access from remote] from 115.231.222.14:4168 to 192.168.1.7:8080, Wednesday, August 19, 2015 16:37:47
[LAN access from remote] from 115.231.222.14:64316 to 192.168.1.7:8080, Wednesday, August 19, 2015 16:37:47
[DoS Attack: TCP/UDP Chargen] from source: 89.248.168.148, port 48856, Wednesday, August 19, 2015 16:35:21
[DoS Attack: SYN/ACK Scan] from source: 195.154.233.184, port 3724, Wednesday, August 19, 2015 16:22:13
[LAN access from remote] from 115.231.222.14:3672 to 192.168.1.7:8080, Wednesday, August 19, 2015 16:08:57
[LAN access from remote] from 115.231.222.14:64316 to 192.168.1.7:8080, Wednesday, August 19, 2015 16:08:57
[LAN access from remote] from 195.154.165.177:60000 to 192.168.1.7:8080, Wednesday, August 19, 2015 15:58:14
[DoS Attack: RST Scan] from source: 162.159.241.118, port 443, Wednesday, August 19, 2015 15:52:49
[LAN access from remote] from 115.231.222.14:4965 to 192.168.1.7:8080, Wednesday, August 19, 2015 15:40:11
[LAN access from remote] from 115.231.222.14:64316 to 192.168.1.7:8080, Wednesday, August 19, 2015 15:40:11
[DoS Attack: ACK Scan] from source: 168.235.75.252, port 3389, Wednesday, August 19, 2015 15:13:53
[LAN access from remote] from 141.212.122.68:35912 to 192.168.1.10:80, Wednesday, August 19, 2015 15:12:44
[LAN access from remote] from 115.231.222.14:1121 to 192.168.1.7:8080, Wednesday, August 19, 2015 15:12:03
[LAN access from remote] from 115.231.222.14:64316 to 192.168.1.7:8080, Wednesday, August 19, 2015 15:12:03
[LAN access from remote] from 62.210.69.173:60009 to 192.168.1.10:80, Wednesday, August 19, 2015 15:01:45
[LAN access from remote] from 115.231.222.14:4743 to 192.168.1.7:8080, Wednesday, August 19, 2015 14:43:58
[LAN access from remote] from 115.231.222.14:64316 to 192.168.1.7:8080, Wednesday, August 19, 2015 14:43:58
[DHCP IP: 192.168.1.9] to MAC address dc:d3:21:09:fb:4d, Wednesday, August 19, 2015 14:29:20
[DHCP IP: 192.168.1.9] to MAC address dc:d3:21:09:fb:4d, Wednesday, August 19, 2015 14:25:05
[DoS Attack: SYN/ACK Scan] from source: 104.20.10.52, port 80, Wednesday, August 19, 2015 14:18:30

Message 9 of 44
Anonymous_fan
Aspirant

Re: WNR2000v4 keeps changing internal ip address

[admin login] from source 192.168.1.2, Thursday, August 20, 2015 10:00:52
[admin login] from source 192.168.1.2, Thursday, August 20, 2015 09:50:34
[LAN access from remote] from 115.231.222.14:64316 to 192.168.1.7:8080, Thursday, August 20, 2015 09:40:29
[DoS Attack: SYN/ACK Scan] from source: 59.26.71.187, port 25569, Thursday, August 20, 2015 09:17:04
[DHCP IP: 192.168.1.9] to MAC address dc:d3:21:09:fb:4d, Thursday, August 20, 2015 09:14:07
[LAN access from remote] from 115.231.222.14:64316 to 192.168.1.7:8080, Thursday, August 20, 2015 09:09:32
[DoS Attack: TCP/UDP Chargen] from source: 74.82.47.29, port 44185, Thursday, August 20, 2015 09:05:27
[DHCP IP: 192.168.1.9] to MAC address dc:d3:21:09:fb:4d, Thursday, August 20, 2015 08:42:10
[LAN access from remote] from 115.231.222.14:64316 to 192.168.1.7:8080, Thursday, August 20, 2015 08:40:11
[LAN access from remote] from 123.151.149.222:22204 to 192.168.1.10:80, Thursday, August 20, 2015 08:27:12
[LAN access from remote] from 46.172.71.251:57291 to 192.168.1.10:80, Thursday, August 20, 2015 08:19:17
[LAN access from remote] from 115.231.222.14:64316 to 192.168.1.7:8080, Thursday, August 20, 2015 08:09:55
[DHCP IP: 192.168.1.10] to MAC address e0:cb:ee:c0:6d:3b, Thursday, August 20, 2015 07:57:59
[LAN access from remote] from 115.231.222.14:3787 to 192.168.1.7:8080, Thursday, August 20, 2015 07:40:03
[LAN access from remote] from 115.231.222.14:64316 to 192.168.1.7:8080, Thursday, August 20, 2015 07:40:02
[DoS Attack: SYN/ACK Scan] from source: 5.196.120.46, port 7777, Thursday, August 20, 2015 07:27:14
[LAN access from remote] from 115.231.222.14:64316 to 192.168.1.7:8080, Thursday, August 20, 2015 07:10:12
[LAN access from remote] from 169.229.3.90:41590 to 192.168.1.10:80, Thursday, August 20, 2015 07:09:41
[LAN access from remote] from 77.247.181.162:41590 to 192.168.1.10:80, Thursday, August 20, 2015 07:08:21
[LAN access from remote] from 96.44.189.100:41590 to 192.168.1.10:80, Thursday, August 20, 2015 07:08:09
[LAN access from remote] from 96.47.226.20:41590 to 192.168.1.10:80, Thursday, August 20, 2015 07:08:09
[LAN access from remote] from 109.163.234.7:41590 to 192.168.1.10:80, Thursday, August 20, 2015 07:08:09
[LAN access from remote] from 141.212.121.192:41590 to 192.168.1.10:80, Thursday, August 20, 2015 07:08:09
[LAN access from remote] from 128.232.110.28:41590 to 192.168.1.10:80, Thursday, August 20, 2015 07:07:37
[DoS Attack: SYN/ACK Scan] from source: 5.196.120.46, port 7777, Thursday, August 20, 2015 06:57:41
[LAN access from remote] from 115.231.222.14:64316 to 192.168.1.7:8080, Thursday, August 20, 2015 06:40:11
[DHCP IP: 192.168.1.9] to MAC address dc:d3:21:09:fb:4d, Thursday, August 20, 2015 06:26:15
[DHCP IP: 192.168.1.2] to MAC address 1c:6f:65:2d:f1:c6, Thursday, August 20, 2015 06:21:59
[LAN access from remote] from 61.231.7.125:3447 to 192.168.1.7:8080, Thursday, August 20, 2015 06:14:04
[LAN access from remote] from 61.231.7.125:12200 to 192.168.1.7:8080, Thursday, August 20, 2015 06:13:10
[LAN access from remote] from 115.231.222.14:3501 to 192.168.1.7:8080, Thursday, August 20, 2015 05:41:06
[LAN access from remote] from 115.231.222.14:64316 to 192.168.1.7:8080, Thursday, August 20, 2015 05:41:02
[DHCP IP: 192.168.1.9] to MAC address dc:d3:21:09:fb:4d, Thursday, August 20, 2015 05:14:55
[LAN access from remote] from 115.231.222.14:4546 to 192.168.1.7:8080, Thursday, August 20, 2015 05:12:16
[LAN access from remote] from 115.231.222.14:64316 to 192.168.1.7:8080, Thursday, August 20, 2015 05:12:15
[LAN access from remote] from 115.231.222.14:4299 to 192.168.1.7:8080, Thursday, August 20, 2015 04:42:09
[LAN access from remote] from 115.231.222.14:64316 to 192.168.1.7:8080, Thursday, August 20, 2015 04:42:08
[DHCP IP: 192.168.1.10] to MAC address e0:cb:ee:c0:6d:3b, Thursday, August 20, 2015 04:38:50
[DoS Attack: SYN/ACK Scan] from source: 195.64.185.10, port 80, Thursday, August 20, 2015 04:22:08
[LAN access from remote] from 115.231.222.14:2626 to 192.168.1.7:8080, Thursday, August 20, 2015 04:12:21
[LAN access from remote] from 115.231.222.14:64316 to 192.168.1.7:8080, Thursday, August 20, 2015 04:12:21
[LAN access from remote] from 37.203.214.106:41239 to 192.168.1.10:80, Thursday, August 20, 2015 04:09:51
[DoS Attack: TCP/UDP Echo] from source: 185.82.203.159, port 45616, Thursday, August 20, 2015 04:03:08
[LAN access from remote] from 115.231.222.14:2085 to 192.168.1.7:8080, Thursday, August 20, 2015 03:42:05
[LAN access from remote] from 115.231.222.14:64316 to 192.168.1.7:8080, Thursday, August 20, 2015 03:42:05
[LAN access from remote] from 115.231.222.14:2028 to 192.168.1.7:8080, Thursday, August 20, 2015 03:12:08
[LAN access from remote] from 115.231.222.14:64316 to 192.168.1.7:8080, Thursday, August 20, 2015 03:12:00
[LAN access from remote] from 45.33.4.91:58004 to 192.168.1.10:80, Thursday, August 20, 2015 03:09:19
[LAN access from remote] from 115.231.222.14:1574 to 192.168.1.7:8080, Thursday, August 20, 2015 02:41:57
[LAN access from remote] from 115.231.222.14:64316 to 192.168.1.7:8080, Thursday, August 20, 2015 02:41:57
[DHCP IP: 192.168.1.9] to MAC address dc:d3:21:09:fb:4d, Thursday, August 20, 2015 02:29:21
[DHCP IP: 192.168.1.9] to MAC address dc:d3:21:09:fb:4d, Thursday, August 20, 2015 02:25:07
[DHCP IP: 192.168.1.9] to MAC address dc:d3:21:09:fb:4d, Thursday, August 20, 2015 02:15:52
[LAN access from remote] from 115.231.222.14:1759 to 192.168.1.7:8080, Thursday, August 20, 2015 02:11:24
[LAN access from remote] from 115.231.222.14:64316 to 192.168.1.7:8080, Thursday, August 20, 2015 02:11:23
[DoS Attack: SYN/ACK Scan] from source: 195.64.185.10, port 80, Thursday, August 20, 2015 01:55:50
[LAN access from remote] from 115.231.222.14:1032 to 192.168.1.7:8080, Thursday, August 20, 2015 01:40:48
[LAN access from remote] from 115.231.222.14:64316 to 192.168.1.7:8080, Thursday, August 20, 2015 01:40:47
[LAN access from remote] from 89.248.160.196:21188 to 192.168.1.10:80, Thursday, August 20, 2015 01:26:21
[DHCP IP: 192.168.1.9] to MAC address dc:d3:21:09:fb:4d, Thursday, August 20, 2015 01:12:06
[LAN access from remote] from 115.231.222.14:3678 to 192.168.1.7:8080, Thursday, August 20, 2015 01:10:19
[LAN access from remote] from 115.231.222.14:64316 to 192.168.1.7:8080, Thursday, August 20, 2015 01:10:18
[DoS Attack: SYN/ACK Scan] from source: 181.114.18.22, port 25, Thursday, August 20, 2015 00:59:54
[LAN access from remote] from 115.231.222.14:2985 to 192.168.1.7:8080, Thursday, August 20, 2015 00:40:21
[LAN access from remote] from 115.231.222.14:64316 to 192.168.1.7:8080, Thursday, August 20, 2015 00:40:21
[DoS Attack: SYN/ACK Scan] from source: 198.50.130.178, port 6023, Thursday, August 20, 2015 00:29:24
[DoS Attack: SYN/ACK Scan] from source: 80.7.186.25, port 80, Thursday, August 20, 2015 00:14:44
[LAN access from remote] from 115.231.222.14:3518 to 192.168.1.7:8080, Thursday, August 20, 2015 00:10:36
[LAN access from remote] from 115.231.222.14:64316 to 192.168.1.7:8080, Thursday, August 20, 2015 00:10:36
[LAN access from remote] from 115.231.222.14:2852 to 192.168.1.7:8080, Wednesday, August 19, 2015 23:41:19
[LAN access from remote] from 115.231.222.14:64316 to 192.168.1.7:8080, Wednesday, August 19, 2015 23:41:18
[DHCP IP: 192.168.1.7] to MAC address 08:00:27:08:ff:ab, Wednesday, August 19, 2015 23:38:21
[LAN access from remote] from 115.231.222.14:64316 to 192.168.1.7:8080, Wednesday, August 19, 2015 23:11:10
[DoS Attack: SYN/ACK Scan] from source: 195.64.185.10, port 80, Wednesday, August 19, 2015 22:40:09
[LAN access from remote] from 115.231.222.14:4435 to 192.168.1.7:8080, Wednesday, August 19, 2015 22:39:53
[LAN access from remote] from 115.231.222.14:64316 to 192.168.1.7:8080, Wednesday, August 19, 2015 22:39:53
[DHCP IP: 192.168.1.9] to MAC address dc:d3:21:09:fb:4d, Wednesday, August 19, 2015 22:12:11
[LAN access from remote] from 115.231.222.14:64316 to 192.168.1.7:8080, Wednesday, August 19, 2015 22:10:23
[LAN access from remote] from 36.229.233.209:2549 to 192.168.1.7:8080, Wednesday, August 19, 2015 21:51:02
[LAN access from remote] from 36.229.233.209:12200 to 192.168.1.7:8080, Wednesday, August 19, 2015 21:49:54
[LAN access from remote] from 115.231.222.14:3102 to 192.168.1.7:8080, Wednesday, August 19, 2015 21:40:58
[LAN access from remote] from 115.231.222.14:64316 to 192.168.1.7:8080, Wednesday, August 19, 2015 21:40:57
[LAN access from remote] from 222.186.21.48:4885 to 192.168.1.7:8080, Wednesday, August 19, 2015 21:31:18
[DHCP IP: 192.168.1.9] to MAC address dc:d3:21:09:fb:4d, Wednesday, August 19, 2015 21:14:05
[LAN access from remote] from 115.231.222.14:2524 to 192.168.1.7:8080, Wednesday, August 19, 2015 21:11:58
[LAN access from remote] from 115.231.222.14:64316 to 192.168.1.7:8080, Wednesday, August 19, 2015 21:11:54
[DoS Attack: RST Scan] from source: 37.59.30.114, port 80, Wednesday, August 19, 2015 21:10:43
[DHCP IP: 192.168.1.9] to MAC address dc:d3:21:09:fb:4d, Wednesday, August 19, 2015 20:42:09
[LAN access from remote] from 115.231.222.14:4655 to 192.168.1.7:8080, Wednesday, August 19, 2015 20:41:24
[LAN access from remote] from 115.231.222.14:64316 to 192.168.1.7:8080, Wednesday, August 19, 2015 20:41:24
[DoS Attack: RST Scan] from source: 216.110.245.16, port 1256, Wednesday, August 19, 2015 20:40:06
[LAN access from remote] from 46.172.71.251:53263 to 192.168.1.10:80, Wednesday, August 19, 2015 20:35:33
[DHCP IP: 192.168.1.8] to MAC address 00:26:9e:c1:20:11, Wednesday, August 19, 2015 20:28:23
[Time synchronized with NTP server] Wednesday, August 19, 2015 20:17:44
[LAN access from remote] from 115.231.222.14:64316 to 192.168.1.7:8080, Wednesday, August 19, 2015 20:10:35
[LAN access from remote] from 199.203.59.118:32951 to 192.168.1.10:80, Wednesday, August 19, 2015 20:06:28
[LAN access from remote] from 115.231.222.14:2160 to 192.168.1.7:8080, Wednesday, August 19, 2015 19:38:58
[LAN access from remote] from 115.231.222.14:64316 to 192.168.1.7:8080, Wednesday, August 19, 2015 19:38:57
[DoS Attack: SYN/ACK Scan] from source: 195.64.185.10, port 80, Wednesday, August 19, 2015 19:09:47
[LAN access from remote] from 115.231.222.14:4698 to 192.168.1.7:8080, Wednesday, August 19, 2015 19:08:40
[LAN access from remote] from 115.231.222.14:64316 to 192.168.1.7:8080, Wednesday, August 19, 2015 19:08:40
[DHCP IP: 192.168.1.2] to MAC address 1c:6f:65:2d:f1:c6, Wednesday, August 19, 2015 18:44:04
[LAN access from remote] from 115.231.222.14:4463 to 192.168.1.7:8080, Wednesday, August 19, 2015 18:39:11
[LAN access from remote] from 115.231.222.14:64316 to 192.168.1.7:8080, Wednesday, August 19, 2015 18:39:11
[DHCP IP: 192.168.1.9] to MAC address dc:d3:21:09:fb:4d, Wednesday, August 19, 2015 18:26:13
[DoS Attack: RST Scan] from source: 221.186.120.130, port 56901, Wednesday, August 19, 2015 18:16:29
[LAN access from remote] from 115.231.222.14:1469 to 192.168.1.7:8080, Wednesday, August 19, 2015 18:08:42
[LAN access from remote] from 115.231.222.14:64316 to 192.168.1.7:8080, Wednesday, August 19, 2015 18:08:42
[LAN access from remote] from 88.202.224.162:35581 to 192.168.1.10:80, Wednesday, August 19, 2015 18:00:25
[DoS Attack: SYN/ACK Scan] from source: 188.165.200.195, port 19505, Wednesday, August 19, 2015 17:52:19
[LAN access from remote] from 37.203.214.106:45280 to 192.168.1.10:80, Wednesday, August 19, 2015 17:46:04
[LAN access from remote] from 115.231.222.14:2562 to 192.168.1.7:8080, Wednesday, August 19, 2015 17:37:54
[LAN access from remote] from 115.231.222.14:64316 to 192.168.1.7:8080, Wednesday, August 19, 2015 17:37:54
[DHCP IP: 192.168.1.9] to MAC address dc:d3:21:09:fb:4d, Wednesday, August 19, 2015 17:14:53
[LAN access from remote] from 115.231.222.14:4702 to 192.168.1.7:8080, Wednesday, August 19, 2015 17:07:21
[LAN access from remote] from 115.231.222.14:64316 to 192.168.1.7:8080, Wednesday, August 19, 2015 17:07:20
[DoS Attack: RST Scan] from source: 59.51.81.210, port 80, Wednesday, August 19, 2015 16:55:24
[DoS Attack: RST Scan] from source: 216.110.245.16, port 4898, Wednesday, August 19, 2015 16:43:12
[LAN access from remote] from 115.231.222.14:4168 to 192.168.1.7:8080, Wednesday, August 19, 2015 16:37:47
[LAN access from remote] from 115.231.222.14:64316 to 192.168.1.7:8080, Wednesday, August 19, 2015 16:37:47
[DoS Attack: TCP/UDP Chargen] from source: 89.248.168.148, port 48856, Wednesday, August 19, 2015 16:35:21
[DoS Attack: SYN/ACK Scan] from source: 195.154.233.184, port 3724, Wednesday, August 19, 2015 16:22:13
[LAN access from remote] from 115.231.222.14:3672 to 192.168.1.7:8080, Wednesday, August 19, 2015 16:08:57
[LAN access from remote] from 115.231.222.14:64316 to 192.168.1.7:8080, Wednesday, August 19, 2015 16:08:57
[LAN access from remote] from 195.154.165.177:60000 to 192.168.1.7:8080, Wednesday, August 19, 2015 15:58:14
[DoS Attack: RST Scan] from source: 162.159.241.118, port 443, Wednesday, August 19, 2015 15:52:49
[LAN access from remote] from 115.231.222.14:4965 to 192.168.1.7:8080, Wednesday, August 19, 2015 15:40:11
[LAN access from remote] from 115.231.222.14:64316 to 192.168.1.7:8080, Wednesday, August 19, 2015 15:40:11
[DoS Attack: ACK Scan] from source: 168.235.75.252, port 3389, Wednesday, August 19, 2015 15:13:53
[LAN access from remote] from 141.212.122.68:35912 to 192.168.1.10:80, Wednesday, August 19, 2015 15:12:44
[LAN access from remote] from 115.231.222.14:1121 to 192.168.1.7:8080, Wednesday, August 19, 2015 15:12:03
[LAN access from remote] from 115.231.222.14:64316 to 192.168.1.7:8080, Wednesday, August 19, 2015 15:12:03
[LAN access from remote] from 62.210.69.173:60009 to 192.168.1.10:80, Wednesday, August 19, 2015 15:01:45
[LAN access from remote] from 115.231.222.14:4743 to 192.168.1.7:8080, Wednesday, August 19, 2015 14:43:58
[LAN access from remote] from 115.231.222.14:64316 to 192.168.1.7:8080, Wednesday, August 19, 2015 14:43:58
[DHCP IP: 192.168.1.9] to MAC address dc:d3:21:09:fb:4d, Wednesday, August 19, 2015 14:29:20
[DHCP IP: 192.168.1.9] to MAC address dc:d3:21:09:fb:4d, Wednesday, August 19, 2015 14:25:05
[DoS Attack: SYN/ACK Scan] from source: 104.20.10.52, port 80, Wednesday, August 19, 2015 14:18:30

Message 10 of 44
Babylon5
NETGEAR Employee Retired

Re: WNR2000v4 keeps changing internal ip address

OK, I’m at work and most of the images you post are blocked by the firewall. My only reason for questioning the modem setup is to ensure that it is operating as a modem, and since you are sure it is then that’s fine. Otherwise I still think that the reason the LAN subnet is changing for the Netgear router is that it has detected a clashing (same) subnet on the WAN side. In that case since it’s unlikely that you will be making any changes to the modem settings, perhaps it would be best to accept the changed LAN subnet and continue to use 10.0.0.x?
Message 11 of 44
Anonymous_fan
Aspirant

Re: WNR2000v4 keeps changing internal ip address

Hi Andy,

 

Still many thanks for looking into this. I'm wondering why this is happening since,

 

- None of the numbers (ip/subnetmask) match, so I assume that there is no problem in addressing.

- This happens after the last upgrade (1.0.0.50 to 1.0.0.60), which I also installed a while ago.

 

I contacted my ISP and they confirm that it is a single modem and I get the 94.213.*.* address assigned to it.

 

Is there any alternative I can try, apart from a factory reset? I have some servers running which I need to change if I accept your proposal to use the new settings of the changed internal ip addresses. This requires a lot of work. Hmm, I was thinking, would a factory reset work? Then I have to configure the router again and not all of my servers.

 

Offtopic:

I was not trying to post an image. It was text and a log of my router. I exceeded the max characters (20.000), so posting logs is not allowed, I quess. Or it was to rapid since I had to do it in parts.

Message 12 of 44
Babylon5
NETGEAR Employee Retired

Re: WNR2000v4 keeps changing internal ip address

Hi, I can’t be absolutely sure of your issue, but I’ve come across it before on these forums, a similar situation where someone has a modem but the router changes its LAN subnet, apparently to avoid a clash. I suppose one thing you might like to try is to connect a computer directly to the modem and monitor traffic using something like Wireshark or Microsoft Network Monitor, this should easily identify if there’s any traffic on the 192.168.1.x subnet. You could make a backup of the router settings if you want to try a factory reset, then if you find no difference in performance you could reload the saved settings. I quite understand that you might not want to change the LAN subnet; these things are rarely as straightforward as they might sound. I think the post attachments are limited to images or .pdf files, I could not upload a .docx file a few days ago. I used Word and the print to .pdf option, .pdf files can be uploaded.
Message 13 of 44
Babylon5
NETGEAR Employee Retired

Re: WNR2000v4 keeps changing internal ip address

I can see your earlier posts now.

 

Well it looks like you have a couple of servers on your LAN, one listening at Port 80 (LAN IP 192.168.1.10) and the other listening at Port 8080 (LAN IP 192.168.1.7). Is this as you intend it?

 

By the way, that 115.231.222.14 address traces to China, is that familiar to you, are you running any equipment on you LAN e.g. IP cameras which might ‘phone home’?

Message 14 of 44
KennethL
NETGEAR Employee Retired

Re: WNR2000v4 keeps changing internal ip address


@Anonymous_fan wrote:

...

Offtopic:

I was not trying to post an image. It was text and a log of my router. I exceeded the max characters (20.000), so posting logs is not allowed, I quess. Or it was to rapid since I had to do it in parts.


There is a Spam filter that reviews every postings.  Sometime with repeating patterns, it may think your logs to be Spam content and flags that post, moves into a spam quarantine and watches for further posting from that user.  A human would need to make additional decisions.    

 

We are increasing our monitoring to decrease this inconvenience.

 

Regards,

Kenneth

Message 15 of 44
Anonymous_fan
Aspirant

Re: WNR2000v4 keeps changing internal ip address

Hi Andy,

 

I do not know about Wireshark but Microsoft Network Monitor will not work on my computer. The reason for this is that I'm a Linux user and not a Windows user.

 

I can try to connect to my modem but I'm pretty sure that I'm getting the same addresses as the router would. I will try it anyway.

 

It is a shame that this system (the community forums) are so restricted but I can understand.

Message 16 of 44
Anonymous_fan
Aspirant

Re: WNR2000v4 keeps changing internal ip address


@Babylon5 wrote:

I can see your earlier posts now.

 

Well it looks like you have a couple of servers on your LAN, one listening at Port 80 (LAN IP 192.168.1.10) and the other listening at Port 8080 (LAN IP 192.168.1.7). Is this as you intend it?

 

By the way, that 115.231.222.14 address traces to China, is that familiar to you, are you running any equipment on you LAN e.g. IP cameras which might ‘phone home’?


 

I do have a few servers but not all run for the internet. The one's you see on port 80 and 8080 are a webapp for a friend and one for supporting my website with video's and pdf's saving traffic. I also got a server called Owncloud on port 15000 but when I'm home then it is turned off.

 

I do not have any family or friends in China. I also do not have any cams running. I have one webcam which is a USB attached cam. It is not connected so I really do not know who that is.

Message 17 of 44
Babylon5
NETGEAR Employee Retired

Re: WNR2000v4 keeps changing internal ip address

I probably wasn’t clear. The intention of monitoring network traffic between the modem and connected device wasn’t just to see what IP address is allocated to the attached PC, but to see if there’s any other background traffic which might trigger the router (when attached) into thinking there’s a conflicting subnet on the WAN side. So the idea would be to record traffic for a while, to see if any 192.168.1.x sourced data appears.

 

Do you have any comments on my post 14?

 

As Kenneth said, the plan/hope is to reduce the automatic actions of the forum and replace with human interaction, the forums will adapt as usage patterns become clearer.

Message 18 of 44
Anonymous_fan
Aspirant

Re: WNR2000v4 keeps changing internal ip address


@KennethL wrote:

@Anonymous_fan wrote:

...

Offtopic:

I was not trying to post an image. It was text and a log of my router. I exceeded the max characters (20.000), so posting logs is not allowed, I quess. Or it was to rapid since I had to do it in parts.


There is a Spam filter that reviews every postings.  Sometime with repeating patterns, it may think your logs to be Spam content and flags that post, moves into a spam quarantine and watches for further posting from that user.  A human would need to make additional decisions.    

 

We are increasing our monitoring to decrease this inconvenience.

 

Regards,

Kenneth


Hi Kenneth,

 

Thank you for answering this but I wonder when there are repeating patterns, like in my case in which I exceeded the maximum limit of posting characters. The spamfilter does not understand this or there can't be an exception for this?

Message 19 of 44
Anonymous_fan
Aspirant

Re: WNR2000v4 keeps changing internal ip address


@Babylon5 wrote:

I probably wasn’t clear. The intention of monitoring network traffic between the modem and connected device wasn’t just to see what IP address is allocated to the attached PC, but to see if there’s any other background traffic which might trigger the router (when attached) into thinking there’s a conflicting subnet on the WAN side. So the idea would be to record traffic for a while, to see if any 192.168.1.x sourced data appears.

 

Do you have any comments on my post 14?

 

As Kenneth said, the plan/hope is to reduce the automatic actions of the forum and replace with human interaction, the forums will adapt as usage patterns become clearer.


I understand and the servers are intended so the ports needs to be open.

 

I need to research network monitoring on Linux since I do not use windows (at all). It may take a moment but I will report back.

Message 20 of 44
Anonymous_fan
Aspirant

Re: WNR2000v4 keeps changing internal ip address

Hi Andy, I have Wireshark running on my computer. What would you have me look for and how long?
Message 21 of 44
Babylon5
NETGEAR Employee Retired

Re: WNR2000v4 keeps changing internal ip address

I'm not a Wireshark user, but would hope that you can set a filter to capture any traffic in the 192.168.1.x address range (I believe this is also the default LAN subnet for the WNR2000). As for how long, well I guess that a direct connection to the modem effectively kills the Internet for your LAN, so really as long as you can before it's too much grief (or you capture some data).

Message 22 of 44
Anonymous_fan
Aspirant

Re: WNR2000v4 keeps changing internal ip address


@Babylon5 wrote:

I'm not a Wireshark user, but would hope that you can set a filter to capture any traffic in the 192.168.1.x address range (I believe this is also the default LAN subnet for the WNR2000). As for how long, well I guess that a direct connection to the modem effectively kills the Internet for your LAN, so really as long as you can before it's too much grief (or you capture some data).


I have it running on eth0 (ethernet 0 / router) and it is catching all data received and sent. As for how long, it depends a little on how much data it will save (in size on the disk). So if I need to change a location (the system is installed on a SSD drive which has little room) in order to save more data.

 

The problem is that it's occurring randomly so I do not know when the next time is happening.

Message 23 of 44
Babylon5
NETGEAR Employee Retired

Re: WNR2000v4 keeps changing internal ip address

Fair enough, I do realise that it’s a disruptive thing to do and might therefore be impractical. I just wanted to try and satisfy my suspicion that the modem may on occasions generate messages on the 192.168.1.x subnet.
Message 24 of 44
Anonymous_fan
Aspirant

Re: WNR2000v4 keeps changing internal ip address

Hi Andy, I have a run from Wireshark for about 24 hours. This is the router run. How do I analyse it? I got a Wireshark file and a MS compatible file (.cap) This weekend I will try the modem. I'm away tomorrow so maybe I will have the results by sunday or monday.
Message 25 of 44
Top Contributors
Discussion stats
  • 43 replies
  • 17091 views
  • 0 kudos
  • 3 in conversation
Announcements

Orbi WiFi 7