Reply
Highlighted
Tutor

orbi network turn of by dos attack

Hi,

My orbi system turn off a view time's a week. When I take a look at the log file there is a dos attack standing on that time. 

I'm using:

firmware version 2.3.5.30

orbi system RBR50

 

can someone help me out?

 

Model: RBR50|Orbi AC3000 Tri-band WiFi Router
Message 1 of 24
Highlighted
Sensei

Re: orbi network turn of by dos attack

My experience (since I began saving Orbi logs on two systems last March) is that the Orbi recognizes dozens of what it characterizes as "DOS Attacks" every day.  Already since Jan 1, my Orbi has logged 82.  Last fall, there was a period of about a week when the number of attempts was 3-4 times "normal".  Yet, my Orbi never goes down.  One of the things that annoys users is that when the Orbi "reboots", the log file is erased, and thus does not record "what happened".

 

So, I have no doubt that you are correct that the Orbi is having a problem several times a week, and it can be a struggle to identify and resolve the problem.  The DOS attacks that are recorded are entirely normal and are not likely to be the cause.  As an example, my  phone gets 20-30 "robocalls" every day.  Yet, if my phone service goes down, it is not likely to be the robocalls that caused it.

 

We generally start by asking:

  • What firmware release is on the Orbi now?
    (and, no, we are not asking you to "update firmware".  sometimes that is the wrong thing to do.)
  • What brand and model of modem is the Orbi connected to?
  • Is there a distinct "pattern" to the service interruption?
    (once a day?  2-4 times a day?)
  • Is there a distinct pattern to how long it is before the Orbi fails from the time you restart it?

 

I love my Orbi.
Message 2 of 24
Highlighted
Tutor

Re: orbi network turn of by dos attack

the firmware version is V2.3.5.30

the brand of the modem is one of my provider

and there is not something like a pattern to the service interruption.

sometimes it happens twice a day and sometimes it works good for a whole week. 

Model: RBR50|Orbi AC3000 Tri-band WiFi Router
Message 3 of 24
Highlighted

Re: orbi network turn of by dos attack

Anyway to block external ip addresses being tagged as Dos attackers?
Message 4 of 24
Highlighted
Sensei

Re: orbi network turn of by dos attack

The Orbi is "blocking" those attempts already.   The only way to keep them from reaching the Orbi is at the ISP, and my experience is that is something they are not set up to do.  When my phone says an incomming call is "Listed as a telemarketer", the call has already arrived.

 

You can instruct the Orbi to stop logging these nuisances.  They will still be there, but you will not be told about them.  All of the annoying robocalls that come to my phone and do not leave a message appear in my "Missed Calls" list.  I choose not to scroll through the list of "missed calls", but those calls still happened.

 

It is not acceptable when a WiFi router fails often.  My Orbi stays up and running for months despite all of these things being logged.  If the Orbi is having to be rebooted often, I am very confident (1) there is a problem, and (2) the problem is not these DoS attempts in the log file.

I love my Orbi.
Message 5 of 24
Highlighted
Tutor

Re: orbi network turn of by dos attack

I did a reinstall last weekend but today there was the same problem as before. 

So the problem is still there.

Model: RBR50|Orbi AC3000 Tri-band WiFi Router
Message 6 of 24
Highlighted
Guru

Re: orbi network turn of by dos attack

What is the Mfr and model# of the ISP modem the NG router is connected too? Built in router here by chance? 

 

You might update to v2.5.1.8, factory reset and setup from scratch and see if this changes anything. 


@Z190mn wrote:

I did a reinstall last weekend but today there was the same problem as before. 

So the problem is still there.


 


My Setup (Cable 900Mbps/50Mbps)>CAX80>XR450 v2.3.2.106(Router Mode)
Additional NG HW: C7800/CM1100/CM1200/CM2000, Orbi CBK40, RBK853, R7800, R7960P,
EX7500/EX7700, XR450 and WNHDE111
Message 7 of 24
Highlighted
Tutor

Re: orbi network turn of by dos attack

I did the factory reset a view weeks ago. after that I did the firmware update to v2.5.1.8. 

But there is still the same problem that the orbi system reboot a view times a week. knows someone a fix for this problem?

Model: RBK53|Orbi AC3000 Tri-band WiFi System
Message 8 of 24
Highlighted
Guru

Re: orbi network turn of by dos attack

What is the Mfr and model# of the ISP modem the NG router is connected too? Built in router here by chance? 

 

Any Wifi Neighbors near by? If so, how many?

 


My Setup (Cable 900Mbps/50Mbps)>CAX80>XR450 v2.3.2.106(Router Mode)
Additional NG HW: C7800/CM1100/CM1200/CM2000, Orbi CBK40, RBK853, R7800, R7960P,
EX7500/EX7700, XR450 and WNHDE111
Message 9 of 24
Highlighted
Tutor

Re: orbi network turn of by dos attack

We have a modem from a dutch provider. And the modem is in bridge mode. 

This is an URL to the specifications: https://nl.hardware.info/routers.9/compal-ch7465lg-zg-ziggo-connect-box.371250

 

There are a view other wifi connections nearby, but if I check this on my phone I count 4. So I don't think that's the problem. 

 

Model: RBK53|Orbi AC3000 Tri-band WiFi System
Message 10 of 24
Highlighted
Guru

Re: orbi network turn of by dos attack

I would try this:

Configure the ISP modem back to router mode. Disable all wifi radios on the modem and connect the Orbi router to the modem, configure AP mode on the Orbi router. https://kb.netgear.com/31218/How-do-I-configure-my-Orbi-router-to-act-as-an-access-point and https://www.youtube.com/watch?v=H7LOcJ8GdDo&app=desktop


My Setup (Cable 900Mbps/50Mbps)>CAX80>XR450 v2.3.2.106(Router Mode)
Additional NG HW: C7800/CM1100/CM1200/CM2000, Orbi CBK40, RBK853, R7800, R7960P,
EX7500/EX7700, XR450 and WNHDE111
Message 11 of 24
Highlighted
Tutor

Re: orbi network turn of by dos attack

I tried what you just said. This works good for a view days but after that the orbi had the same problem as before. 

So I don't think that this is the good solution.

Model: RBK53|Orbi AC3000 Tri-band WiFi System
Message 12 of 24
Highlighted
Guru

Re: orbi network turn of by dos attack

Have you changed the WiFi SSID and Pasword on the RBR? 

 

Seems like something is going after the Orbi or there is some interferences.

What channels are you using? Auto? Try setting manual channel 1, 6 or 11 on 2.4Ghz and any unused channel on 5Ghz.
Any Wifi Neighbors near by? If so, how many?

Try enabling Beamforming and MIMO(MIMO may or maynot be needed) and WMM. Under Advanced Tab/Advanced Settings/Wireless Settings

Try disabling the following and see:
Armor, Circle, Daisy Chain, Fast Roaming, IPv6 and Set 20/40Mhz Coexistence to 40Mhz only. Save settings and reboot the router and satellite(s).

Above suggestions working:
https://community.netgear.com/t5/Orbi/Throttling-Devices-RBK53/m-p/1858561/highlight/true#M81925

 


My Setup (Cable 900Mbps/50Mbps)>CAX80>XR450 v2.3.2.106(Router Mode)
Additional NG HW: C7800/CM1100/CM1200/CM2000, Orbi CBK40, RBK853, R7800, R7960P,
EX7500/EX7700, XR450 and WNHDE111
Message 13 of 24
Highlighted
Tutor

Re: orbi network turn of by dos attack

sorry for the delay. 

I have tried but non of the things are working. Smiley Sad

I had taked a look for all the channels what my neighbors but there are a view different channels.

 

Model: RBK53|Orbi AC3000 Tri-band WiFi System
Message 14 of 24
Highlighted
Guru

Re: orbi network turn of by dos attack

You may want to contact NG support. 

https://www.netgear.com/support/#


My Setup (Cable 900Mbps/50Mbps)>CAX80>XR450 v2.3.2.106(Router Mode)
Additional NG HW: C7800/CM1100/CM1200/CM2000, Orbi CBK40, RBK853, R7800, R7960P,
EX7500/EX7700, XR450 and WNHDE111
Message 15 of 24
Highlighted
Aspirant

Re: orbi network turn of by dos attack

I have the same problems with a simular setup both in router and DHCP mode.

Firmware Version   V2.5.1.8

The router resets several times a day, the only logging is a dos attack.

 

Model: RBR50|Orbi AC3000 Tri-band WiFi Router
Message 16 of 24
Highlighted
Guru

Re: orbi network turn of by dos attack

What is the Mfr and model# of the ISP modem the NG router is connected too?

Has a factory reset and setup from scratch been performed since last FW update? Try this. 

Reboot or power cycle all network devices as well after the reset. 

Power OFF the ISP modem for 1 minute then back ON and then setup the RBR. 


@Spider4 wrote:

I have the same problems with a simular setup both in router and DHCP mode.

Firmware Version   V2.5.1.8

The router resets several times a day, the only logging is a dos attack.

 


 


My Setup (Cable 900Mbps/50Mbps)>CAX80>XR450 v2.3.2.106(Router Mode)
Additional NG HW: C7800/CM1100/CM1200/CM2000, Orbi CBK40, RBK853, R7800, R7960P,
EX7500/EX7700, XR450 and WNHDE111
Message 17 of 24
Highlighted
Aspirant

Re: orbi network turn of by dos attack

The netgear orbi router RBR50v2 is connected to Eurodocsis 3.0 modem.

I did factory reset of router and modem, to test the setup in orbi in router and dhcp mode.

The result is both negative.

Model: RBR50|Orbi AC3000 Tri-band WiFi Router
Message 18 of 24
Highlighted
Guru

Re: orbi network turn of by dos attack

Where are these attacks coming from? Is the IP addresses a external address or an internal address? 

Try downloading v30 FW on the RBR to see if this changes anything...


@Spider4 wrote:

The netgear orbi router RBR50v2 is connected to Eurodocsis 3.0 modem.

I did factory reset of router and modem, to test the setup in orbi in router and dhcp mode.

The result is both negative.


 


My Setup (Cable 900Mbps/50Mbps)>CAX80>XR450 v2.3.2.106(Router Mode)
Additional NG HW: C7800/CM1100/CM1200/CM2000, Orbi CBK40, RBK853, R7800, R7960P,
EX7500/EX7700, XR450 and WNHDE111
Message 19 of 24
Highlighted
Aspirant

Re: orbi network turn of by dos attack

example: in DHCP mode

[DOS Attack: RST Scan] from 151.139.242.13, port 443 ......

[DOS Attack: ACK Scan] from 212.123.200.220, port 220 ......

[DOS Attack: ACK Scan] from 212.123.200.220, port 220 ......

 

example: in router mode

[DOS Attack: RST Scan] from 17.179.252.32, port 443 ......

 

 

Message 20 of 24
Highlighted
Aspirant

Re: orbi network turn of by dos attack

sorry 2 typo's in the port; port is always 443

 

example: in DHCP mode

[DOS Attack: RST Scan] from 151.139.242.13, port 443 ......

[DOS Attack: ACK Scan] from 212.123.200.220, port 443 ......

[DOS Attack: ACK Scan] from 212.123.200.220, port 443 ......

 

example: in router mode

[DOS Attack: RST Scan] from 17.179.252.32, port 443 ......

 

Message 21 of 24
Highlighted
Guru

Re: orbi network turn of by dos attack

You might check those IPs with a whois web site. 

Ask your ISP to give you a different WAN IP address to see if the attacks stop. 

 


My Setup (Cable 900Mbps/50Mbps)>CAX80>XR450 v2.3.2.106(Router Mode)
Additional NG HW: C7800/CM1100/CM1200/CM2000, Orbi CBK40, RBK853, R7800, R7960P,
EX7500/EX7700, XR450 and WNHDE111
Message 22 of 24
Highlighted
Aspirant

Re: orbi network turn of by dos attack

I have asked for the helpdesk for support and after a clean installation all works again.

Message 23 of 24
Highlighted
Guru

Re: orbi network turn of by dos attack

Be sure to do a backup configuration to file for safe keeping. Saves time if a reset is needed. 

 

Enjoy. Smiley Wink


@Spider4 wrote:

I have asked for the helpdesk for support and after a clean installation all works again.


 


My Setup (Cable 900Mbps/50Mbps)>CAX80>XR450 v2.3.2.106(Router Mode)
Additional NG HW: C7800/CM1100/CM1200/CM2000, Orbi CBK40, RBK853, R7800, R7960P,
EX7500/EX7700, XR450 and WNHDE111
Message 24 of 24
Top Contributors
Discussion stats
  • 23 replies
  • 1320 views
  • 1 kudo
  • 5 in conversation
Announcements