Hi all, newbie here. I would first of like to say hello to all.
I would consider myself quite tech-literate, I picked up the XR500 gaming router last week after weeks of rage with the poor quality connection to servers. From the first gunfight I got into I could already see the difference.
However, my ISP (VM) has been going nuts all night and constantly been booted off. I was going through the logs and have noticed a number of dos/scan attacks of my network. Usually I would ignore these. However, I had two such attacks within an hour of each other from the same IP address.
2 from this IP
<151.80.36.90> France
And 3 from the same IP
<62.253.90.133> Edinburgh (VM) doing an ACK scan?
And also 6 from this IP
<69.171.250.20> West Chester, Pennyslvania, USA.
Any help would be greatly appreciated.
I have also noticed other strange going ons such as renewing my DHCP multiple times. I will include the logs here.
[DumaOS] config write 'com.netdumsoftware.geofilter.settings', Monday, April 27, 2020 20:39:14 [DumaOS] config write 'com.netdumsoftware.geofilter.settings', Monday, April 27, 2020 20:39:14 [UPnP set event: del_nat_rule] from source (HIDDEN), Monday, April 27, 2020 20:34:48 [DumaOS] applying qos for zone lan, Monday, April 27, 2020 20:32:53 [DumaOS] applying qos for zone wan, Monday, April 27, 2020 20:32:51 [DumaOS] applying qos for zone lan, Monday, April 27, 2020 20:32:40 [DumaOS] applying qos for zone wan, Monday, April 27, 2020 20:32:38 [UPnP set event: add_nat_rule] from source (HIDDEN), Monday, April 27, 2020 20:31:48 [DumaOS] applying qos for zone lan, Monday, April 27, 2020 20:31:16 [DumaOS] applying qos for zone wan, Monday, April 27, 2020 20:31:14 [DumaOS] applying qos for zone lan, Monday, April 27, 2020 20:31:03 [DumaOS] applying qos for zone wan, Monday, April 27, 2020 20:31:01 [DumaOS] R-App store cloud sync failed, Monday, April 27, 2020 20:29:38 [DumaOS] HTTP download failed with code '404', Monday, April 27, 2020 20:29:38 [DumaOS] Resync R-App store cloud, Monday, April 27, 2020 20:29:38 [DumaOS] Cloudsync DPI result 'false','All mirrors are down', Monday, April 27, 2020 20:29:36 [DumaOS] Cloudsync Themes result 'false','All mirrors are down', Monday, April 27, 2020 20:29:32 [DumaOS] applying qos for zone lan, Monday, April 27, 2020 20:27:58 [DumaOS] applying qos for zone wan, Monday, April 27, 2020 20:27:56 [admin login] from source (HIDDEN), Monday, April 27, 2020 20:20:50 [DumaOS] DHCP new lease allocated., Monday, April 27, 2020 20:20:30 [DumaOS] DHCP new event., Monday, April 27, 2020 20:20:30 [DHCP IP: (HIDDEN) to MAC address (HIDDEN), Monday, April 27, 2020 20:20:30 [DumaOS] applying qos for zone lan, Monday, April 27, 2020 20:18:59 [DumaOS] applying qos for zone wan, Monday, April 27, 2020 20:18:58 [UPnP set event: del_nat_rule] from source (HIDDEN), Monday, April 27, 2020 20:18:04 [DoS Attack: SYN/ACK Scan] from source: 151.80.36.90, port 80, Monday, April 27, 2020 20:10:15 [DoS Attack: SYN/ACK Scan] from source: 151.80.36.90, port 80, Monday, April 27, 2020 19:09:45 [DumaOS] applying qos for zone lan, Monday, April 27, 2020 18:28:36 [DumaOS] applying qos for zone wan, Monday, April 27, 2020 18:28:35 [DumaOS] applying qos for zone lan, Monday, April 27, 2020 18:21:19 [DumaOS] applying qos for zone wan, Monday, April 27, 2020 18:21:18 [DumaOS] DHCP lease change., Monday, April 27, 2020 18:20:41 [DumaOS] DHCP new event., Monday, April 27, 2020 18:20:41 [DHCP IP: (HIDDEN)to MAC address (HIDDEN), Monday, April 27, 2020 18:20:41 [UPnP set event: add_nat_rule] from source (HIDDEN), Monday, April 27, 2020 18:20:26 [UPnP set event: del_nat_rule] from source (HIDDEN), Monday, April 27, 2020 18:20:24 [UPnP set event: add_nat_rule] from source HIDDEN), Monday, April 27, 2020 18:20:06 [UPnP set event: del_nat_rule] from source HIDDEN), Monday, April 27, 2020 18:19:59 [DumaOS] DHCP lease change., Monday, April 27, 2020 18:13:38 [DumaOS] DHCP new event., Monday, April 27, 2020 18:13:38 [DHCP IP: (HIDDEN)] to MAC address (HIDDEN), Monday, April 27, 2020 18:13:38 [DumaOS] DHCP lease change., Monday, April 27, 2020 18:09:01 [DumaOS] DHCP new event., Monday, April 27, 2020 18:09:01 [DHCP IP: (HIDDEN)] to MAC address (HIDDEN), Monday, April 27, 2020 18:09:01 [DumaOS] DHCP lease change., Monday, April 27, 2020 18:02:22 [DumaOS] DHCP new event., Monday, April 27, 2020 18:02:22 [DHCP IP: (HIDDEN)] to MAC address (HIDDEN), Monday, April 27, 2020 18:02:22 [DumaOS] DHCP lease change., Monday, April 27, 2020 18:01:37 [DumaOS] DHCP new event., Monday, April 27, 2020 18:01:37 [DHCP IP: (HIDDEN) to MAC address (HIDDEN), Monday, April 27, 2020 18:01:37 [DumaOS] DHCP lease change., Monday, April 27, 2020 18:00:34 [DumaOS] DHCP new event., Monday, April 27, 2020 18:00:34 [DHCP IP: (HIDDEN) to MAC address (HIDDEN), Monday, April 27, 2020 18:00:34 [DumaOS] DHCP lease change., Monday, April 27, 2020 17:54:50 [DumaOS] DHCP new event., Monday, April 27, 2020 17:54:50 [DHCP IP: (HIDDEN) to MAC address (HIDDEN), Monday, April 27, 2020 17:54:50 [DumaOS] DHCP lease change., Monday, April 27, 2020 17:54:01 [DumaOS] DHCP new event., Monday, April 27, 2020 17:54:01 [DHCP IP: (HIDDEN) to MAC address (HIDDEN), Monday, April 27, 2020 17:54:01 [DoS Attack: SYN/ACK Scan] from source: 51.144.95.101, port 8024, Monday, April 27, 2020 17:42:36 [DoS Attack: SYN/ACK Scan] from source: 104.149.141.14, port 80, Monday, April 27, 2020 17:38:02 [DumaOS] applying qos for zone lan, Monday, April 27, 2020 17:30:49 [DumaOS] applying qos for zone wan, Monday, April 27, 2020 17:30:48 [DumaOS] DHCP lease change., Monday, April 27, 2020 17:24:27 [DumaOS] DHCP new event., Monday, April 27, 2020 17:24:27 [DHCP IP: (HIDDEN)] to MAC address (HIDDEN), Monday, April 27, 2020 17:24:27 [DumaOS] DHCP lease change., Monday, April 27, 2020 17:19:33 [DumaOS] DHCP new event., Monday, April 27, 2020 17:19:33 [DHCP IP: (HIDDEN) to MAC address (HIDDEN), Monday, April 27, 2020 17:19:33 [DumaOS] applying qos for zone lan, Monday, April 27, 2020 17:19:30 [DumaOS] applying qos for zone wan, Monday, April 27, 2020 17:19:28 [DoS Attack: ACK Scan] from source: 62.253.90.133, port 443, Monday, April 27, 2020 17:07:03 [DoS Attack: ACK Scan] from source: 62.253.90.133, port 443, Monday, April 27, 2020 17:02:03 [DoS Attack: ACK Scan] from source: 62.253.90.133, port 443, Monday, April 27, 2020 16:57:03 [DumaOS] applying qos for zone lan, Monday, April 27, 2020 16:45:31 [DumaOS] applying qos for zone wan, Monday, April 27, 2020 16:45:29 [DumaOS] DHCP lease change., Monday, April 27, 2020 16:45:25 [DumaOS] DHCP new event., Monday, April 27, 2020 16:45:25 [DHCP IP: (HIDDEN) to MAC address (HIDDEN), Monday, April 27, 2020 16:45:25 [DumaOS] applying qos for zone lan, Monday, April 27, 2020 16:44:57 [DumaOS] applying qos for zone wan, Monday, April 27, 2020 16:44:56 [DumaOS] Error parsing line in ARP table: '(HIDDEN) dev br0 lladdr 2c:cc:44:41:90:80 STALE', Monday, April 27, [UPnP set event: add_nat_rule] from source (HIDDEN) Monday, April 27, 2020 16:43:56 [DumaOS] DHCP lease change., Monday, April 27, 2020 16:43:53 [DumaOS] DHCP new event., Monday, April 27, 2020 16:43:53 [DHCP IP: (HIDDEN) to MAC address (HIDDEN), Monday, April 27, 2020 16:43:53 [UPnP set event: add_nat_rule] from source (HIDDEN) Monday, April 27, 2020 16:41:54 [DoS Attack: ACK Scan] from source: 69.171.250.20, port 443, Monday, April 27, 2020 16:41:41 [DumaOS] applying qos for zone lan, Monday, April 27, 2020 16:40:42 [DumaOS] applying qos for zone wan, Monday, April 27, 2020 16:40:40 [DumaOS] DHCP lease change., Monday, April 27, 2020 16:40:30 [DumaOS] DHCP new event., Monday, April 27, 2020 16:40:30 [DHCP IP: (HIDDEN) to MAC address (HIDDEN), Monday, April 27, 2020 16:40:30 [DumaOS] DHCP new lease allocated., Monday, April 27, 2020 16:40:30 [DumaOS] DHCP new event., Monday, April 27, 2020 16:40:30 [DHCP IP: (HIDDEN)] to MAC address (HIDDEN), Monday, April 27, 2020 16:40:30 [DoS Attack: ACK Scan] from source: 69.171.250.20, port 443, Monday, April 27, 2020 16:39:39 [DoS Attack: ACK Scan] from source: 69.171.250.20, port 443, Monday, April 27, 2020 16:37:36 [DumaOS] DHCP new lease allocated., Monday, April 27, 2020 16:37:32 [DumaOS] DHCP new event., Monday, April 27, 2020 16:37:32 [DHCP IP: (HIDDEN)] to MAC address (HIDDEN) Monday, April 27, 2020 16:37:32 [DoS Attack: ACK Scan] from source: 69.171.250.20, port 443, Monday, April 27, 2020 16:35:33 [DoS Attack: ACK Scan] from source: 69.171.250.20, port 443, Monday, April 27, 2020 16:33:30 [DoS Attack: ACK Scan] from source: 69.171.250.20, port 443, Monday, April 27, 2020 16:31:27 [DumaOS] DHCP new lease allocated., Monday, April 27, 2020 16:30:18 [DumaOS] DHCP new event., Monday, April 27, 2020 16:30:18 [DHCP IP: (HIDDEN) to MAC address (HIDDEN), Monday, April 27, 2020 16:30:18 [Time synchronized with NTP server] Monday, April 27, 2020 16:30:11
Regarding the DoS attacks they are just connections you have come in contact with and so wouldn't give you any issues. Regarding the DHCP lease entries, unless devices are disconnecting that match those entries then it's fine. All the rest of the logs are fine. When you've encountered the issues you mentioned, do you get them when connecting to the Virgin Hub as well?
Hi Fraser, I haven't checked my VM router logs purely as I put it into modem mode last week when I got my router. I never used to bother with my logs at all anyway as my net was always running fine, I assume.
Was just checking my QoS and having a nosey round the logs, settings etc.
You mentioned the DoS attacks as nothing to worry about, why would the same IP be logged 6 times? Found that weird.
There was the whole drama of the outage last night so was wondering if maybe the DCHP dropping me would have any correlation to this?
If it happens again unplug the router from the VM and plug in your PC and see if it is present there. It could be something like Google or something you access or is connected to in the background frequently. That's definitely possible yes, lets rule out ISP issues first.
To be fair there are a lot of devices in the house.
3 x iPhones
2 x PS4
1 x iPad
1 x MacBook
1 x Alexa
1 x PC (not connected yet)
1 x nVidia Shield
Probably more that I have forgotten about.
Another question if I may, Fraser. I was playing a game of Warzone and have my Geo-Filter set to 500 miles, last couple of games I've had high ping 70+. Done a quick check and seen that I was connected to Atlanta (USA). I thought that this router would nullify this from happening? Or could I have my settings messed up?
It's possible that the server was mislocated on the map, we have to constantly keep the IP database up to date so sometimes you'll see servers misplaced. If you could provide a screenshot of the Geo-Filter page when this happens with the ping panel I can further advise.
I'll do my best, but thats another game, where my ping is all over the place, check and its in the USA. Getting to the point I think i've wasted my money. Bought this to help at least control things from my end. Doesn't help that i'm being bumped all over the place. Latest IP <24.105.54.162>
@Netduma-Fraser wrote: It's possible that the server was mislocated on the map, we have to constantly keep the IP database up to date so sometimes you'll see servers misplaced. If you could provide a screenshot of the Geo-Filter page when this happens with the ping panel I can further advise.
That first IP looks like it might actually be an authentication server, were there any other icons on the map as well as that one? The second one I'm getting France which looks like it could just about be inside your radius. Just to clarify, it was just your console online when doing this PingPlotter test? Could you repeat the test but with nothing on the internet please as it's looking like you have a high base ping as well as packet loss which would be contributing to your issue.
@Netduma-Fraser wrote: That first IP looks like it might actually be an authentication server, were there any other icons on the map as well as that one? The second one I'm getting France which looks like it could just about be inside your radius. Just to clarify, it was just your console online when doing this PingPlotter test? Could you repeat the test but with nothing on the internet please as it's looking like you have a high base ping as well as packet loss which would be contributing to your issue.
As far as I remember there was a box in America and a triangle in maybe Holland/Belgium. I have my radius to 450 miles. I'm in Glasgow so only wanted UK and Ireland servers this is what is frustrating me so much. I'll do another Ping Plotter tonight when the wee man is off-line.
I had another look at my logs again...i've only included 1 but there was more below this.
Okay so probably the US server was authentication and the Holland server was the attempted game server. That sounds normal so far in that it was blocked because it was outside your radius. I assume that US server has a solid white circle around it? That log entry is normal, just means you've come in contact with that IP address.
Ah ok, so how can I tell what server i'm joining, it all looks like the US but you have a valid point with the authentication server. Is there any websites that will give me the server that i'm connecting to. I can't remember off the top of my head, I'm going to say no until I see it again as I can't be sure.
The server you're connected to should be the biggest icon on the map. If you could provide a screenshot of the whole Geo-Filter Map when you're in a game I can let you know what is happening so you know what to look out for. Auto Ping will show you the ping/IP but not specifically it's location as should be correct on the map the majority of the time.
Okay so it will be the biggest icon there, the one to the south of the UK. It will be the one that Auto Ping has pinged as well so looks to be working well there.
Unless you didn't have QoS configured/there were a lot of devices using the internet on your side then it may be that particular server that is under heavy load. There are usually many servers clustered in one location so just because that one may not play well doesn't mean others in that same location will also be bad.
