RBR20 (RBK23) - constantly rebooting itself

[lentoc]

So my orbi system - 1 router, two satellites, worked like a dream for about 6 months. About a week ago I lose all my connections over 10-15x a day. 

FW version has been upgraded to V2.5.1.16 on all devices. no joy.

Factory default. Same issue. With just limited to a few devices and opened up to the entire network. No joy.

Settings changed  , mimo, beamforming, etc...channel 11,48 etc, no joy. CTS/RTS settings changed. No joy. As a matter of fact its actually cut my speed tests in half. MTU size was also changed.

Logs do show DOS attacks. Got two different IP addresses in the last week from Charter/Spectrum. Tonight got a new ip (which requires a new modem) and the problem came back 10 minutes after I was back online, which makes me find it hard to believe its an actual ddos. Here are some logs:(x'd out my ip address)

Time synchronized with NTP server] Tuesday, May 19, 2020 20:41:04
[DHCP IP: 192.168.1.10] to MAC address c4:9d:ed:ad:53:c6, Tuesday, May 19, 2020 20:40:57
[Internet connected] IP address: 24.xx.xx.xx, Tuesday, May 19, 2020 20:40:57
[admin login] from source 192.168.1.10, Tuesday, May 19, 2020 20:39:20
[DoS Attack: ACK Scan] from source: 157.240.2.15, port 443, Tuesday, May 19, 2020 20:38:53
[DHCP IP: 192.168.1.12] to MAC address cc:44:63:b7:4c:bc, Tuesday, May 19, 2020 20:38:40
[DHCP IP: 192.168.1.4] to MAC address 08:36:c9:0c:39:5f, Tuesday, May 19, 2020 20:38:23
[DHCP IP: 192.168.1.3] to MAC address 08:36:c9:0c:35:31, Tuesday, May 19, 2020 20:38:05
[DHCP IP: 192.168.1.8] to MAC address 40:26:19:1b:4d:c4, Tuesday, May 19, 2020 20:37:59
[DHCP IP: 192.168.1.10] to MAC address c4:9d:ed:ad:53:c6, Tuesday, May 19, 2020 20:37:56
[DHCP IP: 192.168.1.5] to MAC address f8:ff:c2:7d:42:4d, Tuesday, May 19, 2020 20:37:43
[DHCP IP: 192.168.1.18] to MAC address 40:99:22:cb:88:01, Tuesday, May 19, 2020 20:37:42
[DHCP IP: 192.168.1.11] to MAC address 4c:17:44:c0:1e:c8, Tuesday, May 19, 2020 20:37:34
[DHCP IP: 192.168.1.7] to MAC address a8:47:4a:f6:7f:af, Tuesday, May 19, 2020 20:37:33
[Initialized, firmware version: V2.5.1.16] Tuesday, May 19, 2020 20:36:55

The dos attacks are fairly confident. No idea when they started as logs only go back so far. Only been paying attention for a week or so. 

I have already RMA'd the rbr 20 as well and got it all synced up, but still have the same issue. Router is definitely rebooting itself. Does the pulsing white light thing while I am kicked out.

Have reached the end of my rope with netgear support and this whole thing in general. If anyone has any suggestions here, it would be greatly appreciated.

[FURRYe38]

What is the Mfr and model# of the Internet Service Providers modem/ONT the NG router is connected too?

You need to do a whois lookup on this address: 157.240.2.15

Have your ISP help you change the WAN IP address on your ISP modem/ONT. 

Does the RBR still reboot if you turn OFF The RBS? 

Any Wifi Neighbors near by? If so, how many?

---

@lentoc wrote:

So my orbi system - 1 router, two satellites, worked like a dream for about 6 months. About a week ago I lose all my connections over 10-15x a day. 

FW version has been upgraded to V2.5.1.16 on all devices. no joy.

Factory default. Same issue. With just limited to a few devices and opened up to the entire network. No joy.

Settings changed  , mimo, beamforming, etc...channel 11,48 etc, no joy. CTS/RTS settings changed. No joy. As a matter of fact its actually cut my speed tests in half. MTU size was also changed.

Logs do show DOS attacks. Got two different IP addresses in the last week from Charter/Spectrum. Tonight got a new ip (which requires a new modem) and the problem came back 10 minutes after I was back online, which makes me find it hard to believe its an actual ddos. Here are some logs:(x'd out my ip address)

Time synchronized with NTP server] Tuesday, May 19, 2020 20:41:04
[DHCP IP: 192.168.1.10] to MAC address c4:9d:ed:ad:53:c6, Tuesday, May 19, 2020 20:40:57
[Internet connected] IP address: 24.xx.xx.xx, Tuesday, May 19, 2020 20:40:57
[admin login] from source 192.168.1.10, Tuesday, May 19, 2020 20:39:20
[DoS Attack: ACK Scan] from source: 157.240.2.15, port 443, Tuesday, May 19, 2020 20:38:53
[DHCP IP: 192.168.1.12] to MAC address cc:44:63:b7:4c:bc, Tuesday, May 19, 2020 20:38:40
[DHCP IP: 192.168.1.4] to MAC address 08:36:c9:0c:39:5f, Tuesday, May 19, 2020 20:38:23
[DHCP IP: 192.168.1.3] to MAC address 08:36:c9:0c:35:31, Tuesday, May 19, 2020 20:38:05
[DHCP IP: 192.168.1.8] to MAC address 40:26:19:1b:4d:c4, Tuesday, May 19, 2020 20:37:59
[DHCP IP: 192.168.1.10] to MAC address c4:9d:ed:ad:53:c6, Tuesday, May 19, 2020 20:37:56
[DHCP IP: 192.168.1.5] to MAC address f8:ff:c2:7d:42:4d, Tuesday, May 19, 2020 20:37:43
[DHCP IP: 192.168.1.18] to MAC address 40:99:22:cb:88:01, Tuesday, May 19, 2020 20:37:42
[DHCP IP: 192.168.1.11] to MAC address 4c:17:44:c0:1e:c8, Tuesday, May 19, 2020 20:37:34
[DHCP IP: 192.168.1.7] to MAC address a8:47:4a:f6:7f:af, Tuesday, May 19, 2020 20:37:33
[Initialized, firmware version: V2.5.1.16] Tuesday, May 19, 2020 20:36:55

The dos attacks are fairly confident. No idea when they started as logs only go back so far. Only been paying attention for a week or so. 

I have already RMA'd the rbr 20 as well and got it all synced up, but still have the same issue. Router is definitely rebooting itself. Does the pulsing white light thing while I am kicked out.

Have reached the end of my rope with netgear support and this whole thing in general. If anyone has any suggestions here, it would be greatly appreciated.

---

[lentoc]

Charter/Spectrum is the ISP
Modem = Hitron technologies E31N2V1

I have had two new modems since this started accompanied with two IP address changes. The problems return almost immediately and thus I don’t think I’m truly under a ddos attack or anything like that. Lot of the message board reading leads me to believe false positives.

Who is returns always to Facebook.

Live in a populated suburb so lots of WiFi around.

Haven’t tried system without both satellites turned on. Hasn’t been suggested by netgear support either. I can try that today.

Uploaded file is the whois info on that ip. But let’s be clear there are many ips and logs that show the same info. All that I checked lead back to Facebook.

[FURRYe38]

Also try turning down the power output of the RBRs wifi radios from 100% to 50% and see if this changes anything. Under Advanced Tab/Advanced Settings/Wireless Settings

[lentoc]

So i set the radios to 50% a few hours ago and it continues to reboot. 

Will try the satellite removal here shortly and see if that makes a difference. 

Does netgear do rma up to one year.? This is getting crazy. 

[lentoc]

Ok so radios ar half power now and one satellite removed from mix. Uptime is 17 minutes now so we will see how long it lasts. Here is fresh router log...

admin login] from source 192.168.1.12, Wednesday, May 20, 2020 20:34:23
[DoS Attack: RST Scan] from source: 34.98.102.181, port 1883, Wednesday, May 20, 2020 20:32:09
[DoS Attack: ACK Scan] from source: 3.132.204.55, port 443, Wednesday, May 20, 2020 20:31:38
[DoS Attack: SYN/ACK Scan] from source: 185.209.179.76, port 25461, Wednesday, May 20, 2020 20:29:54
[DoS Attack: ACK Scan] from source: 3.132.204.55, port 443, Wednesday, May 20, 2020 20:28:38
[DoS Attack: SYN/ACK Scan] from source: 185.209.176.22, port 25461, Wednesday, May 20, 2020 20:25:51
[DoS Attack: ACK Scan] from source: 3.132.204.55, port 443, Wednesday, May 20, 2020 20:25:38
[DHCP IP: 192.168.1.12] to MAC address d0:4f:7e:5d:2d:1a, Wednesday, May 20, 2020 20:25:08
[DHCP IP: 192.168.1.6] to MAC address 4c:17:44:c0:1e:c8, Wednesday, May 20, 2020 20:23:22
[DoS Attack: ACK Scan] from source: 17.248.132.54, port 443, Wednesday, May 20, 2020 20:23:15

[lentoc]

Symptoms still present with and without satellites. 

[FURRYe38]

What are the CPU usage value seen here: 192.168.1.1/debug.htm with the RBS disconnected. Then look again with the RBS connected. 

Might contact NG support and see what RMA options are avialable to you.

@Blanca_O