Orbi WiFi 7 RBE973
Reply

Re: R7000 DHCP question

Java_man
Aspirant

R7000 DHCP question

I checked my R7000 log this morning and saw this:

"[LAN access from remote] from 192.144.226.157:26559 to 192.168.1.2:80, Tuesday, Jun 28,2022 03:33:38"

 

Reading through the logs I see multiple entries like this with different IP address all "to 192.168.1.2"

 

I have DHCP turned on and the range begins at 192.168.1.2.

 

I have a list of devices that are Allowed and 192.168.1.2 is not one them.

 

Is this a problem I should be concerned about?

Message 1 of 12
FURRYe38
Guru

Re: R7000 DHCP question

Do a who is lookup on 192.144.226.157

 

What FW version is currently loaded? 

What is the Mfr and model# of the Internet Service Providers modem/ONT the NG router is connected too?

Message 2 of 12
Java_man
Aspirant

Re: R7000 DHCP question

Thanks for the reply. 

 

Netgear FW: V1.0.9.88_10.2.88

 

I looked up a couple of the IPs and they were an ISP in England - pptechnology.

 

Modem: Motorola Surfboard SB6120 connected to Comcast.

 

Also noticed they're all connecting to  192.168.1.2:80 (port 80 - the HTTP port). 

Message 3 of 12
Java_man
Aspirant

Re: R7000 DHCP question

Gotta step out for a couple hours.  I'll check in when I get back.

 

Thanks again.

Message 4 of 12
FURRYe38
Guru

Re: R7000 DHCP question

What devices has the address 192.168.1.2? 

 

Message 5 of 12
Java_man
Aspirant

Re: R7000 DHCP question

I did a little more digging in the logs.  Here are a few examples:

 

[LAN access from remote] from 2.57.122.209:17773 to 192.168.1.2:80, Monday, Jun 27,2022 07:37:33 PPTECHNOLOGY LIMITED

 

[LAN access from remote] from 185.196.220.70:50551 to 192.168.1.2:80, Monday, Jun 27,2022 07:10:34 = HOSTLICK - Germany (AbuseIPDB: This IP was reported 1,076 times. Confidence of Abuse is 12%)

 

[LAN access from remote] from 221.176.116.78:20647 to 192.168.1.2:80, Monday, Jun 27,2022 07:09:36 = China Mobile Communications Corporation - ISP (AbuseIPDB: This IP was reported 663 times. Confidence of Abuse is 100%)

 

[LAN access from remote] from 154.89.5.87:58914 to 192.168.1.2:80, Monday, Jun 27,2022 06:39:43 = AgotoZ HK Limited (AbuseIPDB: This IP was reported 1,132 times. Confidence of Abuse is 100%)

 

[LAN access from remote] from 128.1.248.46:18057 to 192.168.1.2:80, Monday, Jun 27,2022 06:35:25 = Zenlayer Inc (AbuseIPDB: This IP was reported 14,921 times. Confidence of Abuse is 100%)

Message 6 of 12
Java_man
Aspirant

Re: R7000 DHCP question

That's just it. . . none of them.  I pinged the address and get no reply messages.

 

It's not listed in my "Connected Devices" page in the Netgear software either.

Message 7 of 12
FURRYe38
Guru

Re: R7000 DHCP question

Hmmm...

 

Message 8 of 12
FURRYe38
Guru

Re: R7000 DHCP question

Would be curious to see what happens if you set the default DHCP IP address range to 192.168.1.100 to.200.

 

Has a factory reset and setup from scratch been performed since you updated FW? 


Something would be using .2 I believe. What browser are you using? Try MS Edge or Firefox and see what's seen in Connected Devices. 

Message 9 of 12
Java_man
Aspirant

Re: R7000 DHCP question

Pinging 192.168.1.2 with 32 bytes of data
Reply from 192.168.1.100: Destination host unreachable.
Reply from 192.168.1.100: Destination host unreachable.
Reply from 192.168.1.100: Destination host unreachable.
Reply from 192.168.1.100: Destination host unreachable.

Ping statistics for 192.168.1.2:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),

Message 10 of 12
FURRYe38
Guru

Re: R7000 DHCP question

I would do this, turn OFF all devices accept for 1 wired PC. Change the Default DHCP IP address pool range as suggested. 

After you apply the change and the router reboot. Power OFF the ISP modem and router for 1 minute then back ON. 

I would leave all devices off accept for the 1 wired PC. 

Check the connected devices page on the router. You PC should be listed here. 

If it is, turn on 1 device. Let it connect, check the connected devices list again. If seen, check the log page for any LAN access entries. 

Graduate turning on devices one at a time and check the connected devices page. Take not of any device that doesn't appear on the page.

Check the log for any continue LAN access entries. 

Message 11 of 12
Java_man
Aspirant

Re: R7000 DHCP question

Earlier today I reset DHCP to begin range with 192.168.1.3.

 

I cleared the logs and will post when there are some entries.

 

[LAN access from remote] from 163.172.158.4:57501 to 192.168.1.2:80, Tuesday, Jun 28,2022 10:02:50

 

BUT, I just remembered I used to host a web server.  I searched some code that checked on the IP of the server and it was 192.168.1.2.  Took it offline years ago and it's not even connected. 

 

Thoughts?

 

Message 12 of 12
Top Contributors
Discussion stats
  • 11 replies
  • 1214 views
  • 0 kudos
  • 2 in conversation
Announcements

Orbi WiFi 7