I have a distinct suspicion of what the cause of your semi-crash might be. If it is so, it's kind-of bad news:
SEC Consult Vulnerability Lab has discovered the flaw, which Ars
Techinca refers to as “amateurish,” in a driver referred to as NetUSB.
The driver, as its name suggests, is installed on routers to allow
computers to access USB devices over a network.
Sadly, the driver contains an error known as a buffer overflow, which
can occur when a device sends its name to the router and it’s longer
than 64 bytes. The researchers claim that the simple overflow can be
used to crash the router, using denial of service of attacks, and even
execute code remotely.
According to Ars Technica & the vulnerability testers who caught the bug, it's present in both WNDR v1 & WNDR v2. (The full list of routers believed to be affected is in that Gizmodo article.)
Now, to be clear this is just a suspicion; it's possible the unusual attack traffic (unusual to your router, at least) might just have coincidentally arrived about the time that your 2.4 network had its crash-like event. Without further log details of what was actually in the packets of the suspicious traffic, details that aren't going to be in a consumer-grade router's logs, it's perhaps impossible to say for sure. If the suspicious traffic reoccurs and your router immediately suffers subsequent issues, obviously the cause could then be known with more certainty. (Or if you were to capture some of that future traffic with a packet sniffer like Wireshark.)
You can try the check-for-updates capability wherever in exists in the UI there and see if Netgear has released a firmware update that patches the flaw/s. Sometimes consumer-grade router makers will act responsibly and do so. Sometimes.
On the plus side, I guess, if this is an attack the person or program that knocks out your router has a slight sense of humor, spoofing an IP address of Symantec as the attack source.
Ars has some more technical details on the vulnerability. It's really, really stupid:
This router-side driver listens to connections on TCP port 20005, and
it's this driver that contains a major security flaw. SEC Consult
Vulnerability Lab, which publicized the problem, discovered that the
Linux driver contains a simple buffer overflow. As part of the
communication between client and server, the client sends the name of
the client computer; if this name is longer than 64 bytes, the buffer
overflows. The company says that this overflow can be exploited to
enable both denial of service (crashing the router) and remote code
If this situation is one such DoS attack, is there anything you can actually do about any of this? Well, the obvious things for me to tell you are to try (1) disabling the USB port feature in the router UI and (2) try getting the router to block WAN traffic on port 20005, which is how the remote code that triggers the buffer overflow gets to your router. (Very roughly speaking, in non-technical terms.) Which might be good advice, except:
Netgear told SEC that even with NetUSB functionality disabled through
the router's configuration UI, the driver is still loaded, and there
is no ability either to disable it or to block access to port 20005 in
So...I'm sort of out of ideas at the moment. Maybe someone else has other suggestions. If this really is the result of the attack method described above...
Edit #2: Qualified my previous statement that this situation definitely is/was an example of an attack to exploit the vulnerability described in the answer. It might well be, but that is still, as the Scots might say, not proven.