Posted this on Netgear forums but decided to get insights here too:
I have an interesting problem here. Not sure if someone is trying to hack me, if this is some weird router behavior, or what is going on. I contacted my ISP, they confirm there is no capping on my plan.
I had a Netgear WNR2000v3 router. I purchased a R6400 replacement router because I was having the router frequently drop my LAN connectivity. What is interesting is a work router hangs off the Netgear, and that router does NOT lose Internet or even briefly drop the VPN - even though it drops everything else - my IP cameras (wired & wireless), and I was unable to log into the router from the desktop (wired). In fact, after restarting the router I was locked out from the 192.168.1.1 / routerlogin.net interface as it "forgot" my password. Hince why I bought the new router.
Well, after just 36 hours, and 20 GB of data downloaded - it happened again. on the R6400. Latest firmware - literally - V18.104.22.168_1.0.15 - due to the whole CVE vulnerability I decided not to even risk having it hooked up until it was updated. Totally new Internet IP. Even set up new SSH keys. SSH is key only no password, so someone can't try brute force to get in.
This is particularly annoying because I tunnel SSH to my Linux box over the router, and the SSH session is completely down when it drops the LAN. The cable modem does not drop at all. I am a data hog so to speak - I wrote some shell scripts for my Linux box that downloads weather data from the National Weather Service public servers - on the order of ~20 GB/day / 500-750 GB/month. NOTE - This problem started about a week after I increased my downloading from 2 GB/day to 20 GB/day.
From a weird perspective, it's almost like someone is trying to "knock my LAN offline" - or these routers have some "data abuse prevention" built in to prohibit heavy data use. I do have the Traffic Meter turned on to monitor data use, but it's set to no limit and no monthly limit. Again, ISP has absolutely no cap - Spectrum, formerly Road Runner. Or at least, they "tell me that" - they could be sending some kill packet for all I know?
Router logs are useless - the second it drops the WAN and I have to reboot, the logs reset. I can't get into the router at all when it does this behavior. I used my cell phone to run nmap on my Internet facing IP - it's locked down to only the port I need open for SSHing to my Linux gaming/programming rig.
I am thinking of trying to get a tcpdump running next time I get near the 20 GB "threshold" to see what may be happening.