 HankIts all relativePremium
join:2002-05-21
Burlington, WV | USg-100 was it hacked For the last couple mornings my LAN has stopped because port 4 (lan1) is down. The logs for the first two days only showed the port down and then the router returned to normal service. Today apps were added and firewall rules showed being modified (see attached zip file). Did my router get hacked? If so any ideas? |
|
| Make sure you changed the default SNMP read/write passwords if SNMP is available from WAN.
And you could also change the password on the device, just to make sure.
--
"Perl is executable line noise, Python is executable pseudo-code."
|
|
|
|
HankIts all relativePremium
join:2002-05-21
Burlington, WV
1 edit | Thanks, all have been changed. Hopefully it is just precautionary. I also noticed a generic credential in the Windows 7 Credential Manager and it has been deleted. Second thought that Windows 7 machine would not have had any impact as it was not on during the first two events. |
|
HankIts all relativePremium
join:2002-05-21
Burlington, WV | Ok, I think I have ruled out any hacking. It appears to be something with the USG-100. Port 4 went down again this morning but for a shorter period of time. I have reviewed the logs for an additional few days and I see where it started with port 3 going down then port 3 stopped; then port 4 started going down with no further occurrence of port 3 going down. I have not seen where any other ports have gone down. Have to do further investing to find out whether it is the USG-100 hardware causing the issue or something else. |
|
| Is there anything connected to port 4? |
|
HankIts all relativePremium
join:2002-05-21
Burlington, WV | Yes, I have a switch connected to port 4. I have spared the switch. Switch has a NAS, PC, Printer, and an WHS connected to it. |
|
| reply to Hank
In addition to it might be a problem with the USG, it could be an IOP issue with the switch chips in the USG and switch.
Try to disable auto detection of speed and duplex on the usg port and switch port. Set it to the same on both ports and see if the problem persists.
Do you have any thing like Spanning three etc running?
--
"Perl is executable line noise, Python is executable pseudo-code."
|
|
HankIts all relativePremium
join:2002-05-21
Burlington, WV
1 edit | No Spanning three etc running. I tried several things without results finally reloaded the firmware. So far so good; will see how it goes.
Update: Lasted for about 45 minutes, then port went down and would not come back up. I had previously replaced the switch but I did not replace the switch power supply. replaced swith power supply and unit came back up. Power supply was not suppling the specified 12 VDC, was down to 11 VDC. Opend power supply and it has a capacitor with swollen top. Hopefully this resolves the issue once and for all. |
|
