Orbi 20 DoS Drops Internet

[Newbie_Guy]

Howdy!

So, I was given an Orbi 20 router and tried to use it to replace my ancient networking setup. It worked fine for about a day but now about once or twice an hour it's been dropping internet (both wifi & wired, I plug it into a switch) for 4-5 minutes. Light flashes, then wifi reconnects. I looked in the logs and everytime it drops it's reporting a DoS Attack. The IP's resolve back to Amazon or Google on port 443.

I found simular posts but it seems the solution was having the ISP change my ip? I don't think these are really DoS attacks. For now I plugged back in my old belkin router and the internet has been stable again.

Is there something I can do to prevent this from resetting when it detects a DoS? Or could this Orbi be defective?

When I set it up I did a factory reset. Then it updated the firmware.

Orbi RBR20

Firmware 2.7.3.22

[Newbie_Guy · Accepted solution]

Well I fixed the problem but i'm not really sure how. All I did was toggle logging of DoS attacks first "off", then "on". Then, I cleared the log. Now the issue is resolved and it no longer reboots. After looking through these forums, had I known upgrading firmware causes such grief, I never would have done that step when I first set this up. Anyway, I'll stay away from future firmware updates for now. Thanks all!

[FURRYe38]

What is the Mfr and model# of the Internet Service Providers modem/ONT the NG router is connected too?

Has a power off for 1 minute then back ON with the ISP modem and Orbi system been performed since last update?

[Newbie_Guy]

Hi. I'm using an Arris SURFboard SB6183 cable modem. It's about a year old. I do have to unplug it when i switch out the routers so the internet will come back on.

[FURRYe38]

No just unplug the power adapters for the modem and RBR for a good minute then plug back in the modem then RBRs power adapters. 

Does the top ring LED come on when the RBR drops this connection? 

[CrimpOn]

---

@Newbie_Guy wrote:

Howdy!

So, I was given an Orbi 20 router and tried to use it to replace my ancient networking setup. It worked fine for about a day but now about once or twice an hour it's been dropping internet (both wifi & wired, I plug it into a switch) for 4-5 minutes.

---

This switch is on the LAN side of the Orbi, correct? (not between the Orbi and the modem).

Orbi's log of number of different types of DoS attacks when the Orbi firewall recognizes patterns in connection attempts.  Is there a consistent type of DoS attack that seems to trigger these service interruptions?

I am very interested in this topic because my Orbi does not exhibit this behavior and I'm looking for "what is different?" about my Orbi than Orbi's which do this.

[CrimpOn]

Just reviewed Orbi logs for August. These DoS attacks were logged:

ACK Scan........ 201

ARP Attack....... 14

Ascend Kill....... 4

ICMP Scan......... 5

RST Scan........ 115

SYN/SCK Scan.  1,466

SYN/RST Scan...... 2

TCP/UDP Chargen.. 32

TCP/UDP Echo..... 27

UDP Port Scan..... 1

Total......... 1,867

To ensure that I am not missing events where the Orbi loses the internet connection and reboots without my knowledge, I have PingInfoView pinging 5 different DNS servers every 30 seconds.  ICMP is based on UDP, so occasionally a ping will go missing, but never several minutes worth.

I do  not doubt for a minute that people have Orbi routers that drop the internet connection. It would be useful to understand what causes this to happen and why my Orbi does not.

[Newbie_Guy]

Hi so I'm using an Arris SB6183 Cable modem. It's about a year old. I do use a switch but it's after the router. Nothing in between modem and router. When it drops connection the top lights blink which I assume means its cycling power. I have noted that everytime it has done this, in the logs it shows "DoS attack: ACK Scan" which coinsides with the service interuption. I don't experiance this when i switch my old router back. I wasn't having network issues before, I just wanted to use this Orbi because my old router is only 10/100. Right now I'm using it with DoS logging disabled to see if that makes a difference.

[FURRYe38]

Is there an IP Address on the DoS attack: ACK Scan when this happens? 

[Newbie_Guy · Accepted solution]

Well I fixed the problem but i'm not really sure how. All I did was toggle logging of DoS attacks first "off", then "on". Then, I cleared the log. Now the issue is resolved and it no longer reboots. After looking through these forums, had I known upgrading firmware causes such grief, I never would have done that step when I first set this up. Anyway, I'll stay away from future firmware updates for now. Thanks all!

[FURRYe38]

Good to hear 

You can select the log items that you feel you want the RBR to collect. You don't have to have them all set to logging. I don't.

Please mark your thread as solved so others will know.
Be sure to save off a back up configuration to file for safe keeping. Saves time if a reset is needed.
https://kb.netgear.com/000062080/How-do-I-back-up-the-configuration-settings-on-my-Orbi-WiFi-System
Enjoy.