topic Re: Broadband dropping - had engineer to no avail in Broadband

Broadband dropping - had engineer to no avail

Crazyflum — Mon, 11 Sep 2023 17:32:52 GMT

Hi there, (I am a total noob at networking, so be prepared!)

I have recently (Roughly 2 months) been experiencing our home network dropping at random times of the day. I will often be gaming or doing something on my phone when it completely drops our broadband signal.

We've recently changed the router since we had an engineer out, and we changed from the hub one to the hub 2 router.

When the signal drops, the light on the router will always be flashing orange - "your hub is working but the broadband signal can't be detected"

I have also looked onto my router event log and seen some things that have rung alarm bells...

14:00:01, 11 Sep.

DoS(Spoofing): IN=ppp1 OUT= MAC= src=*** DST=*** LEN=60 TOS=0x00 PREC=0x00 TTL=** ID=**** DF PROTO=TCP SPT=**** DPT=**** WINDOW=0 RES=0x00 URG ACK PSH RST SYN FIN URGP=***** MARK=0x8000000

12:00:01, 11 Sep.

DoS(Port Scanning): IN=ppp1 OUT= MAC= src=**** DST=**** LEN=60 TOS=0x00 PREC=0x00 TTL=*** ID=**** DF PROTO=TCP SPT=17570 DPT=38127 WINDOW=0 RES=0x00 URG ACK PSH RST SYN FIN URGP=**** MARK=0x8000000

Followed by loads of :

Port forwarding rule added via UPnP/TR064. Protocol: UDP, external ports: any->22606, internal ports: 22606, internal client: ***

Any help or insight will be really useful..

Thanks, Peter.

Any time I used *** I blanked something out, be it an ID or IP

Re: Broadband dropping - had engineer to no avail

Dan_the_Van — Mon, 11 Sep 2023 18:48:58 GMT

Hi @Crazyflum welcome to the forum

I wouldn't be to bothered about those messages I see them regularly

19:00:01, 11 Sep.

DoS(Port Scanning): IN=ppp1 OUT= MAC= src=129.126.98.222 DST=<my public IP> LEN=60 TOS=0x00 PREC=0x00 TTL=55 ID=52150 DF PROTO=TCP SPT=3649 DPT=17828 WINDOW=0 RES=0x00 URG ACK PSH RST SYN FIN URGP=20865 MARK=0x8000000

19:00:01, 11 Sep.

DoS(Spoofing): IN=ppp1 OUT= MAC= src=129.126.98.222 DST=<my public IP> LEN=60 TOS=0x00 PREC=0x00 TTL=55 ID=52150 DF PROTO=TCP SPT=3649 DPT=17828 WINDOW=0 RES=0x00 URG ACK PSH RST SYN FIN URGP=20865 MARK=0x8000000

The src=would be helpful as that is source IP Address of the port scan, some organisations do this for research purposes.

EDIT: these messages are the firewall reporting it's doing it's job

Port forwarding rule is by added by an internal device on your network, any idea what that may be.

You can turn off UPnP rules being added by disabling UPnP found in firewall settings.

http://192.168.1.254 Advanced settings >Firewall >Configuration.

I suggest finding out why the rule is being added as it maybe important for an app on the device. internal client: *** this is probably 192.168.1.***

With the light flashing orange on the Hub suggests your broadband signal is dropping, where you getting a flashing b with the Hub One?

What did Openreach do when they visited you?

Re: Broadband dropping - had engineer to no avail

Crazyflum — Mon, 11 Sep 2023 21:28:03 GMT

Ah brilliant, thanks, certainly an ease of mind!

And why would I want to turn off UPnP?

I don't really know what could be causing that, however, I do a lot of gaming, so not 100%.

And my broadband was dropping the exact same with the last router, same lights etc..

We had a cube engineer, and he did everything that he could think of, but it didn't work - Internet was still dropping after he came. He said it wouldn't be the internet exchange for the broadband, but Plusnet have got another engineer coming Wednesday to take a look at the exchange.

Re: Broadband dropping - had engineer to no avail

Dan_the_Van — Tue, 12 Sep 2023 06:47:02 GMT

Regarding UPnP, some people prefer to create port forwarding rules rather than rely on UPnP.

Flashing orange light on a Hub suggests to me the broadband (xDSL) signal is dropping, if you were to look at the event log and select category WAN, I would suspect you will find "DSL Link Down" a few times. Not sure what help a cube engineer would be unless it was thought your internal phone cabling was the cause.

Hopefully you will now be having a Openreach visit and they check your line out