Router keeps dropping out: "tcp reset attack is suspected"

[#1]

Given that  "PPPoE is down after 23 minutes uptime" is quite a short time for the PPP connection to be up,  there could be an as yet undiagnosed line fault causing the PPP to drop.

Try running through the Plusnet broadband troubleshooter - Quickest way - troubleshoot by text  to see if that finds anything wrong.

[#2]

---

@Anonymous wrote:

Given that  "PPPoE is down after 23 minutes uptime" is quite a short time for the PPP connection to be up,  there could be an as yet undiagnosed line fault causing the PPP to drop.

Try running through the Plusnet broadband troubleshooter - Quickest way - troubleshoot by text  to see if that finds anything wrong.

---

Yeah, I've done that and they've confirmed there is a fault of some kind, engineer booked for Monday. Fingers crossed!

[#3]

---

@Dan_the_Van wrote:

These messages are a port forward rule to a device which is currently turned off, the connection if from 147.70.179.19 which appears to be M247 Ltd

09:56:10, 20 Jul.	IN: ACCEPT [57] Connection closed (Port Forwarding: TCP [192.168.1.66]:39579 <-​-​> [146.90.163.248]:39579 -​ -​ -​ [146.70.179.19]:19388 CLOSED/SYN_SENT ppp3 NAPT)
09:56:10, 20 Jul.	IN: ACCEPT [54] Connection opened (Port Forwarding: TCP [192.168.1.66]:39579 <-​-​> [146.90.163.248]:39579 -​ -​ -​ [146.70.179.19]:19388 CLOSED/SYN_SENT ppp3 NAPT)

---

You've got the IP wrong @Dan_the_Van. The first octet is 146, not 147; it's the OP's public IP address.

The problem is the fact that the line is losing sync. Below are line initialisations from yesterday...

line_sync.png

Hopefully the engineer sorts it.

[#4]

Not a nice picture, @bobpullen 😞

[#5]

---

@bobpullen wrote:

---

@Dan_the_Van wrote:

These messages are a port forward rule to a device which is currently turned off, the connection if from 147.70.179.19 which appears to be M247 Ltd

09:56:10, 20 Jul.	IN: ACCEPT [57] Connection closed (Port Forwarding: TCP [192.168.1.66]:39579 <-​-​> [146.90.163.248]:39579 -​ -​ -​ [146.70.179.19]:19388 CLOSED/SYN_SENT ppp3 NAPT)
09:56:10, 20 Jul.	IN: ACCEPT [54] Connection opened (Port Forwarding: TCP [192.168.1.66]:39579 <-​-​> [146.90.163.248]:39579 -​ -​ -​ [146.70.179.19]:19388 CLOSED/SYN_SENT ppp3 NAPT)

---

You've got the IP wrong @Dan_the_Van. The first octet is 146, not 147; it's the OP's public IP address.

The problem is the fact that the line is losing sync. Below are line initialisations from yesterday...

line_sync.png

Hopefully the engineer sorts it.

---

I don't really understand what that graph is @bobpullen, but I take it that it means there's a physical issue with the line in order for it to lose sync, rather than a router issue?

[#6]

@LawTurley - Correct, hence your engineer visit.

[#7]

@bobpullen 

sorry for the typo,

inetnum: 146.70.179.0 - 146.70.179.255
netname: M247-LTD-London
descr: M247 LTD London Infrastructure

inetnum: 146.90.128.0 - 146.90.255.255
netname: PLUSNET-DIAL-ADSL
descr: Dial-up and ADSL pool

Dan

[#8]

@Dan_the_Van - ah, I see now. Had overlooked that there were two distinct IP's starting 146.

[#9]

---

@bobpullen wrote:

@Dan_the_Van - ah, I see now. Had overlooked that there were two distinct IP's starting 146.

---

The engineer has just left and has concluded that it's a problem with the router, and has ordered me a new one. I'm frankly a bit baffled, as i seemed as if you guys were confirming it was an issue with the line/connection not a router problem.

[#10]

@LawTurley That engineer needs sacking. The graph @bobpullen posted earlier clearly shows network - i.e. OpenReach drops - your Hub has nothing to do with it! Standard OR brush-off when they can't be bothered.