1

Posted this on Netgear forums but decided to get insights here too:

I have an interesting problem here. Not sure if someone is trying to hack me, if this is some weird router behavior, or what is going on. I contacted my ISP, they confirm there is no capping on my plan.

I had a Netgear WNR2000v3 router. I purchased a R6400 replacement router because I was having the router frequently drop my LAN connectivity. What is interesting is a work router hangs off the Netgear, and that router does NOT lose Internet or even briefly drop the VPN - even though it drops everything else - my IP cameras (wired & wireless), and I was unable to log into the router from the desktop (wired). In fact, after restarting the router I was locked out from the 192.168.1.1 / routerlogin.net interface as it "forgot" my password. Hince why I bought the new router.

Well, after just 36 hours, and 20 GB of data downloaded - it happened again. on the R6400. Latest firmware - literally - V1.0.1.18_1.0.15 - due to the whole CVE vulnerability I decided not to even risk having it hooked up until it was updated. Totally new Internet IP. Even set up new SSH keys. SSH is key only no password, so someone can't try brute force to get in.

This is particularly annoying because I tunnel SSH to my Linux box over the router, and the SSH session is completely down when it drops the LAN. The cable modem does not drop at all. I am a data hog so to speak - I wrote some shell scripts for my Linux box that downloads weather data from the National Weather Service public servers - on the order of ~20 GB/day / 500-750 GB/month. NOTE - This problem started about a week after I increased my downloading from 2 GB/day to 20 GB/day.

From a weird perspective, it's almost like someone is trying to "knock my LAN offline" - or these routers have some "data abuse prevention" built in to prohibit heavy data use. I do have the Traffic Meter turned on to monitor data use, but it's set to no limit and no monthly limit. Again, ISP has absolutely no cap - Spectrum, formerly Road Runner. Or at least, they "tell me that" - they could be sending some kill packet for all I know?

Router logs are useless - the second it drops the WAN and I have to reboot, the logs reset. I can't get into the router at all when it does this behavior. I used my cell phone to run nmap on my Internet facing IP - it's locked down to only the port I need open for SSHing to my Linux gaming/programming rig.

I am thinking of trying to get a tcpdump running next time I get near the 20 GB "threshold" to see what may be happening.

  • 1
    Wild guess, but your camera/dvr is probably part of a botnet – wireghoul Jan 23 '17 at 6:13
  • I don't think that is too likely. Everything is natted, no IPv6. Only the non-standard SSH port to outside world is passing throigh the router. Desktop shell script wgets the images to computer every half second, makes a mp4 every 2 mins, and I just access that feed via PHP/Apache2 over the tunnel. IP cams only accept connection from desktop IP. – user3260912 Jan 23 '17 at 13:26
  • Sounds like unreliable hardware. What kind of environment is it in? Is it adequately ventilated? – SDsolar Jul 24 '17 at 19:22
1

I found out the problem several months ago. I had a lot of scripts which were downloading data. When the Internet was breifly unavailable these scripts had the curl -retry flag set to 5. Due to the nature of curl delaying the retry exponentially, it created a fork bomb which in turn crashed the network stack. -retry was set to 0 and the problem resolved it's self.

  • Fork bombs will definitely stop things dead in their tracks. – SDsolar Jul 24 '17 at 19:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.