R7000 - Very frequent disconnects and Self2WAN ICMP type b Detected
Nighthawk R7000
Firmware Version V1.0.9.88_10.2.88
We have been having recent problems with the internet going up and down like a yoyo. I can see in the router logs lots of connections, and disconnects. And frequently one or more "Self2WAN ICMP type b Detected" right after.
[Internet connected] IP address: XX.XX.XX.XX, Friday, Nov 13,2020 10:05:39 [Self2WAN ICMP type b Detected!] To prevent from revealing router's activity, this packet is droppe Friday, Nov 13,2020 10:00:59 [Time synchronized with NTP server] Friday, Nov 13,2020 10:00:39 [Internet connected] IP address: XX.XX.XX.XX, Friday, Nov 13,2020 10:00:39 [Internet disconnected] Friday, Nov 13,2020 10:00:35 [Internet connected] IP address: 192.168.254.10, Friday, Nov 13,2020 10:00:21 [Internet connected] IP address: 192.168.254.10, Friday, Nov 13,2020 10:00:06 [Internet connected] IP address: 192.168.254.10, Friday, Nov 13,2020 09:59:50 [Internet connected] IP address: 192.168.254.10, Friday, Nov 13,2020 09:59:35 [Internet connected] IP address: 192.168.254.10, Friday, Nov 13,2020 09:59:20 [DHCP IP: (192.168.1.6)] to MAC address 58:82:A8:4B:0C:5E, Friday, Nov 13,2020 09:59:14 [Internet connected] IP address: 192.168.254.10, Friday, Nov 13,2020 09:59:05 [Internet connected] IP address: 192.168.254.10, Friday, Nov 13,2020 09:58:50 [Internet connected] IP address: 192.168.254.10, Friday, Nov 13,2020 09:58:35 [Internet connected] IP address: 192.168.254.10, Friday, Nov 13,2020 09:58:19 [Internet connected] IP address: 192.168.254.10, Friday, Nov 13,2020 09:58:05 [Internet disconnected] Friday, Nov 13,2020 09:57:54 [Internet connected] IP address: XX.XX.XX.XX, Friday, Nov 13,2020 09:57:18 [DHCP IP: (192.168.1.20)] to MAC address 98:01:A7:9A:E7:CB, Friday, Nov 13,2020 09:56:11 [Time synchronized with NTP server] Friday, Nov 13,2020 09:52:18 [Internet connected] IP address: XX.XX.XX.XX, Friday, Nov 13,2020 09:52:18 [Admin login] from source 192.168.1.12, Friday, Nov 13,2020 09:51:18 [Admin login] from source 192.168.1.12, Friday, Nov 13,2020 09:51:03 [Time synchronized with NTP server] Friday, Nov 13,2020 09:47:18 [Internet connected] IP address: XX.XX.XX.XX, Friday, Nov 13,2020 09:47:17 [DHCP IP: (192.168.1.2)] to MAC address D4:12:43:D2:18:FA, Friday, Nov 13,2020 09:43:51 [Self2WAN ICMP type b Detected!] To prevent from revealing router's activity, this packet is droppe Friday, Nov 13,2020 09:43:03 [Self2WAN ICMP type b Detected!] To prevent from revealing router's activity, this packet is droppe Friday, Nov 13,2020 09:42:47 [Self2WAN ICMP type b Detected!] To prevent from revealing router's activity, this packet is droppe Friday, Nov 13,2020 09:42:31 [Self2WAN ICMP type b Detected!] To prevent from revealing router's activity, this packet is droppe Friday, Nov 13,2020 09:42:19 [Time synchronized with NTP server] Friday, Nov 13,2020 09:42:19 [Self2WAN ICMP type b Detected!] To prevent from revealing router's activity, this packet is droppe Friday, Nov 13,2020 09:42:18 [Internet connected] IP address: XX.XX.XX.XX, Friday, Nov 13,2020 09:42:18 [Internet disconnected] Friday, Nov 13,2020 09:42:14 [Internet connected] IP address: 192.168.254.10, Friday, Nov 13,2020 09:41:54 [Internet connected] IP address: 192.168.254.10, Friday, Nov 13,2020 09:41:39 [Internet connected] IP address: 192.168.254.10, Friday, Nov 13,2020 09:41:25 [Internet connected] IP address: 192.168.254.10, Friday, Nov 13,2020 09:41:10 [Internet connected] IP address: 192.168.254.10, Friday, Nov 13,2020 09:40:55 [Internet connected] IP address: 192.168.254.10, Friday, Nov 13,2020 09:40:40 [Internet connected] IP address: 192.168.254.10, Friday, Nov 13,2020 09:40:25 [Internet connected] IP address: 192.168.254.10, Friday, Nov 13,2020 09:40:10 [Internet connected] IP address: 192.168.254.10, Friday, Nov 13,2020 09:39:55 [Internet connected] IP address: 192.168.254.10, Friday, Nov 13,2020 09:39:41 [Internet disconnected] Friday, Nov 13,2020 09:39:29
Even in places where there is no disconnect I see connects every 5 minutes:
[Time synchronized with NTP server] Friday, Nov 13,2020 09:05:14 [Internet connected] IP address: XX.XX.XX.XX, Friday, Nov 13,2020 09:05:14 [Time synchronized with NTP server] Friday, Nov 13,2020 09:00:14 [Internet connected] IP address: XX.XX.XX.XX, Friday, Nov 13,2020 09:00:14 [Time synchronized with NTP server] Friday, Nov 13,2020 08:55:14 [Internet connected] IP address: XX.XX.XX.XX, Friday, Nov 13,2020 08:55:13 [Time synchronized with NTP server] Friday, Nov 13,2020 08:50:14 [Internet connected] IP address: XX.XX.XX.XX, Friday, Nov 13,2020 08:50:14 [Time synchronized with NTP server] Friday, Nov 13,2020 08:45:14 [Internet connected] IP address: XX.XX.XX.XX, Friday, Nov 13,2020 08:45:13 [Time synchronized with NTP server] Friday, Nov 13,2020 08:40:14 [Internet connected] IP address: XX.XX.XX.XX, Friday, Nov 13,2020 08:40:14 [Time synchronized with NTP server] Friday, Nov 13,2020 08:35:14 [Internet connected] IP address: XX.XX.XX.XX, Friday, Nov 13,2020 08:35:14
The XX is the IP from my ISP. I have the R7000 acting as a router, and the box from Frontier setup to act as a modem only (it passes the ISP IP to the R7000, has WIFI off, etc). This setup has been working for several years.
When this first happened, my son claims it was a caused my DDOS related to some xbox game (apparently that is a way folks cheat now)? Not sure if I beieve what he is saying in that regard.
Re: R7000 - Very frequent disconnects and Self2WAN ICMP type b Detected
A brief update, I just saw this in the log now too:
[Time synchronized with NTP server] Friday, Nov 13,2020 13:07:09 [Internet connected] IP address: XX.XX.XX.XX, Friday, Nov 13,2020 13:07:09 [DoS attack: Smurf] (4) attack packets in last 20 sec from ip [XX.XX.XX.XX], Friday, Nov 13,2020 13:03:14 [DoS attack: Smurf] (5) attack packets in last 20 sec from ip [XX.XX.XX.XX], Friday, Nov 13,2020 13:02:21 [Time synchronized with NTP server] Friday, Nov 13,2020 13:02:09 [Internet connected] IP address: XX.XX.XX.XX, Friday, Nov 13,2020 13:02:08
Re: R7000 - Very frequent disconnects and Self2WAN ICMP type b Detected
One last snippet, in addition to the "Smurf" attack, there is also a "FIN Scan" one. I don't know if these are related to the "Internet Connected" every 5 minutes or not.
[Time synchronized with NTP server] Friday, Nov 13,2020 13:26:59 [Internet connected] IP address: XX.XX.XX.XX, Friday, Nov 13,2020 13:26:58 [Admin login] from source 192.168.1.2, Friday, Nov 13,2020 13:26:44 [DHCP IP: (192.168.1.11)] to MAC address 98:01:A7:9A:E7:CB, Friday, Nov 13,2020 13:26:00 [Time synchronized with NTP server] Friday, Nov 13,2020 13:21:58 [Internet connected] IP address: XX.XX.XX.XX, Friday, Nov 13,2020 13:21:58 [DHCP IP: (192.168.1.10)] to MAC address 84:AB:1A:34:AB:C2, Friday, Nov 13,2020 13:19:40 [DHCP IP: (192.168.1.9)] to MAC address F6:C2:E4:B0:8A:F1, Friday, Nov 13,2020 13:19:29 [Time synchronized with NTP server] Friday, Nov 13,2020 13:17:46 [DoS attack: FIN Scan] (3) attack packets in last 20 sec from ip [13.225.198.114], Friday, Nov 13,2020 13:17:43 [Admin login] from source 192.168.1.2, Friday, Nov 13,2020 13:17:20 [Admin login] from source 192.168.1.2, Friday, Nov 13,2020 13:17:05 [DoS attack: FIN Scan] (1) attack packets in last 20 sec from ip [13.225.198.114], Friday, Nov 13,2020 13:17:02
