Troubling messages in log: Dos Attack: DHCP leases changinging: Geofilter Changing.

[Mrbchambers]

Setup:- XR500, TP link N600 in bridge mode, Too many PC's game console to name here, though none of these are relevant. I have a VDSL2 connection to the house hence the TPlink.

All has been well with the modem and connection, no real issues. Until about 2 days ago; when the geo filter stopped working, and my internet seemed to be falling apart. I plugged in my ISP's router (BT Smart Hub), and the internet was working as expected with their router. So I plugged in the XR500 and it all went wrong again. I factory reset the router as discribed in several forums, both here and on Netduma forums. Thats when the messages started to appear, and (I know this may not be of a concern to you, but for completeness) the geo filter is doing things it hasnt done before eg: it keeps filtering when I put it in spectator mode; or delete the device. I will raise this when I get onto the Netduma site.

Please help, its becoming worrying.

[Netduma-Fraser]

DoS attacks are normal entries, they just show connections you've come into contact with. DHCP Lease changes are normal as well. What messages are you referring to? Could you provide a screenshot of the Geo-Filter filtering when it shouldn't please?

[Mrbchambers]

I did try to add a text file but it wouldn't let me. Also it should be noted it is the rate these messages are generated.

I don't know how to send you a screen shot of my friends not being able to get into the same game lobby/session as me. Though I must admit I haven't looked at the geofilter when they can't access my lobbies/sessions, I will look next time and post what I find.

Here is the log:- 

DumaOS] config write 'com.netdumsoftware.geofilter.settings', Tuesday, February 18, 2020 23:23:20
[DumaOS] config write 'com.netdumsoftware.geofilter.settings', Tuesday, February 18, 2020 23:23:20
[DumaOS] DHCP lease change., Tuesday, February 18, 2020 23:23:14
[DumaOS] DHCP new event., Tuesday, February 18, 2020 23:23:14
[DumaOS] DHCP lease change., Tuesday, February 18, 2020 23:22:41
[DumaOS] DHCP new event., Tuesday, February 18, 2020 23:22:41
[DumaOS] DHCP lease change., Tuesday, February 18, 2020 23:22:07
[DumaOS] DHCP new event., Tuesday, February 18, 2020 23:22:07
[DumaOS] DHCP lease change., Tuesday, February 18, 2020 23:21:34
[DumaOS] DHCP new event., Tuesday, February 18, 2020 23:21:34
[DumaOS] DHCP lease change., Tuesday, February 18, 2020 23:21:00
[DumaOS] DHCP new event., Tuesday, February 18, 2020 23:21:00
[DumaOS] DHCP lease change., Tuesday, February 18, 2020 23:20:26
[DumaOS] DHCP new event., Tuesday, February 18, 2020 23:20:26
[DumaOS] DHCP lease change., Tuesday, February 18, 2020 23:19:53
[DumaOS] DHCP new event., Tuesday, February 18, 2020 23:19:53
[DumaOS] DHCP lease change., Tuesday, February 18, 2020 23:19:19
[DumaOS] DHCP new event., Tuesday, February 18, 2020 23:19:19
[DumaOS] DHCP lease change., Tuesday, February 18, 2020 23:19:17
[DumaOS] DHCP new event., Tuesday, February 18, 2020 23:19:17
[DumaOS] DHCP lease change., Tuesday, February 18, 2020 23:18:47
[DumaOS] DHCP new event., Tuesday, February 18, 2020 23:18:47
[DumaOS] DHCP lease change., Tuesday, February 18, 2020 23:18:13
[DumaOS] DHCP new event., Tuesday, February 18, 2020 23:18:13
[DumaOS] DHCP lease change., Tuesday, February 18, 2020 23:17:40
[DumaOS] DHCP new event., Tuesday, February 18, 2020 23:17:40
[DumaOS] DHCP lease change., Tuesday, February 18, 2020 23:17:06
[DumaOS] DHCP new event., Tuesday, February 18, 2020 23:17:06
[DumaOS] DHCP lease change., Tuesday, February 18, 2020 23:16:32
[DumaOS] DHCP new event., Tuesday, February 18, 2020 23:16:32
[DumaOS] DHCP lease change., Tuesday, February 18, 2020 23:15:58
[DumaOS] DHCP new event., Tuesday, February 18, 2020 23:15:58
[DumaOS] DHCP lease change., Tuesday, February 18, 2020 23:15:49
[DumaOS] DHCP new event., Tuesday, February 18, 2020 23:15:49
[DumaOS] DHCP lease change., Tuesday, February 18, 2020 23:15:25
[DumaOS] DHCP new event., Tuesday, February 18, 2020 23:15:25
[DumaOS] DHCP lease change., Tuesday, February 18, 2020 23:14:51
[DumaOS] DHCP new event., Tuesday, February 18, 2020 23:14:51
[DumaOS] DHCP lease change., Tuesday, February 18, 2020 23:14:17
[DumaOS] DHCP new event., Tuesday, February 18, 2020 23:14:17
[DumaOS] DHCP lease change., Tuesday, February 18, 2020 23:13:44
[DumaOS] DHCP new event., Tuesday, February 18, 2020 23:13:44
[DumaOS] DHCP lease change., Tuesday, February 18, 2020 23:13:10
[DumaOS] DHCP new event., Tuesday, February 18, 2020 23:13:10
[DumaOS] DHCP lease change., Tuesday, February 18, 2020 23:12:36
[DumaOS] DHCP new event., Tuesday, February 18, 2020 23:12:36
[DumaOS] DHCP lease change., Tuesday, February 18, 2020 23:12:02
[DumaOS] DHCP new event., Tuesday, February 18, 2020 23:12:02
[DumaOS] DHCP lease change., Tuesday, February 18, 2020 23:11:29
[DumaOS] DHCP new event., Tuesday, February 18, 2020 23:11:29
[DumaOS] DHCP lease change., Tuesday, February 18, 2020 23:10:55
[DumaOS] DHCP new event., Tuesday, February 18, 2020 23:10:55
[DumaOS] DHCP lease change., Tuesday, February 18, 2020 23:10:21
[DumaOS] DHCP new event., Tuesday, February 18, 2020 23:10:21
[DumaOS] DHCP lease change., Tuesday, February 18, 2020 23:09:48
[DumaOS] DHCP new event., Tuesday, February 18, 2020 23:09:48
[DumaOS] DHCP lease change., Tuesday, February 18, 2020 23:09:14
[DumaOS] DHCP new event., Tuesday, February 18, 2020 23:09:14
[DumaOS] DHCP lease change., Tuesday, February 18, 2020 23:08:41
[DumaOS] DHCP new event., Tuesday, February 18, 2020 23:08:41
[DumaOS] DHCP lease change., Tuesday, February 18, 2020 23:08:08
[DumaOS] DHCP new event., Tuesday, February 18, 2020 23:08:08
[DumaOS] DHCP lease change., Tuesday, February 18, 2020 23:07:34
[DumaOS] DHCP new event., Tuesday, February 18, 2020 23:07:34
[DumaOS] DHCP lease change., Tuesday, February 18, 2020 23:07:01
[DumaOS] DHCP new event., Tuesday, February 18, 2020 23:07:01
[DumaOS] DHCP lease change., Tuesday, February 18, 2020 23:06:27
[DumaOS] DHCP new event., Tuesday, February 18, 2020 23:06:27
[DumaOS] DHCP lease change., Tuesday, February 18, 2020 23:05:54
[DumaOS] DHCP new event., Tuesday, February 18, 2020 23:05:54
[DumaOS] DHCP lease change., Tuesday, February 18, 2020 23:05:20
[DumaOS] DHCP new event., Tuesday, February 18, 2020 23:05:20
[DumaOS] DHCP lease change., Tuesday, February 18, 2020 23:04:47
[DumaOS] DHCP new event., Tuesday, February 18, 2020 23:04:47
[DumaOS] DHCP lease change., Tuesday, February 18, 2020 23:04:12
[DumaOS] DHCP new event., Tuesday, February 18, 2020 23:04:12
[DumaOS] DHCP lease change., Tuesday, February 18, 2020 23:03:37
[DumaOS] DHCP new event., Tuesday, February 18, 2020 23:03:37
[DumaOS] DHCP lease change., Tuesday, February 18, 2020 23:03:03
[DumaOS] DHCP new event., Tuesday, February 18, 2020 23:03:03
[DumaOS] DHCP lease change., Tuesday, February 18, 2020 23:02:30
[DumaOS] DHCP new event., Tuesday, February 18, 2020 23:02:30
[DumaOS] DHCP lease change., Tuesday, February 18, 2020 23:01:56
[DumaOS] DHCP new event., Tuesday, February 18, 2020 23:01:56
[DumaOS] DHCP lease change., Tuesday, February 18, 2020 23:01:38
[DumaOS] DHCP new event., Tuesday, February 18, 2020 23:01:38
[DumaOS] DHCP lease change., Tuesday, February 18, 2020 23:01:22
[DumaOS] DHCP new event., Tuesday, February 18, 2020 23:01:22
[DumaOS] DHCP lease change., Tuesday, February 18, 2020 23:00:49
[DumaOS] DHCP new event., Tuesday, February 18, 2020 23:00:49
[DumaOS] DHCP lease change., Tuesday, February 18, 2020 23:00:16
[DumaOS] DHCP new event., Tuesday, February 18, 2020 23:00:16
[DumaOS] DHCP lease change., Tuesday, February 18, 2020 22:59:42
[DumaOS] DHCP new event., Tuesday, February 18, 2020 22:59:42
[DumaOS] DHCP lease change., Tuesday, February 18, 2020 22:59:09
[DumaOS] DHCP new event., Tuesday, February 18, 2020 22:59:09
[DoS Attack: ACK Scan] from source: 94.136.40.162, port 993, Tuesday, February 18, 2020 22:58:58
[DoS Attack: ACK Scan] from source: 94.136.40.162, port 993, Tuesday, February 18, 2020 22:58:58
[DoS Attack: ACK Scan] from source: 94.136.40.162, port 993, Tuesday, February 18, 2020 22:58:58
[DoS Attack: ACK Scan] from source: 94.136.40.162, port 993, Tuesday, February 18, 2020 22:58:57
[DumaOS] DHCP lease change., Tuesday, February 18, 2020 22:58:35
[DumaOS] DHCP new event., Tuesday, February 18, 2020 22:58:35
[DoS Attack: ACK Scan] from source: 3.86.138.203, port 443, Tuesday, February 18, 2020 22:58:24
[DoS Attack: ACK Scan] from source: 94.136.40.162, port 993, Tuesday, February 18, 2020 22:58:09
[DoS Attack: ACK Scan] from source: 3.86.138.203, port 443, Tuesday, February 18, 2020 22:58:09
[DoS Attack: ACK Scan] from source: 94.136.40.162, port 993, Tuesday, February 18, 2020 22:58:08
[DumaOS] DHCP lease change., Tuesday, February 18, 2020 22:58:02
[DumaOS] DHCP new event., Tuesday, February 18, 2020 22:58:02
[DoS Attack: ACK Scan] from source: 94.136.40.162, port 993, Tuesday, February 18, 2020 22:57:58
[DoS Attack: ACK Scan] from source: 94.136.40.162, port 993, Tuesday, February 18, 2020 22:57:58
[DoS Attack: ACK Scan] from source: 17.248.144.236, port 443, Tuesday, February 18, 2020 22:57:56
[DoS Attack: ACK Scan] from source: 17.248.144.176, port 443, Tuesday, February 18, 2020 22:57:55
[DoS Attack: ACK Scan] from source: 17.248.144.208, port 443, Tuesday, February 18, 2020 22:57:54
[DoS Attack: ACK Scan] from source: 3.86.138.203, port 443, Tuesday, February 18, 2020 22:57:54
[DoS Attack: ACK Scan] from source: 3.86.138.203, port 443, Tuesday, February 18, 2020 22:57:39
[DoS Attack: ACK Scan] from source: 17.248.144.236, port 443, Tuesday, February 18, 2020 22:57:39
[DumaOS] DHCP lease change., Tuesday, February 18, 2020 22:57:28
[DumaOS] DHCP new event., Tuesday, February 18, 2020 22:57:28
[DoS Attack: ACK Scan] from source: 3.86.138.203, port 443, Tuesday, February 18, 2020 22:57:24
[DoS Attack: ACK Scan] from source: 3.86.138.203, port 443, Tuesday, February 18, 2020 22:57:09
[DoS Attack: ACK Scan] from source: 94.136.40.162, port 993, Tuesday, February 18, 2020 22:57:05
[DoS Attack: ACK Scan] from source: 94.136.40.162, port 993, Tuesday, February 18, 2020 22:57:04
[DoS Attack: ACK Scan] from source: 94.136.40.162, port 993, Tuesday, February 18, 2020 22:56:58
[DoS Attack: ACK Scan] from source: 94.136.40.162, port 993, Tuesday, February 18, 2020 22:56:58
[DumaOS] DHCP lease change., Tuesday, February 18, 2020 22:56:55
[DumaOS] DHCP new event., Tuesday, February 18, 2020 22:56:55
[DoS Attack: ACK Scan] from source: 3.86.138.203, port 443, Tuesday, February 18, 2020 22:56:54
[DoS Attack: ACK Scan] from source: 3.86.138.203, port 443, Tuesday, February 18, 2020 22:56:39
[DoS Attack: ACK Scan] from source: 3.86.138.203, port 443, Tuesday, February 18, 2020 22:56:24
[DumaOS] DHCP lease change., Tuesday, February 18, 2020 22:56:22
[DumaOS] DHCP new event., Tuesday, February 18, 2020 22:56:22
[DoS Attack: ACK Scan] from source: 3.86.138.203, port 443, Tuesday, February 18, 2020 22:56:09
[DoS Attack: ACK Scan] from source: 94.136.40.162, port 993, Tuesday, February 18, 2020 22:56:01
[DoS Attack: ACK Scan] from source: 94.136.40.162, port 993, Tuesday, February 18, 2020 22:56:00
[DoS Attack: ACK Scan] from source: 17.248.144.236, port 443, Tuesday, February 18, 2020 22:55:59
[DoS Attack: ACK Scan] from source: 17.248.144.211, port 443, Tuesday, February 18, 2020 22:55:52
[DumaOS] DHCP lease change., Tuesday, February 18, 2020 22:55:48
[DumaOS] DHCP new event., Tuesday, February 18, 2020 22:55:48
[DumaOS] DHCP lease change., Tuesday, February 18, 2020 22:55:15
[DumaOS] DHCP new event., Tuesday, February 18, 2020 22:55:15
[DoS Attack: ACK Scan] from source: 17.248.144.236, port 443, Tuesday, February 18, 2020 22:54:57
[DoS Attack: ACK Scan] from source: 17.248.144.211, port 443, Tuesday, February 18, 2020 22:54:54

[Netduma-Fraser]

The screenshots or even a small video would be really helpful in determining what the cause may be so if possible I'd appreciate it. The changes are very frequent, how many devices do you have connected to the router? Are the lease changes causing disconnects at all?

[Mrbchambers]

What is this new message? The one starting "Error parsing line in ARP table:......" There are a number of these in the log, and when these happend, I was removed from my game world and couldn' connect to the internet.

something has happened to this router, and I dont know what, you keep telling me that messages in logs are usual, even though they dont appear to tell what is happening. What should I be looking for?

Please help!

[DumaOS] DHCP new event., Sunday, February 23, 2020 18:28:55
[DumaOS] DHCP lease change., Sunday, February 23, 2020 18:28:22
[DumaOS] DHCP new event., Sunday, February 23, 2020 18:28:22
[DumaOS] Error parsing line in ARP table: 'fe80::c883:62ff:fed9:8622 dev brwan lladdr ec:08:6b:e3:01:ee router STALE', Sunday, F

[Mrbchambers]

Sorry only just seen message (4) I have a number of devices attached, and strangely devices like servers seem to latch on too, like amazon 9D50 (see attached file), nothing in the area or property with that network name.

[Netduma-Fraser]

As far as I am aware it just means it had trouble identifying a device but it will retry using another method, it can happen a lot of the time. Usually you wouldn't notice backend processes but the log is verbose. You would notice if something in the log was of concern as it would be a big error message and you would see the same on the interface. You don't need to look at the log yourself to determine if there is an issue. Did it happen to all devices or just that device? It may have been the lease change event. I'd double check your WiFi is secure and remote access is disabled.

[Mrbchambers]

It happened to all devices at the same time. 

I can confirm that my wifi is secure, and internet access is off (see attached file). I routinely change my wifi password (this is a throwback from working in the nuclear industry). 

There are so many things happening, when I got the "Error parsing line in ARP table:" table, I was playing GTAV, I was placed in a new lobby, I was kicked out the chat party I was in on the PS4, I had to reset the PS4 to get back into the chat party, when I loaded back into GTAV I still couldnt connect to anyone, I had to load a new device in the geo filter, the device is in filtering mode when it appears, I then had to knock the filter off by going into spectating mode, and toggle access to my friends. There is something really strange going on. My GTA friends think this is brilliant, because I end up in so many solo public lobbies.

[Netduma-Fraser]

With BT you're using PPPoE is that correct? Is the XR500 handling this?

[Mrbchambers]

The XR500 is using PPPoE to connect to BT via a tp-link n600 in bridge mode. This was the only way I could connect without double Nat issues, and originally, there were no spurious log messages.

Is there a better way?

[Netduma-Fraser]

Remove the PPPoE details from the XR and disable the bridge mode on the N600. Have the N600 handle PPPoE instead then turn of its WiFi and put the XR500 WAN IP (found in System Information) into the DMZ of the N600. That will resolve the double NAT issue. Then see if the issues you've been seeing have been resolved back on the XR. I'd give it a reboot after setting this all up just to be sure it applies properly.