dslreports logo
site
 
    All Forums Hot Topics Gallery
spc

spacer




how-to block ads


Search Topic:
uniqs
834
share rss forum feed


pchy

join:2002-08-12
Newport, OR

[Connectivity] Modem resets

Hello,
Our modem keeps resetting. We have tried:
-Connecting it directly to the cable wire from the outside: no change
-Connected to only 1 computer on the inside: no change
-Unplugged it for more than 30 minutes, then reconnected (multiple times): no change

I can see the log shows a lot of time outs in Unicast, Tod, and SYNC Timing. I also see on the firewall some SYN Floods with 20+ connection attempts.

I'm wondering if we have a virus on the inside. Does SL disconnect infected users?

I can also see outside that there is a green box

Here are my connection numbers, cable EventLog, and Firewall log. Any help in narrowing this down is appreciated!


gatorkram
Need for Speed
Premium
join:2002-07-22
Winterville, NC
kudos:3
Your upstream power looks high, which could be causing resets and loss of sync.
--
What the heck is a GatorKram? »www.gatorkram.com


moldypickle

join:2009-01-04
Haughton, LA
kudos:3
Reviews:
·Suddenlink
Power levels are fine, upstream doesn't cause a restart condition until about 56~58db.

Shoot SDL3tech an email and see if he can see any problems in your area/with your line.

Have you tried getting in contact with phone/chat support yet either?
--
50/3 Suddenlink : Current
5/1 CMA : Old
15/2 TWC : Old


gatorkram
Need for Speed
Premium
join:2002-07-22
Winterville, NC
kudos:3
Brain fart on that upstream power limit. Even my own levels are higher than 50 sometimes, lol
--
What the heck is a GatorKram? »www.gatorkram.com


SDL L3Tech

join:2011-06-07
Tyler, TX
kudos:28
reply to pchy
At a glance the node looks clean. The syn floods are a type of denial of service attack and could be the cause of the disconnects, especially since it's an all-in-one modem.

However, at this time I am unable to ping your modem. When I remotely reset it I can ping it for about 10 seconds as it registers but then it starts timing out again. I have also seen it re-register twice with an abnormal status and what looked like a partial config file. Your neighbor's modems are not having this problem. I believe your modem may be having problems and suggest taking it to the local office to swap it out as the next step of troubleshooting.


pchy

join:2002-08-12
Newport, OR
Hi, thanks for the reply. Ping response is disabled from WAN, could that be why you wouldn't get a response? (or do you have another method?)

The fact that my neighbors' modems are working does support that it's something on our end though. There is one of those green utility boxes in the back yard (one of the tall square-ish ones like this: »1.bp.blogspot.com/-tXVzMUJk7FI/U···box1.jpg). It looks like some kids pulled off the cover and pulled out wires. Could that be the source of just our trouble, or would that affect our neighbors as well?


pchy

join:2002-08-12
Newport, OR
reply to SDL L3Tech
Also, is there a way to get a new IP from SuddenLink to stop the DoS attacks (if that's what they are) at least temporarily to test?


SDL L3Tech

join:2011-06-07
Tyler, TX
kudos:28
said by pchy:

Ping response is disabled from WAN, could that be why you wouldn't get a response?

I am pinging the cable side of the modem which has a private IP that we use for provisioning. I should always be able to ping that IP.

said by pchy:

It looks like some kids pulled off the cover and pulled out wires.

Wow, that looks fantastic. I do not know if that would be the cause of the problem but it would be best if you called in to report it and have someone come out to clean it up.

said by pchy:

is there a way to get a new IP from SuddenLink to stop the DoS attacks (if that's what they are) at least temporarily to test?

This question is two fold. First of all the DHCP will try to give you the same IP every time and is based on the WAN port's MAC address. If you change your modem (because it's a combo), change its MAC address, or leave it offline for I believe 24h, then you should pull a different IP.

However, DOS attacks are not necessarily random. If someone is targeting you then they likely got your IP from somewhere that you visited such as a website or forum. If, for example, that is the case and you change your IP, then when you log into the forum again then the attacker will have your new IP and the DOS will likely follow to your new IP.

I'd like to see your modem swapped as the next step since I am seeing the packet-loss to the modem side and the abnormal status. If it's a rental then the local office should replace it without any hassle.


pchy

join:2002-08-12
Newport, OR
Thanks for the info. This is really helpful.

The modem is ours, but they're going to send a tech out to check things out tomorrow. I'll update the forum when I have new info in case others have similar trouble.


pchy

join:2002-08-12
Newport, OR
double post


pchy

join:2002-08-12
Newport, OR
The tech came out and redid all the connectors. Our power levels and SNR improved on all lines. The modem was still disconnecting though. The tech claimed that our house wiring is causing the problem and we need an electrician (!!). That sounds very suspect to me; While I understand it's plausible, we've had the same house, modem, and service for years. Not sure how the house wiring would all of the sudden cause problems. Is this legitimate?

We tried to get a new modem, but the office insisted on sending a tech, so back to the office we go today to get a new modem.

More to come...


SDL L3Tech

join:2011-06-07
Tyler, TX
kudos:28

3 edits
Thanks for the update. I do not believe it is a signal problem with the symptoms I saw. It had flawless pings during the registration process but once it completes registration, I saw severe packet-loss.

Edit: Your modem shows offline at this time so I am not able to recheck the symptom.


pchy

join:2002-08-12
Newport, OR

2 recommendations

You were right the first time... the new modem seems to have solved the issue. So far today we have not seen a single disconnect and I'm able to open 5+ non-cached pages at the same time without disconnecting.

I'll post if anything changes. Thank you for your help.


SDL L3Tech

join:2011-06-07
Tyler, TX
kudos:28
reply to pchy
My pings are now flawless to the modem. Glad I could help!


pchy

join:2002-08-12
Newport, OR
reply to pchy
The problem seems to be back. I can see on my router logs that we're really being hammered by 2 IPs. One appears to be a SuddenLink address:
66.76.232.14 (Suddenlink?)
173.219.229.76 (and various other 173.219.*.* variations).

Besides blocking with a firewall, can SuddenLink block that IP for us? Is there anything else I can do to troubleshoot this?


SDL L3Tech

join:2011-06-07
Tyler, TX
kudos:28
I am not seeing any packet-loss at this time to your modem. I presume the problem is not happening now. How long did it last?

Both of the IPs you mentioned are link addresses of two different circuits and should not be generating any traffic so the source IPs may be spoofed. Would you upload the router logs to a service like »pastebin.com/ and private message me the link to it so I can see them?

FLAGCMTK01#ping [ip removed] repeat 1000000

Type escape sequence to abort.
Sending 1000000, 100-byte ICMP Echos to [ip removed], timeout is 2 seconds:
Success rate is 100 percent (14189/14189), round-trip min/avg/max = 4/7/15 ms