Router log shows disconnect/connect about every 15 minutes
I noticed I got disconnected from the interwebz earlier today. Did some checking and saw that the router did a full internet disconnect/connect. Did some more checking, to see what was going on and am seeing a disconnect/connect task every 15 minutes in the router log. I'm also seeing some DoS ACK_Scan results from my two Windows computers. I've gone through the systems, as well as my cell which showed up for a while too, to make sure nothing funny was going on there. As far as I can tell, all devices are clean.
I've applied the latest firmware to the router (today) which is version 1.0.8.64_3. Since it mentioned stability improvements in the release note I was hoping that it would help resolve the issue. Nope. With the disconnect/connect taking place in all of three or four seconds, I don't know if this is a false message or not. It's rather annoying to see all the entries in the log.
I bought the router in November of 2022. It was connected, for the first time, to my new fiber service (1Gb). I recently had to have the ONT box replaced due to it's 10Gb port failing. New box has been good since then. With how the support people are for the ISP, I'd rather not call them first with this. Basically, most of them are 'offshore' these days, so they only go by the script in front of them and cannot seem to think on their own. Even when the script calls out for an ONT replacement, they don't act on that (yeah, annoying).
Here's a sample of what I'm seeing in the router log (local IPs amended to protect the not so innocent):
[DoS attack:ACK_Scan] from source: <local.229,port 51454, Wednesday, January 29, 2025 18:31:11 [DoS attack:ACK_Scan] from source: <local.229,port 49386, Wednesday, January 29, 2025 18:30:47 [DoS attack:ACK_Scan] from source: <local.229,port 51454, Wednesday, January 29, 2025 18:30:26 [DoS attack:ACK_Scan] from source: <local.229,port 49386, Wednesday, January 29, 2025 18:30:02 [DoS attack:ACK_Scan] from source: <local.229,port 51454, Wednesday, January 29, 2025 18:29:41 [DoS attack:ACK_Scan] from source: <local.229,port 49386, Wednesday, January 29, 2025 18:29:17 [DoS attack:ACK_Scan] from source: <local.229,port 51454, Wednesday, January 29, 2025 18:28:56 [DoS attack:ACK_Scan] from source: <local.240,port 50574, Wednesday, January 29, 2025 18:28:34 [DoS attack:ACK_Scan] from source: <local.229,port 51228, Wednesday, January 29, 2025 18:28:14 [DoS attack:ACK_Scan] from source: <local.229,port 51498, Wednesday, January 29, 2025 18:27:53 [Internet connected] IP address: <ISP IP>, Wednesday, January 29, 2025 18:27:51 [Internet disconnected] Wednesday, January 29, 2025 18:27:48 [DoS attack:ACK_Scan] from source: <local.229,port 50430, Wednesday, January 29, 2025 18:26:22 [DoS attack:ACK_Scan] from source: <local.229,port 50429, Wednesday, January 29, 2025 18:25:47 [DoS attack:ACK_Scan] from source: 52.7.29.22,port 443, Wednesday, January 29, 2025 18:23:07 [DoS attack:ACK_Scan] from source: <local.229,port 49386, Wednesday, January 29, 2025 18:19:32 [DoS attack:ACK_Scan] from source: <local.229,port 49386, Wednesday, January 29, 2025 18:18:47 [DoS attack:ACK_Scan] from source: 52.7.29.22,port 443, Wednesday, January 29, 2025 18:17:55 [DoS attack:ACK_Scan] from source: <local.229,port 49386, Wednesday, January 29, 2025 18:17:17 [DoS attack:ACK_Scan] from source: <local.240,port 50515, Wednesday, January 29, 2025 18:16:48 [DoS attack:ACK_Scan] from source: <local.240,port 50515, Wednesday, January 29, 2025 18:16:27 [DoS attack:ACK_Scan] from source: <local.240,port 50514, Wednesday, January 29, 2025 18:15:57 [DoS attack:ACK_Scan] from source: <local.240,port 50514, Wednesday, January 29, 2025 18:15:35 [DoS attack:ACK_Scan] from source: <local.229,port 49466, Wednesday, January 29, 2025 18:15:15 [DoS attack:ACK_Scan] from source: <local.229,port 51129, Wednesday, January 29, 2025 18:14:52 [DoS attack:ACK_Scan] from source: <local.229,port 51072, Wednesday, January 29, 2025 18:14:30 [DoS attack:ACK_Scan] from source: <local.229,port 51129, Wednesday, January 29, 2025 18:14:07 [DoS attack:ACK_Scan] from source: <local.229,port 51072, Wednesday, January 29, 2025 18:13:45 [DoS attack:ACK_Scan] from source: <local.229,port 51135, Wednesday, January 29, 2025 18:13:15 [DoS attack:ACK_Scan] from source: <local.229,port 51054, Wednesday, January 29, 2025 18:12:51 [Internet connected] IP address: <ISP IP>, Wednesday, January 29, 2025 18:12:49 [DoS attack:ACK_Scan] from source: <local.229,port 51067, Wednesday, January 29, 2025 18:12:49 [Internet disconnected] Wednesday, January 29, 2025 18:12:46 [DoS attack:ACK_Scan] from source: <local.229,port 49974, Wednesday, January 29, 2025 18:06:13 [DoS attack:ACK_Scan] from source: <local.229,port 49970, Wednesday, January 29, 2025 18:04:27 [DoS attack:ACK_Scan] from source: <local.229,port 49386, Wednesday, January 29, 2025 18:03:47 [DoS attack:ACK_Scan] from source: <local.229,port 49386, Wednesday, January 29, 2025 18:03:02 [DoS attack:ACK_Scan] from source: <local.229,port 49386, Wednesday, January 29, 2025 18:02:17 [DoS attack:ACK_Scan] from source: <local.229,port 49386, Wednesday, January 29, 2025 18:01:32 [DoS attack:ACK_Scan] from source: <local.229,port 50954, Wednesday, January 29, 2025 18:01:11 [DoS attack:ACK_Scan] from source: <local.229,port 49386, Wednesday, January 29, 2025 18:00:47 [DoS attack:ACK_Scan] from source: <local.240,port 50501, Wednesday, January 29, 2025 18:00:23 [DoS attack:ACK_Scan] from source: <local.229,port 49386, Wednesday, January 29, 2025 18:00:02 [DoS attack:ACK_Scan] from source: <local.229,port 50954, Wednesday, January 29, 2025 17:59:41 [DoS attack:ACK_Scan] from source: <local.229,port 49386, Wednesday, January 29, 2025 17:59:17 [DoS attack:ACK_Scan] from source: <local.240,port 50508, Wednesday, January 29, 2025 17:58:53 [DoS attack:ACK_Scan] from source: <local.229,port 49386, Wednesday, January 29, 2025 17:58:32 [DoS attack:ACK_Scan] from source: <local.229,port 50954, Wednesday, January 29, 2025 17:58:11 [DoS attack:ACK_Scan] from source: <local.229,port 50427, Wednesday, January 29, 2025 17:57:51 [Internet connected] IP address: <ISP IP>, Wednesday, January 29, 2025 17:57:48 [DoS attack:ACK_Scan] from source: <local.229,port 49386, Wednesday, January 29, 2025 17:57:47 [Internet disconnected] Wednesday, January 29, 2025 17:57:44 [DoS attack:ACK_Scan] from source: <local.229,port 56838, Wednesday, January 29, 2025 17:54:10 [DoS attack:ACK_Scan] from source: <local.229,port 56838, Wednesday, January 29, 2025 17:53:25 [DoS attack:ACK_Scan] from source: <local.229,port 56838, Wednesday, January 29, 2025 17:52:40 [DoS attack:ACK_Scan] from source: 54.175.249.133,port 443, Wednesday, January 29, 2025 17:51:45 [admin login] from source <local.229, Wednesday, January 29, 2025 17:50:26 [DoS attack:ACK_Scan] from source: <local.229,port 56838, Wednesday, January 29, 2025 17:50:25 [Time synchronized with NTP server] Wednesday, January 29, 2025 17:50:22 [Internet connected] IP address: <ISP IP>, Wednesday, January 29, 2025 17:50:17 [Initialized, firmware version: V1.0.8.64] Wednesday, January 29, 2025 17:49:11
I'm hoping that someone here will know what the hell is going on with this activity. Until now, the router has been pretty solid. I really don't have any spare funds to get a replacement. Obviously, it's outside of the warranty period (over two years old now). I'm considering running Wireshark to an outside IP for more than 15 minutes to see IF I'm actually disconnecting from the internet, or not. I could do that later on tonight, or tomorrow.
Re: Router log shows disconnect/connect about every 15 minutes
Does the internet LED on top of the router turn AMBER when this happens?
What is the Mfr and model# of the Internet Service Providers modem/ONT the NG router is connected too? Be sure your using a good quality LAN cable between the modem and router. CAT6A STP is recommended.
If you connect a wired PC directly to the ONT, do you notice same thing every 15 minutes?
Re: Router log shows disconnect/connect about every 15 minutes
The disconnect/connect entry in the log was all of four seconds (at most). I wasn't getting a disconnect message from the computer I was using, other than one time where I then went into the log. So chances of me looking up and catching it mid process was pretty much zero.
No way am I shifting the connection to the ONT from the router to my computer to see if that does anything. The router MAC is coded into the service as the only authenticated device to connect to the ONT. So that would just be a complete failure to test out anything.
I rebooted the router last night and that seems to have cleared up almost all of the messages I was getting in the log. I only got two DoS messages in the log. One from an external IP and one internal. Looks fairly 'common' from what I was able to dig up online.
Cable between the ONT and router isn't the issue either. I've been in the IT field for over 25 years now. When it comes to setting up my home stuff I typically go with higher quality items for things like cables. Right now I have a fully shielded ethernet cable connecting the ONT and router (think it's a cat 6, not worth looking at it).
As for your request of specifics for my ONT. Hell no am I posting that info online. The router model that I'm using was included in my opening post. If you couldn't see that, that's on you. 😛
Re: Router log shows disconnect/connect about every 15 minutes
Guess we can't help you then if your not willing to try some suggestions or give feedback information. Us users are here to help each other out as best as we can. How this forums works and works well for those what give feedback and work with us to fix there problems.
You'll need to contact NG support and have them help you out.
Re: Router log shows disconnect/connect about every 15 minutes
That's what you took from my reply?? Really?? Wow...
1. Plugging a computer into my ONT would yield me NOTHING since it won't be able to connect to the internet. The ISP LOCKS the MAC address of the initial device into it. There's no way for me to reset that without contacting the ISP to get them to release it. That would have been final steps IF I couldn't get this resolved otherwise.
2. Posting up what I consider information that should remain private is what I consider a security hole. If others do it, that's fine on them. I cannot afford to get compromised.
3. Having an attitude when someone is more security focused and really just asking if he's seeing something that's easy to fix, or not, is poor form.
As I posted earlier, a simple reboot of the router pretty much cleared things up. The router had been power cycled more than a few times within the last couple of months due to the original ONT box having a port failure. Pretty sure I rebooted the router when the new ONT was put in place too. If I need to bounce the router every X months, then I'll be looking to get a better router. You shouldn't NEED to reboot your router every X months JUST to keep things healthy. I also applied the latest firmware to the thing (mentioned in the opening post) thinking that MIGHT resolve the issue. The router did a reboot during that process. But it didn't clear the issue. Doing a 'normal' reboot of the router from the control panel/site did resolve the issue, at least for now.
If anyone else has a similar issue I would recommend making sure the firmware is the latest release. Ignore the 'update' panel in the router control site and look under the support downloads section for that router. Since hitting the 'look for updates' button yielded NOTHING (useless). Then reboot the router shortly after the firmware update completes and you can get back into the thing. Then see if the log populates with BS or not.
