F5F Stay Refreshed Power Users Networks Internet connection problems are becoming more common.

Internet connection problems are becoming more common.

Internet connection problems are becoming more common.

G
53
01-27-2016, 12:22 PM
#1
Hello, roughly three to four days back my internet performance dropped sharply. Usually I experience about 600KB/s down and 100KB/s up. Don’t be silly. Right now I’m dealing with frequent drops and only around 50KB/s either way. I’ve contacted my ISP several times but they haven’t offered any solution. They mentioned static on the phone line, which suggests a possible broken segment. A Telstra representative is visiting to investigate. If the issue lies outside my home, they’ll cover the callout cost. If it’s within my building (like an ADSL filter or setup error), I’ll be billed for that.

I reviewed the Netgear DGN2200 logs and noticed what the modem identifies as Denial of Service attacks. Others have pointed out that Netgear’s software tends to be quite cautious. It seems odd that my speed is being crippled while I’m getting hundreds of DoS alerts at once. Some of the IPs I checked belong to Chinese mobile firms, Facebook, Yahoo, Microsoft, an NZ provider, and Apple. Many logs show activity mainly during nighttime or when people are away from home (work, school).

Could these “DoS” attempts be behind my problems? If so, I need to figure out what triggered them four days ago and find a way to stop the random requests. What do others think about this situation? Any ideas or fixes for what’s happening? The modem log is here: https://pastebin.com/0vdE1D3w
G
goldengaming33
01-27-2016, 12:22 PM #1

Hello, roughly three to four days back my internet performance dropped sharply. Usually I experience about 600KB/s down and 100KB/s up. Don’t be silly. Right now I’m dealing with frequent drops and only around 50KB/s either way. I’ve contacted my ISP several times but they haven’t offered any solution. They mentioned static on the phone line, which suggests a possible broken segment. A Telstra representative is visiting to investigate. If the issue lies outside my home, they’ll cover the callout cost. If it’s within my building (like an ADSL filter or setup error), I’ll be billed for that.

I reviewed the Netgear DGN2200 logs and noticed what the modem identifies as Denial of Service attacks. Others have pointed out that Netgear’s software tends to be quite cautious. It seems odd that my speed is being crippled while I’m getting hundreds of DoS alerts at once. Some of the IPs I checked belong to Chinese mobile firms, Facebook, Yahoo, Microsoft, an NZ provider, and Apple. Many logs show activity mainly during nighttime or when people are away from home (work, school).

Could these “DoS” attempts be behind my problems? If so, I need to figure out what triggered them four days ago and find a way to stop the random requests. What do others think about this situation? Any ideas or fixes for what’s happening? The modem log is here: https://pastebin.com/0vdE1D3w

C
CardsGirl
Junior Member
3
01-29-2016, 05:08 AM
#2
I have no background in modems, yet the signals passing through seem like phones transmitting messages to servers or apps such as Facebook.
C
CardsGirl
01-29-2016, 05:08 AM #2

I have no background in modems, yet the signals passing through seem like phones transmitting messages to servers or apps such as Facebook.

L
LooseDawg
Senior Member
628
01-30-2016, 10:27 AM
#3
It seems unusual that the return traffic appears from a remote web service. The TCP 443 connection usually indicates browsing activity on most sites. It’s possible the router thinks the session has ended, but the server might still send RST/ACK to close it or provide more data. Because the session was closed early, this could suggest an attack. Have you installed any firmware updates recently? If so, consider resetting the device using factory settings and entering DSL credentials on the admin page, or replacing the hardware.
L
LooseDawg
01-30-2016, 10:27 AM #3

It seems unusual that the return traffic appears from a remote web service. The TCP 443 connection usually indicates browsing activity on most sites. It’s possible the router thinks the session has ended, but the server might still send RST/ACK to close it or provide more data. Because the session was closed early, this could suggest an attack. Have you installed any firmware updates recently? If so, consider resetting the device using factory settings and entering DSL credentials on the admin page, or replacing the hardware.