My R7000 power light blinking // no start up

[swilson317]

---

@Downfall wrote:
Also, a factory reset does not work. I even did it on the phone with support

---

THANKS! Good to know. Did support acknowledge that this is a widespread issue? Geez..it's like the Coronavirus got into our routers! 😞

[Downfall]

No they stated that they were unaware of the issue. Sounded like I was the only one who has called in, which probably means they won't rush lol

[swilson317]

My router is out of warranty, so I can't really call in. Sucks! Unfortunately I could buy a new router for the cost of their support plan. But I really can't afford to have my router down while working and teaching from home! I may have to bite the bullet and buy 6 mos. of coverage. But it would really be interesting to know just how many people are affected. This stinks...on many levels. I want to know if it is Netgear or a 3rd party!!!

[Portwey84]

@swilson317  To be perfectly honest, as your router is now six years old, I'd just bite the bullet and buy a brand new router. I can't begin to understand your own personal situation regarding work/teaching, but if my router went belly up, I'd be straight on Amazon and have a new one in the house the following day. On lockdown here in the UK, so going out to buy one off the shelf is not an option.

I've still got complimentary email/chat support until 2nd May 2020, basically for just another two weeks but I do at least have a hardware warranty until 1st May 2022, so if my router pops its clogs in the next couple of years, I should at least be covered for a replacement.

[swilson317]

Understood. That would be an easier decision if there was a newer model, but I believe it is the same. Will check some reviews. Have always preferred Netgear routers. <sigh> If I get the same model, I won't have to change the mounting setup or cabling up in the corner wall of my home office! 🙂 Also...the six months of support is half the cost of the router, so you are probably right. We aren't locked down that much. I should be able to swing by Best Buy and have them hand it to me at the curb. 

[Downfall]

Mine was out of warranty as well, didn't stop me as I firmly believed it was an issue they caused. I was in the phone for about 3 hours today and we were able to fix it.
There are steps in the community about doing the tftp steps which is basically what was followed

[swilson317]

 Hi all,

Well...here is the long saga of getting this resolved. Similar to a previous poster, I tried contacting support knowing full well that I wasn't entitled to it. The woman helped me through a few basic things, but then said she couldn't go forward without me buying support. The good news is that online, the cheapest support available (at least that I saw) was 6 months. On the phone, she offered me 3 months for $50 and I had to pay it from an email she sent me before we could continue. The interesting part of that was that she said that she couldn't escalate the call until I paid it. She also asked if it was ok for a senior teck to call me an a few hours. I said sure. But as soon as I paid the contract, she suddenly was able to help me. 

Before I called her, since another poster said that all support did was walk him through the TFTP routine, I tried the instructions here. But I was unsuccessful.

If we find out that this was an issue initiated by Netgear, I will be demanding my money back. The only other possibility is that we were a victim of a 3rd party hacker!

Being a professional software trainer, I decided to document (as best I could) the steps that I went through with Netgear support to resolve this issue. I created the attached document. I hope you find it helpful and it saves you $50! 🙂

Steve

[stevenye10969]

We got so many ppl gettting this issue on the same day and the same morning. I demand answer too 

[gdphome]

---

@Downfall wrote:
Mine was out of warranty as well, didn't stop me as I firmly believed it was an issue they caused. I was in the phone for about 3 hours today and we were able to fix it.
There are steps in the community about doing the tftp steps which is basically what was followed

---

So @Downfall you say your R7000 is up and running again, that is good news for you. Can you help me (and it seems plenty other people) and share the link to those pages. Thanks in advance for that 🙂

[gdphome]

---

@swilson317 wrote:

 Hi all,

Well...here is the long saga of getting this resolved. Similar to a previous poster, I tried contacting support knowing full well that I wasn't entitled to it. The woman helped me through a few basic things, but then said she couldn't go forward without me buying support. The good news is that online, the cheapest support available (at least that I saw) was 6 months. On the phone, she offered me 3 months for $50 and I had to pay it from an email she sent me before we could continue. The interesting part of that was that she said that she couldn't escalate the call until I paid it. She also asked if it was ok for a senior teck to call me an a few hours. I said sure. But as soon as I paid the contract, she suddenly was able to help me. 

Before I called her, since another poster said that all support did was walk him through the TFTP routine, I tried the instructions here. But I was unsuccessful.

If we find out that this was an issue initiated by Netgear, I will be demanding my money back. The only other possibility is that we were a victim of a 3rd party hacker!

Being a professional software trainer, I decided to document (as best I could) the steps that I went through with Netgear support to resolve this issue. I created the attached document. I hope you find it helpful and it saves you $50! 🙂

Steve

@swilson317 Just downloaded the file and will see if it works for me as well. Hope it does, but if not already ordered a new router, which will be delivered this afternoon, so in case it does not work, plan B is ready too.

One other question, is my understanding correct that this issue was caused by Netgear?

---

[Portwey84]

@swilson317  Well done! Pleased you got this sorted. I don't envisage any issues with my own router, but I have downloaded your detailed instructions just in case. I'm sorry you had to fork out 50 bucks but I guess you have at least got 3 months support in the meantime. I hope your router behaves itself!

Please tell me also that you have disabled auto update?

[swilson317]

I was a bit frustrated that the support tech gave me miss information about the auto-update feature. Once I gained access to the router administration, I did find the auto-update option AND...as stated by another poster, it WAS set to Enable!!! I had never noticed that setting because it pretty much displays below the bottom edge of my browser when using my laptop.

Soooo....this really does sound like a Netgear-initiated update that bricked our routers! I am continuing to work on finding out for sure. I may engage a local TV consumer group to investigate, since I had to pay money to fix it!

Bottom line...as a precaution...I strongly urge you to:

1) Under Advanced tab > Administrationtion > Router Update, select Disable for Router Auto Firmware Update and Apply! This means that you have FULL control as to WHEN updates are applied to your router. Since we don't know whether the recent event was indeed a Netgear-initiated update or some other hack, I think this is safest (as suggested by another poster)!

2) Under Advanced tab > Administrationtion > Backup Settings, click the Back Up button to save a copy of your router's configuration that you can load later if needed.

Steve

[michaelkenward]

---

@stevenye10969 wrote:

We got so many ppl gettting this issue on the same day and the same morning. I demand answer too 

---

Probably Netgear rolled out an automated update overnight.

R7000 blinking white power light, no WiFi, no conn... - NETGEAR Communities

That's why many people disable that feature.

[Portwey84]

Well, I followed @swilson317  advice on making a backup of my settings, the only thing I hadn't done. I now have a copy saved.

Whilst I was in the admin page, yeah, guess what I found? just after midnight Wednesday into Thursday, the same day as other users reported issues with their routers, my R7000 logged a DoS attack packet. It may be entirely coincindental, a false positive or something, I have no idea. I have carried out a full Bitdefender scan of my system and it is clean. I did find it a bit unnerving if I'm honest.

Then, this afternoon out of the corner of my eye, my router which sits on a table next to me, the power LED turned from white to orange and then all of the lights went orange. I glanced across the room to my modem which is mounted on a wall next to my telephone socket, and noticed that it was blinking in an unusual manner. Upshot was, it was an ISP issue, internet went down for about 3 minutes and then it came back online again. I didn't have to touch my router at all, normal service was resumed.

All that aside, almost 2 weeks since upgrading, not having any issues with the new firmware.

[swilson317]

---

@Portwey84 wrote:

Well, I followed @swilson317  advice on making a backup of my settings, the only thing I hadn't done. I now have a copy saved.

Whilst I was in the admin page, yeah, guess what I found? just after midnight Wednesday into Thursday, the same day as other users reported issues with their routers, my R7000 logged a DoS attack packet. It may be entirely coincindental, a false positive or something, I have no idea. I have carried out a full Bitdefender scan of my system and it is clean. I did find it a bit unnerving if I'm honest.

Then, this afternoon out of the corner of my eye, my router which sits on a table next to me, the power LED turned from white to orange and then all of the lights went orange. I glanced across the room to my modem which is mounted on a wall next to my telephone socket, and noticed that it was blinking in an unusual manner. Upshot was, it was an ISP issue, internet went down for about 3 minutes and then it came back online again. I didn't have to touch my router at all, normal service was resumed.

All that aside, almost 2 weeks since upgrading, not having any issues with the new firmware.

---

Thanks! Would you post what that entry looks like? I suspect you are looking in your log. My log doesn't go back due to the reset. If every one psots their log entry with the DOS attack, we can determine whether we were all hit at the same time. But what you are stating totally fits with what we experienced!!! Like I said...if it wasn't Netgear, then it must have been an attack of some sort! <sigh>

[michaelkenward]

---

@Portwey84 wrote:

Whilst I was in the admin page, yeah, guess what I found? just after midnight Wednesday into Thursday, the same day as other users reported issues with their routers, my R7000 logged a DoS attack packet. It may be entirely coincindental, a false positive or something, I have no idea.

Netgear's firmware is great at creating false reports of DoS attacks. Many of them are no such thing.

Search - NETGEAR Communities – DoS attacks

Use Whois.net to see who is behind some of them and you may find that they are from places like Facebook, Google, even your ISP.

Here is a useful tool for that task:

IPNetInfo: Retrieve IP Address Information from WHOIS servers

If these events are slowing down your router, that may be because it is using up processor time as it writes the events to your logs. Anything that uses processor power – event logging, QoS management, traffic metering – may cause slowdowns. Disable logging of DoS attacks and see if that reduces the problem. This does not prevent the router from protecting you from the outside world.

[Portwey84]

@swilson317  Unfortunately, I deleted it once I'd checked the ip address. The ip belonged to Akamai Technologies according to the Google search I did.

And guess what? In the last hour, it's happened again, ip leads to Akamai Technologies:

[DoS attack: ACK Scan] (1) attack packets in last 20 sec from ip [92.122.116.247], Friday, Apr 17,2020 17:06:36

I've discovered this has cropped up on the Community before:

https://community.netgear.com/t5/Nighthawk-WiFi-Routers/DoS-attacks-logged-after-update/td-p/1576466

I'm not too concerned if I'm honest. I've got stuff quite locked down and good anti-virus etc.

[Portwey84]

@michaelkenward  Thanks for the advice. I've unchecked every box so nothing will be logged.

[Georgia_Dad]

I ran into this same problem as well.  I am happy to report that I was able to get my R7000 back to life this morning using the TFTP command.  

I recommend using these - https://kb.netgear.com/000059634/How-to-upload-firmware-to-a-NETGEAR-router-using-Windows-TFTP

I would like to see something from NETGEAR about this issue.  Once I was able to gain access to the router I confirmed that auto updates was turned on.  I have updated the settings and disabled this setting.  

[swilson317]

Hi all,

Thought I'd post an update. My router has been working fine since buying support, working with a tech, and re-loading the firmware. Then this morning...at 8:30am...I get woken up by a call from Netgear support. I had been co-teaching a class until midnight, so was sleeping. Totally pissed me off. He didn't seem to have any clue what timezone he was calling!! ARGH! Sorry...still pissed!

Anyway...he called to follow-up and wanted to install a beta firmware to collect information in deep memory. Said we would only need to install the firmware, extract the data, and reinstall the current firmware. He totally wasted an hour and a half of my time! We just couldn't get the router to accept the firmware upload via TFTP. I had the same issue with the first tech. Their instructions state that the power LED will flash. It does not! I should have pulled out the doc I posted from the notes from my first time working with Netgear support, as that obviously worked. He was apologetic, said he will find out why this didn't work, and then contact me again.

Bottom line...Netgear seems to be following up on this issue. I also told him that if Netgear is indeed taking responsibility for this event, then I want my money back that I paid for support to resolve it in the first place! Will keep you updated.

If any of you have better, detailed steps regarding the process of powering up with reset and then uploading the firmware, please reply with a link or text. He had me open  a ping -t command window while resetting, but he still couldn't seem to determine when the appropropriate time to send the file was. <heavy sigh>

[michaelkenward]

---

@swilson317 wrote:

Then this morning...at 8:30am...I get woken up by a call from Netgear support. I had been co-teaching a class until midnight, so was sleeping. Totally pissed me off. He didn't seem to have any clue what timezone he was calling!! ARGH! Sorry...still pissed!

---

I do not want to worry you, but are you certain that this was a Netgear person and not one of those scamsters who just love hijacking victims' PCs and wreaking havoc?

I ask only because this has happened, and recently too.

[swilson317]

That is a VERY good question...and kind of funny that you ask! Considering that I was half asleep at the start, I was cautious enough to ask him that very question. I logged into Netgear and saw the case number. I had him tell me the case number to confirm. I also checked my email and confirmed that I was notified directly from Netgear. 

Interestingly...the support tech just called back. It turns out that he shouldn't have been using TFTP to update the firmware while the router was in a good, working state. We used the UI to update the router to a special firmware version that he had emailed me earlier. Once the router was updated, he had me open a special debug webpage on the router to capture a log. Once captured, I downloaded the log and attached it to the case. We then reinstalled the current version ot the firmware. Hopefully, the debug log will give them information as to what the heck happened that fareful night when we all woke up to bricked routers...or at least some of us did!

I do appreciate Netgear following up on this, as they just didn't seem to be taking it seriously at the time! 

[michaelkenward]

Nice one. I wish everyone was that careful.

• Google "Netgear support".
• Find a phone number.
• Ring It.
• Get stung.

All too common.

---

@swilson317 wrote:

I do appreciate Netgear following up on this, as they just didn't seem to be taking it seriously at the time! 

---

It might have helped that you were able to provide an understandable, and constructively  narrated, explanation of something that wasn't easily put down to "user error".  Sadly, that doesn't apply to a lot of what wafts by here, often from people operating in "rant" mode.

[swilson317]

It was a totally fair question! And true...it's all to easy whether by phone or by email...to get burned! It is when you let your gaurd down that you get hit! Even though I consider myself hyper-aware, there have been times I've fallen for a phishing email and stopped dead thinking..."CRAP! You didn't check the reply-to address!" We all need to stay vigilant about protecting our privacy! That goes for respecting the the Coronavirus and staying vigilant about protecting ourselves, and each other, to get past this!