topic Re: Router keeps dropping out: "tcp reset attack is suspected" in My Router

Router keeps dropping out: "tcp reset attack is suspected"

LawTurley — Thu, 20 Jul 2023 09:17:25 GMT

For the last week or so my router has been regularly dropping out. Checking the log I see "tcp reset attack is suspected" regularly before the dropouts. Any idea what's going on?

3. Firmware version:	Software version 4.7.5.1.83.8.289.1.3 Last updated 07/12/21
4. Board version:	Plusnet Hub One

09:58:14, 20 Jul.	(83811.600000) PPPoE is down after 23 minutes uptime [Waiting for Underlying Connection (WAN Ethernet 7 - Down)]
09:58:10, 20 Jul.	(83808.340000) PPP LCP Send Termination Request [User request]
09:57:27, 20 Jul.	OUT: BLOCK [9] Packet invalid in connection (tcp reset attack is suspected: TCP [192.168.1.83]:64201->[17.253.29.207]:443 on ppp3)
09:56:58, 20 Jul.	BLOCKED 2 more packets (because of Packet invalid in connection)

Re: Router keeps dropping out: "tcp reset attack is suspected"

jab1 — Thu, 20 Jul 2023 09:23:16 GMT

Welcome to the forums @LawTurley . It would be interesting, and a little more helpful to see a longer extract from your error logs. The Hub doing its job of blocking these 'attacks shouldn't cause the drops.

Re: Router keeps dropping out: "tcp reset attack is suspected"

LawTurley — Thu, 20 Jul 2023 09:29:50 GMT

Thanks @jab1 , not sure how many lines you feel would be useful, but here's the 7 mins or so leading up to the last dropout...

09:58:14, 20 Jul.	(83811.600000) PTM over DSL is down after 24 minutes uptime
09:58:14, 20 Jul.	(83811.600000) PPPoE is down after 23 minutes uptime [Waiting for Underlying Connection (WAN Ethernet 7 - Down)]
09:58:10, 20 Jul.	(83808.340000) PPP LCP Send Termination Request [User request]
09:57:27, 20 Jul.	OUT: BLOCK [9] Packet invalid in connection (tcp reset attack is suspected: TCP [192.168.1.83]:64201->[17.253.29.207]:443 on ppp3)
09:56:58, 20 Jul.	BLOCKED 2 more packets (because of Packet invalid in connection)
09:56:58, 20 Jul.	IN: BLOCK [16] Remote administration (TCP [185.224.128.17]:58922->[146.90.163.248]:8080 on ppp3)
09:56:57, 20 Jul.	OUT: BLOCK [9] Packet invalid in connection (tcp reset attack is suspected: TCP [192.168.1.83]:64199->[17.253.29.202]:443 on ppp3)
09:56:56, 20 Jul.	OUT: BLOCK [9] Packet invalid in connection (tcp reset attack is suspected: TCP [192.168.1.83]:64198->[17.253.29.202]:443 on ppp3)
09:56:10, 20 Jul.	IN: ACCEPT [57] Connection closed (Port Forwarding: TCP [192.168.1.66]:39579 <--> [146.90.163.248]:39579 - - - [146.70.179.19]:19388 CLOSED/SYN_SENT ppp3 NAPT)
09:56:10, 20 Jul.	IN: ACCEPT [54] Connection opened (Port Forwarding: TCP [192.168.1.66]:39579 <--> [146.90.163.248]:39579 - - - [146.70.179.19]:19388 CLOSED/SYN_SENT ppp3 NAPT)
09:52:35, 20 Jul.	OUT: BLOCK [7] ICMP replay (ICMP type 3 code 3 192.168.1.83->162.159.135.232 on ppp3)
09:52:09, 20 Jul.	IN: BLOCK [9] Packet invalid in connection (Invalid tcp flags for current tcp state: TCP [216.58.204.78]:443->[146.90.163.248]:64175 on ppp3)
09:51:59, 20 Jul.	OUT: BLOCK [9] Packet invalid in connection (tcp reset attack is suspected: TCP [192.168.1.104]:54006->[52.31.26.238]:443 on ppp3)
09:51:46, 20 Jul.	BLOCKED 14 more packets (because of Packet invalid in connection)
09:51:45, 20 Jul.	OUT: BLOCK [9] Packet invalid in connection (tcp reset attack is suspected: TCP [192.168.1.104]:38974->[142.250.178.14]:443 on ppp3)
09:51:23, 20 Jul.	OUT: BLOCK [7] ICMP replay (ICMP type 3 code 3 192.168.1.83->162.159.135.232 on ppp3)
09:51:13, 20 Jul.	OUT: BLOCK [7] ICMP replay (ICMP type 3 code 3 192.168.1.83->162.159.136.232 on ppp3)
09:51:12, 20 Jul.	OUT: BLOCK [7] ICMP replay (ICMP type 3 code 3 192.168.1.83->162.159.137.232 on ppp3)
09:51:10, 20 Jul.	BLOCKED 2 more packets (because of Packet invalid in connection)
09:51:10, 20 Jul.	BLOCKED 4 more packets (because of ICMP replay)
09:51:09, 20 Jul.	BLOCKED 6 more packets (because of Packet invalid in connection)
09:51:09, 20 Jul.

Re: Router keeps dropping out: "tcp reset attack is suspected"

jab1 — Thu, 20 Jul 2023 09:37:06 GMT

That extract is a little more helpful, thanks, but it takes it slightly out of my knowledge area - I don't recall seeing some of those messages.

Mind if I tag a couple of more experienced members?

Re: Router keeps dropping out: "tcp reset attack is suspected"

LawTurley — Thu, 20 Jul 2023 09:38:46 GMT

@jab1 Sure, go ahead.

Re: Router keeps dropping out: "tcp reset attack is suspected"

jab1 — Thu, 20 Jul 2023 09:40:29 GMT

@Townman , @Dan_the_Van - any ideas?

Re: Router keeps dropping out: "tcp reset attack is suspected"

Dan_the_Van — Thu, 20 Jul 2023 09:48:41 GMT

@jab1

I would investigate these messages

09:58:14, 20 Jul.	(83811.600000) PTM over DSL is down after 24 minutes uptime
09:58:14, 20 Jul.	(83811.600000) PPPoE is down after 23 minutes uptime [Waiting for Underlying Connection (WAN Ethernet 7 - Down)]
09:58:10, 20 Jul.	(83808.340000) PPP LCP Send Termination Request [User request]

These messages are a port forward rule to a device which is currently turned off, the connection if from 147.70.179.19 which appears to be M247 Ltd

09:56:10, 20 Jul.	IN: ACCEPT [57] Connection closed (Port Forwarding: TCP [192.168.1.66]:39579 <--> [146.90.163.248]:39579 - - - [146.70.179.19]:19388 CLOSED/SYN_SENT ppp3 NAPT)
09:56:10, 20 Jul.	IN: ACCEPT [54] Connection opened (Port Forwarding: TCP [192.168.1.66]:39579 <--> [146.90.163.248]:39579 - - - [146.70.179.19]:19388 CLOSED/SYN_SENT ppp3 NAPT)

Other messages are the Hub's firewall blocking IN and OUT connections and are not unusually.

Re: Router keeps dropping out: "tcp reset attack is suspected"

jab1 — Thu, 20 Jul 2023 09:54:32 GMT

@Dan_the_Van I agree entirely that the first block of reports would be my initial port of call. The second lot need more information from the OP to determine what port-forwarding rules they have set up?

I wasn't bothered about the other perfectly normal blocks, TBH.

Re: Router keeps dropping out: "tcp reset attack is suspected"

LawTurley — Thu, 20 Jul 2023 10:09:41 GMT

Are you asking if I've made any changes to the router's port forwarding rules? Because if so, no I haven't.

Re: Router keeps dropping out: "tcp reset attack is suspected"

jab1 — Thu, 20 Jul 2023 10:14:05 GMT

So, you have no forwarding rules set up?

Re: Router keeps dropping out: "tcp reset attack is suspected"

LawTurley — Thu, 20 Jul 2023 10:30:05 GMT

Sorry, I'm a bit rusty at router talk, but I haven't made any manual changes to the routers protocols at all.

Re: Router keeps dropping out: "tcp reset attack is suspected"

Anonymous — Thu, 20 Jul 2023 10:31:18 GMT

Firewall port forwarding rules can invisibly and unknowingly be created if "UPnP" is enabled in the router.

These UPnP port forwards can automatically be created by consumer devices such as media centres, games consoles, etc

BUT can also be generated by malicious software that may have infected a computer on your network.

I consider having UPnP enabled as security threat and would advise disabling it and restarting the router, and then manually adding any port forward rules necessary for the functioning of any of your consumer devices.

Re: Router keeps dropping out: "tcp reset attack is suspected"

Anonymous — Thu, 20 Jul 2023 10:39:19 GMT

Are the "PPP LCP Send Termination Request" coincident with attempting to upload a significant sized file, for example doing an online backup, or synchronizing a mobile phone to cloud storage ?

In the past there have been reports here of seeing "PPP LCP Send Termination Request" when the Hub One has it's upload path overwhelmed, and *I think* there was a firmware update that cured that issue.

Re: Router keeps dropping out: "tcp reset attack is suspected"

jab1 — Thu, 20 Jul 2023 10:40:54 GMT

The OP's Hub has the latest f/w, @Anonymous

Re: Router keeps dropping out: "tcp reset attack is suspected"

LawTurley — Thu, 20 Jul 2023 10:51:53 GMT

@Anonymous wrote:

Are the "PPP LCP Send Termination Request" coincident with attempting to upload a significant sized file, for example doing an online backup, or synchronizing a mobile phone to cloud storage ?

In the past there have been reports here of seeing "PPP LCP Send Termination Request" when the Hub One has it's upload path overwhelmed, and *I think* there was a firmware update that cured that issue.

No, nothing unusual going on at all. But I'll try what you suggested with the UPnP and see if that fixes it.

Re: Router keeps dropping out: "tcp reset attack is suspected"

Anonymous — Thu, 20 Jul 2023 11:02:00 GMT

Given that "PPPoE is down after 23 minutes uptime" is quite a short time for the PPP connection to be up, there could be an as yet undiagnosed line fault causing the PPP to drop.

Try running through the Plusnet broadband troubleshooter - Quickest way - troubleshoot by text to see if that finds anything wrong.

Re: Router keeps dropping out: "tcp reset attack is suspected"

LawTurley — Thu, 20 Jul 2023 13:02:22 GMT

@Anonymous wrote:

Given that "PPPoE is down after 23 minutes uptime" is quite a short time for the PPP connection to be up, there could be an as yet undiagnosed line fault causing the PPP to drop.

Try running through the Plusnet broadband troubleshooter - Quickest way - troubleshoot by text to see if that finds anything wrong.

Yeah, I've done that and they've confirmed there is a fault of some kind, engineer booked for Monday. Fingers crossed!

Re: Router keeps dropping out: "tcp reset attack is suspected"

bobpullen — Thu, 20 Jul 2023 13:25:30 GMT

@Dan_the_Van wrote:

These messages are a port forward rule to a device which is currently turned off, the connection if from 147.70.179.19 which appears to be M247 Ltd

09:56:10, 20 Jul. IN: ACCEPT [57] Connection closed (Port Forwarding: TCP [192.168.1.66]:39579 <--> [146.90.163.248]:39579 - - - [146.70.179.19]:19388 CLOSED/SYN_SENT ppp3 NAPT)

09:56:10, 20 Jul. IN: ACCEPT [54] Connection opened (Port Forwarding: TCP [192.168.1.66]:39579 <--> [146.90.163.248]:39579 - - - [146.70.179.19]:19388 CLOSED/SYN_SENT ppp3 NAPT)

You've got the IP wrong @Dan_the_Van. The first octet is 146, not 147; it's the OP's public IP address.

The problem is the fact that the line is losing sync. Below are line initialisations from yesterday...

Hopefully the engineer sorts it.

Re: Router keeps dropping out: "tcp reset attack is suspected"

jab1 — Thu, 20 Jul 2023 13:29:08 GMT

Not a nice picture, @bobpullen 😞

Re: Router keeps dropping out: "tcp reset attack is suspected"

LawTurley — Thu, 20 Jul 2023 13:32:39 GMT

@bobpullen wrote:

@Dan_the_Van wrote:

These messages are a port forward rule to a device which is currently turned off, the connection if from 147.70.179.19 which appears to be M247 Ltd

09:56:10, 20 Jul. IN: ACCEPT [57] Connection closed (Port Forwarding: TCP [192.168.1.66]:39579 <--> [146.90.163.248]:39579 - - - [146.70.179.19]:19388 CLOSED/SYN_SENT ppp3 NAPT)

09:56:10, 20 Jul. IN: ACCEPT [54] Connection opened (Port Forwarding: TCP [192.168.1.66]:39579 <--> [146.90.163.248]:39579 - - - [146.70.179.19]:19388 CLOSED/SYN_SENT ppp3 NAPT)

You've got the IP wrong @Dan_the_Van. The first octet is 146, not 147; it's the OP's public IP address.

The problem is the fact that the line is losing sync. Below are line initialisations from yesterday...

Hopefully the engineer sorts it.

I don't really understand what that graph is @bobpullen, but I take it that it means there's a physical issue with the line in order for it to lose sync, rather than a router issue?