Orbi50 with DOS and remote log in failure causing wifi to die for a minute and come back

[MrNoodles]

For three weeks I had a weird issue where my connection disappears (wireless and wired) maybe 1-3 times a day mostly morning and night. After the wifi signal disappears and comes back less than a minute. Based on the forum search, I did the following; replaced modem since its old, called Spectrum several times to do typical test and everything is good and updated firmware to v2.1.1.12 . I do have a respberry pi web server that host a website that displays at my house and parents smart dashboard.

Any help, troubleshooting, guides or other sources to work how to maintian solid connectivity is appreciated. 

Before firmware update all I saw was DOS attacks and from the forums it can be false positive. Latest firmware update I saw this type of log show up [remote login failure] from source 192.168.1.15, Sunday, December 10, 2017 11:17:47.

[admin login] from source 192.168.1.24, Sunday, December 10, 2017 11:55:14
[DoS Attack: ACK Scan] from source: 13.109.139.242, port 443, Sunday, December 10, 2017 11:49:49
[DoS Attack: ACK Scan] from source: 136.146.210.116, port 443, Sunday, December 10, 2017 11:49:38
[DoS Attack: ACK Scan] from source: 13.109.139.242, port 443, Sunday, December 10, 2017 11:49:32
[DoS Attack: ACK Scan] from source: 13.109.139.242, port 80, Sunday, December 10, 2017 11:49:31
[DoS Attack: RST Scan] from source: 24.105.29.21, port 80, Sunday, December 10, 2017 11:48:39
[admin login] from source 192.168.1.24, Sunday, December 10, 2017 11:43:29
[DoS Attack: RST Scan] from source: 24.105.29.21, port 80, Sunday, December 10, 2017 11:38:39
[admin login] from source 192.168.1.24, Sunday, December 10, 2017 11:36:40
[DoS Attack: RST Scan] from source: 173.194.76.197, port 80, Sunday, December 10, 2017 11:36:33
[DoS Attack: RST Scan] from source: 24.105.29.21, port 80, Sunday, December 10, 2017 11:28:38
[DoS Attack: RST Scan] from source: 173.194.76.197, port 80, Sunday, December 10, 2017 11:24:13
[DoS Attack: ACK Scan] from source: 13.109.139.242, port 443, Sunday, December 10, 2017 11:19:49
[DoS Attack: ACK Scan] from source: 136.146.210.116, port 443, Sunday, December 10, 2017 11:19:38
[DoS Attack: ACK Scan] from source: 13.109.139.242, port 443, Sunday, December 10, 2017 11:19:32
[DoS Attack: ACK Scan] from source: 13.109.139.242, port 80, Sunday, December 10, 2017 11:19:31
[DoS Attack: RST Scan] from source: 24.105.29.21, port 80, Sunday, December 10, 2017 11:18:40
[remote login failure] from source 192.168.1.15, Sunday, December 10, 2017 11:17:47
[remote login failure] from source 192.168.1.15, Sunday, December 10, 2017 11:17:36
[remote login failure] from source 192.168.1.15, Sunday, December 10, 2017 11:17:28
[remote login failure] from source 192.168.1.15, Sunday, December 10, 2017 11:17:15
[DoS Attack: ACK Scan] from source: 54.174.142.142, port 9543, Sunday, December 10, 2017 11:10:18
[DoS Attack: RST Scan] from source: 24.105.29.21, port 80, Sunday, December 10, 2017 11:08:36
[admin login] from source 192.168.1.24, Sunday, December 10, 2017 11:08:35
[DoS Attack: ACK Scan] from source: 54.174.142.142, port 9543, Sunday, December 10, 2017 11:08:18
[admin login failure] from source 192.168.1.24, Sunday, December 10, 2017 11:07:48
[DoS Attack: ACK Scan] from source: 54.174.142.142, port 9543, Sunday, December 10, 2017 11:00:17
[LAN access from remote] from 45.77.105.111:42143 to 192.168.1.14:3000, Sunday, December 10, 2017 10:59:56
[DoS Attack: RST Scan] from source: 24.105.29.21, port 80, Sunday, December 10, 2017 10:58:46
[DoS Attack: ACK Scan] from source: 54.174.142.142, port 9543, Sunday, December 10, 2017 10:52:15
[DoS Attack: SYN/ACK Scan] from source: 173.194.76.197, port 80, Sunday, December 10, 2017 10:51:25
[DoS Attack: ACK Scan] from source: 54.174.142.142, port 9543, Sunday, December 10, 2017 10:50:15
[DoS Attack: ACK Scan] from source: 13.109.139.242, port 443, Sunday, December 10, 2017 10:49:49
[DoS Attack: ACK Scan] from source: 136.146.210.116, port 443, Sunday, December 10, 2017 10:49:38
[DoS Attack: ACK Scan] from source: 13.109.139.242, port 443, Sunday, December 10, 2017 10:49:32
[DoS Attack: ACK Scan] from source: 13.109.139.242, port 80, Sunday, December 10, 2017 10:49:31
[DoS Attack: SYN/ACK Scan] from source: 173.194.76.197, port 80, Sunday, December 10, 2017 10:48:44
[DoS Attack: RST Scan] from source: 24.105.29.21, port 80, Sunday, December 10, 2017 10:48:38
[DoS Attack: ACK Scan] from source: 54.174.142.142, port 9543, Sunday, December 10, 2017 10:46:14
[DoS Attack: ACK Scan] from source: 136.146.210.116, port 443, Sunday, December 10, 2017 10:45:02
[DoS Attack: ACK Scan] from source: 34.226.121.43, port 9543, Sunday, December 10, 2017 10:44:48
[DoS Attack: ACK Scan] from source: 54.174.142.142, port 9543, Sunday, December 10, 2017 10:44:14
[DoS Attack: RST Scan] from source: 173.194.76.197, port 80, Sunday, December 10, 2017 10:43:36
[DoS Attack: ACK Scan] from source: 34.226.121.43, port 9543, Sunday, December 10, 2017 10:42:48
[DoS Attack: ACK Scan] from source: 54.174.142.142, port 9543, Sunday, December 10, 2017 10:42:14
[DoS Attack: ACK Scan] from source: 34.226.121.43, port 9543, Sunday, December 10, 2017 10:40:48
[DoS Attack: RST Scan] from source: 173.194.76.197, port 80, Sunday, December 10, 2017 10:40:23
[DoS Attack: ACK Scan] from source: 54.174.142.142, port 9543, Sunday, December 10, 2017 10:40:13
[DoS Attack: ACK Scan] from source: 34.226.121.43, port 9543, Sunday, December 10, 2017 10:38:47
[DoS Attack: ACK Scan] from source: 54.174.142.142, port 9543, Sunday, December 10, 2017 10:38:13
[DoS Attack: ACK Scan] from source: 34.226.121.43, port 9543, Sunday, December 10, 2017 10:36:47
[DoS Attack: ACK Scan] from source: 54.174.142.142, port 9543, Sunday, December 10, 2017 10:36:13
[DoS Attack: ACK Scan] from source: 34.226.121.43, port 9543, Sunday, December 10, 2017 10:34:47
[DoS Attack: ACK Scan] from source: 54.174.142.142, port 9543, Sunday, December 10, 2017 10:34:12
[DoS Attack: ACK Scan] from source: 34.226.121.43, port 9543, Sunday, December 10, 2017 10:32:46
[DoS Attack: ACK Scan] from source: 54.174.142.142, port 9543, Sunday, December 10, 2017 10:32:12
[DoS Attack: ACK Scan] from source: 34.226.121.43, port 9543, Sunday, December 10, 2017 10:30:46
[DoS Attack: ACK Scan] from source: 54.174.142.142, port 9543, Sunday, December 10, 2017 10:30:12
[admin login] from source 192.168.1.24, Sunday, December 10, 2017 10:29:15
[DoS Attack: ACK Scan] from source: 34.226.121.43, port 9543, Sunday, December 10, 2017 10:28:46
[DoS Attack: RST Scan] from source: 173.194.76.197, port 80, Sunday, December 10, 2017 10:28:46
[DoS Attack: RST Scan] from source: 24.105.29.21, port 80, Sunday, December 10, 2017 10:28:43
[DoS Attack: ACK Scan] from source: 54.174.142.142, port 9543, Sunday, December 10, 2017 10:28:11
[DoS Attack: ACK Scan] from source: 34.226.121.43, port 9543, Sunday, December 10, 2017 10:26:45
[DoS Attack: ACK Scan] from source: 54.174.142.142, port 9543, Sunday, December 10, 2017 10:26:11
[DoS Attack: ACK Scan] from source: 34.226.121.43, port 9543, Sunday, December 10, 2017 10:24:45
[DoS Attack: ACK Scan] from source: 54.174.142.142, port 9543, Sunday, December 10, 2017 10:24:11
[DoS Attack: SYN/ACK Scan] from source: 173.194.76.197, port 80, Sunday, December 10, 2017 10:22:53
[DoS Attack: ACK Scan] from source: 34.226.121.43, port 9543, Sunday, December 10, 2017 10:22:45
[Time synchronized with NTP server] Sunday, December 10, 2017 10:22:43
[DoS Attack: ACK Scan] from source: 162.125.34.129, port 443, Sunday, December 10, 2017 10:22:31
[admin login] from source 192.168.1.24, Sunday, December 10, 2017 10:22:13
[DoS Attack: ACK Scan] from source: 54.174.142.142, port 9543, Sunday, December 10, 2017 10:22:11
[admin login failure] from source 192.168.1.24, Sunday, December 10, 2017 10:22:07
[DoS Attack: ACK Scan] from source: 54.192.136.34, port 443, Sunday, December 10, 2017 10:22:04
[DoS Attack: ACK Scan] from source: 162.125.34.129, port 443, Sunday, December 10, 2017 10:21:33
[Initialized, firmware version: V2.1.1.12] Sunday, December 10, 2017 10:21:14

[MrNoodles · Accepted solution]

@adeclaxton figure out the problem and my fix after two days hasn't shown any disconnect. Here are my steps to address make sure your firmware is up to date on both the main tower and secondary towers, make sure they are the same version. Then reset the routers to start fresh do not use same wifi name and such.... Also add devices one at a time to see if they are the cause of the disconnects. Overall last 24 hours has been solid.

[adeclaxton]

I have a similiar problem and see the same IP 173.194.76.197 in my logs 

[MrNoodles · Accepted solution]

@adeclaxton figure out the problem and my fix after two days hasn't shown any disconnect. Here are my steps to address make sure your firmware is up to date on both the main tower and secondary towers, make sure they are the same version. Then reset the routers to start fresh do not use same wifi name and such.... Also add devices one at a time to see if they are the cause of the disconnects. Overall last 24 hours has been solid.

[adeclaxton]

@MrNoodles I'll give it a try and report back. Mine has just come back online from a disconnect . 2nd one since reading this post

[MrNoodles]

I want to report back after a week updating firmware on orbi and resetting the device, I have had zero disconnects.