Nighthawk AX4 RAX35 Slow Speeds and Disconnects

[reelbigfish35]

Hi All,

I have a rather new AX4 RAX35 router that I'm seeing slow internet performance random drops, and weird things in the logs. Log portion pasted below. The DoS attacks, as far as I can tell from a quick check of the forums seems to be more of a Netgear nuisance thing, I know that IP address .3 is my Roku (wired connection), .19 is iphone, and .9 and .15 are my and my wife's laptops. Weirder is that the internet disconnected log happens consistently every 10 minutes. I just did a ping test to google servers (8.8.8.8) and right at the time when the RAX35 said internet disconnected, I dropped 2 packets. We have AT&T internet, and AT&T modem plugged into the RAX35 for wifi. 

[Internet connected] IP address: , Fri,Jun 19,2020 10:47:12
[DoS attack:ACK Scan] from source: 192.168.1.15, port 59288, Fri,Jun 19,2020 10:47:08
[Internet disconnected] Fri,Jun 19,2020 10:47:07
[DoS attack:ACK Scan] from source: 192.168.1.15, port 59253, Fri,Jun 19,2020 10:45:56
[admin login] from source 192.168.1.9, Fri,Jun 19,2020 10:44:25
[DoS attack:ACK Scan] from source: 192.168.1.9, port 52925, Fri,Jun 19,2020 10:44:24
[DoS attack:ACK Scan] from source: 192.168.1.3, port 36049, Fri,Jun 19,2020 10:44:01
[DoS attack:ACK Scan] from source: 192.168.1.9, port 52925, Fri,Jun 19,2020 10:43:39
[DoS attack:ACK Scan] from source: 192.168.1.3, port 36049, Fri,Jun 19,2020 10:43:15
[DoS attack:ACK Scan] from source: 192.168.1.9, port 52925, Fri,Jun 19,2020 10:42:54
[DoS attack:ACK Scan] from source: 192.168.1.3, port 36049, Fri,Jun 19,2020 10:42:30
[DoS attack:ACK Scan] from source: 192.168.1.9, port 52925, Fri,Jun 19,2020 10:42:09
[DoS attack:ACK Scan] from source: 192.168.1.3, port 36049, Fri,Jun 19,2020 10:41:45
[DoS attack:ACK Scan] from source: 192.168.1.9, port 52925, Fri,Jun 19,2020 10:41:24
[DoS attack:ACK Scan] from source: 192.168.1.3, port 36049, Fri,Jun 19,2020 10:41:00
[DoS attack:ACK Scan] from source: 192.168.1.9, port 52925, Fri,Jun 19,2020 10:40:39
[DoS attack:ACK Scan] from source: 192.168.1.3, port 36049, Fri,Jun 19,2020 10:40:15
[DoS attack:ACK Scan] from source: 192.168.1.9, port 52925, Fri,Jun 19,2020 10:39:54
[DoS attack:ACK Scan] from source: 192.168.1.3, port 36049, Fri,Jun 19,2020 10:39:30
[DoS attack:ACK Scan] from source: 192.168.1.9, port 52925, Fri,Jun 19,2020 10:39:09
[DoS attack:ACK Scan] from source: 192.168.1.3, port 36049, Fri,Jun 19,2020 10:38:45
[DoS attack:ACK Scan] from source: 192.168.1.9, port 52925, Fri,Jun 19,2020 10:38:24
[DoS attack:ACK Scan] from source: 192.168.1.3, port 36049, Fri,Jun 19,2020 10:38:00
[DoS attack:ACK Scan] from source: 192.168.1.9, port 52925, Fri,Jun 19,2020 10:37:39
[Internet connected] IP address: , Fri,Jun 19,2020 10:37:12
[DoS attack:ACK Scan] from source: 192.168.1.19, port 50275, Fri,Jun 19,2020 10:37:08
[Internet disconnected] Fri,Jun 19,2020 10:37:07

Could I be looking at an issue with my ISP? Anything to be concerned with the DoS attack logs? Appreciate any insight you can provide on this.

[plemans]

What att modem are you using? 

They're notorious for using combo devices. which can cause a double nat. 

[reelbigfish35]

Hi there, have Arris NVG589. I did turn off the wifi on the Arris device, following the steps from AT&T on setting up the NVG589 for the RAX35 to handle wifi.

[plemans]

shutting off the wifi doesn't put the arris in passthrough/bridge mode. 

https://forums.att.com/conversations/att-internet-features/how-do-i-put-my-nvg589-in-bridge-mode/5de...

[reelbigfish35]

Hi there, I could've said it better, I did originally put the NVG589 in bridge mode following those instructions in addition to shutting off wifi. So I've had those log entries with bridge mode on. Any other ideas as to what could be causing this?

[plemans]

A couple things you could try. I wouldn't try them at the same time, just things you can try.

1. shut off ax on the router. maybe your devices have issues with AX. 

2. put the att device back in router mode and put the netgear in access point mode. It wouldn't be the first att modem/router device that didn't function properly in bridge/passthrough mode

3. roll back the firmware on the RAX. The Rax devices are pretty new and maybe that firwmare version has a bug. you can downgrade, reset the router, and then reinstall it. (disable auto update if you do)

4. put the att device back in router mode, leave the netgear in router mode but put the netgears IP address into the ATT router's dmz.  

[reelbigfish35]

Thanks for the info. I went back into the NVG589 to double check settings. On the IP passthrough page of the modem interface, I saw that the DHCP lease time was set to default value of 10 minutes. Set it to max time. Since then I haven't seen the Internet disconnected/connected log entries. Now in a sort of wait and see for overall how wifi is doing, so far appears to be better. May re-enable AX and see if still has better performance.

As for the DoS attacks in logs, safe to assume it's nuisance entries?

[plemans]

glad to hear its running better. 

ATT combo devices cause quite a bit of frustration on here. 

If you're device does have issues with ax, check with the wireless chip manufacturer on a driver update. many laptops/tablets on windows only get their drivers updated through windows and they tend to be outdated (by a lot) and not work well with AX. 

[plemans]

And the DoS tend to be nuisance entries. you are correct. Not always