D-Link Forums
The Graveyard - Products No Longer Supported => Routers / COVR => DIR-600 => Topic started by: brettar on February 27, 2014, 07:25:07 PM
-
Hi, I have this hunch that a neighbor is hacking my wireless connection.
My network is like this: From the internet service provider modem, to a switch, and from the switch to the DIR-600 router. Other computers are also connected hard wired to the switch.
The network connection is visible to neighbors.
Now, the hacking as I can see is not like they are stealing my connection in order to surf the web. It's actually that they are killing my internet connection, in order to deny me access to it.
The scenario: I'm using my computer and suddenly on my network icon near the clock it says "a network cable has been unplugged", so I check the cable and the router and switch and modem and everything is well connected, but the problem remains.
The only thing that enables the connection again is if I unplug and plug again the power from the router and from the switch.
Also, I have used the network without the wireless DIR-600 for many days and the problem never happens. But if I connect the wireless any other day, then for sure the problems starts.
From what I can see is like they are hacking the router, and once they hack the router is like all connections on the pcs are disabled.
I have just did a reset to the router.
How can I secure the router so that this hacking does not happens again?
Do I need to change settings in the configuration?
Thanks.
-
- What Hardware version is your router? Look at sticker under router.
- Link>What Firmware (http://forums.dlink.com/index.php?topic=47512.0) version is currently loaded? Found on the routers web page under status.
- What region are you located?
Internet Service Provider and Modem Configurations
- What ISP Service do you have? Cable or DSL?
- What ISP Modem Mfr. and model # do you have?
- What ISP Modem service link speeds UP and Down do you have?
Recommended connections between devices should be as follows:
ISP modem>DIR-600 router<>Any LAN wired devices and switches connected to the back of the router.
I would remove the switch and test the PC to the router and modem to see if it happens again.
Swap out cables between ISP modem, Router and PC. - Check cable between Modem and Router, swap out to be sure. Link> Cat6 is recommended. (http://en.wikipedia.org/wiki/CAT6)
Ensure the PCs network adapter card is in good working condition and it's drivers are up to date. Auto Speed connection should be configured on the adapter card.
-
Any status on this? ???
-
Any status on this? ???
yes. I'm going to post some info later in the day.
-
- What Hardware version is your router? Look at sticker under router.
- Link>What Firmware (http://forums.dlink.com/index.php?topic=47512.0) version is currently loaded? Found on the routers web page under status.
- What region are you located?
Internet Service Provider and Modem Configurations
- What ISP Service do you have? Cable or DSL?
- What ISP Modem Mfr. and model # do you have?
- What ISP Modem service link speeds UP and Down do you have?
Recommended connections between devices should be as follows:
ISP modem>DIR-600 router<>Any LAN wired devices and switches connected to the back of the router.
I would remove the switch and test the PC to the router and modem to see if it happens again.
Swap out cables between ISP modem, Router and PC. - Check cable between Modem and Router, swap out to be sure. Link> Cat6 is recommended. (http://en.wikipedia.org/wiki/CAT6)
Ensure the PCs network adapter card is in good working condition and it's drivers are up to date. Auto Speed connection should be configured on the adapter card.
Hi, here's the info you asked:
router info:
Hardware Version : B1
Firmware Version : 2.01.
I'm located at Panama, Central America.
My ISP service is cable modem.
The modem manufacturer is Arris and the model is TM602G/115
The internet speeds are: for download: 2 mbps, for upload: 1 mbps
Connections between devices:
I had always had this connection setup: modem-->router--->switch, and it was with this setup that the problem began. So that's why I changed to: modem-->switch-->router, but as stated in the original question the problem continued happening.
I also tested with modem--->router--->pc but the problem continued.
I also changed the cables but the problem continued.
The network adapters: I'm using 2, from the two pcs that I'm using, and they are working fine.
-
Oh, I forgot. I couldn't use Cat6 cable. The only cable available I have is Cat5e.
-
- What security mode are you using? Preferred security is WPA-Personal. WPA2/AES Only. Some WiFi adapters don't support AES (http://en.wikipedia.org/wiki/Advanced_Encryption_Standard), so you might want to try TPIK (http://en.wikipedia.org/wiki/Temporal_Key_Integrity_Protocol) only or Auto TPIK and AES.
I'd change the SSID and PW, use WPA2/AES only and don't give out the PW. Does this router have a hidden SSID feature? Might try it out as well..
I recommend placing the switch behind the router, not in front. This can cause some connections issues.
You might change out the ISP modem as well...
-
- What security mode are you using? Preferred security is WPA-Personal. WPA2/AES Only. Some WiFi adapters don't support AES (http://en.wikipedia.org/wiki/Advanced_Encryption_Standard), so you might want to try TPIK (http://en.wikipedia.org/wiki/Temporal_Key_Integrity_Protocol) only or Auto TPIK and AES.
I'd change the SSID and PW, use WPA2/AES only and don't give out the PW. Does this router have a hidden SSID feature? Might try it out as well..
I recommend placing the switch behind the router, not in front. This can cause some connections issues.
You might change out the ISP modem as well...
Right now, I have just set security mode to WPA/WPA2 Wireless Security (enhanced) with CYpher type on AES.
I changed the SSID and password.
I have also enabled the hidden SSID feature.
I also placed the switch behind the router.
So far, I have not seen any problem.
So, I'm gonna use the wireless with this setup the whole week and will tell you how all went down.
Many Thanks!!
-
Good, keep us posted...
-
Hi, I have used the router with the new setup for more than 2 weeks now and the performance is better.
The issue with the "a network cable has been unplugged" message on my network icon near the clock is now gone.
I have access now all the time to the internet.
However, there is one new thing that's happening now: I'm surfing a particular website(website 1) for a while and suddenly that website becomes unavailable. If I go to other different website(website 2) I have access to it. But then that new website becomes unavailable after a while. Then, if I try to go to website 1, I now have access to it again.
This kind of behavior is one which makes me think that is some hacking involved here.
What I think is happening is that somehow this neighbor can see the particular website which I'm surfing and then he blocks it. Then, when I go to other website he block that one too but leaves the first available and so on. This is what I believe is happening but I have no proof of this.
So, if the neighbor is doing some hacking to the router I would like to have some proof.
So, I believe this router has some log?
Could I enable this log to see if an external ip adress(neighbor ip) is connecting to the router?
Also,
What about enabling mac adress filtering on the router for more protection? Could this help?
-
Try using different browser like Opera, or FF to see if they exhibit the same problem with the web sites.
Clear any browser caches.
Temporarily disable 3rd party PC security SW or browser add-ons to see if there is any interferences there.
Yes you can turn on MAC filtering and put in all of your devices into the filter.
I'd review your MAC devices addresses and then look for any MAC addresses that don't belong to you in the Status/Device Info/Connected Devices list or under Wireless Status.
-
Try using different browser like Opera, or FF to see if they exhibit the same problem with the web sites.
Clear any browser caches.
Temporarily disable 3rd party PC security SW or browser add-ons to see if there is any interferences there.
Yes you can turn on MAC filtering and put in all of your devices into the filter.
I'd review your MAC devices addresses and then look for any MAC addresses that don't belong to you in the Status/Device Info/Connected Devices list or under Wireless Status.
Ok. I have turned on Mac filtering, I will see how that works out.
-
One thing though,
Could it be that they are hacking the isp modem as well?
I mean, I have been testing a lot these last days and several times I connected the switch to the modem and the computers to the switch, and there was no dlink router involved, but there was no access to the internet whatsoever.
It just seemed weird that this setup always worked when there were problems with the router, but now all of the sudden is also giving problems?
-
Even though your TM602 is a VoIP Gateway, I don't think there is any WiFi built in.
If you are concerned about the ISP modem, I would as the ISP if there is an upgrade to this modem. I recommend getting into a stand alone modem if you can. Something with out any built in router.
- If this modem has a built in router, it's best to bridge the modem. Having 2 routers on the same line can cause connection problems: Link>Double NAT (http://www.practicallynetworked.com/networking/fixing_double_nat.htm) and How NAT Works (http://cognitiveanomalies.com/cisco-nat-how-nat-works/). To tell if the modem is bridged or not, look at the routers web page, Status/Device Info/Wan Section, if there is a 192.168.0.# address in the WAN IP address field, then the modem is not bridged. If the modem can't be bridged then see if the modem has a DMZ option and input the IP address the router gets from the modem and put that into the modems DMZ. Also check the routers DHCP IP address maybe conflicting with the ISP modems IP address 192.168.0.1. Check to see if this is the same on the ISP modem and if modem can't be bridged. If so, change the DIR router to 192.168.1.1 or .0.254.
Example of a D-Link router configured for PPPoE with ISP Modem bridged: PPPoE Configuration on Router (http://forums.dlink.com/index.php?topic=56344.msg219023#msg219023)
-
Even though your TM602 is a VoIP Gateway, I don't think there is any WiFi built in.
If you are concerned about the ISP modem, I would as the ISP if there is an upgrade to this modem. I recommend getting into a stand alone modem if you can. Something with out any built in router.
- If this modem has a built in router, it's best to bridge the modem. Having 2 routers on the same line can cause connection problems: Link>Double NAT (http://www.practicallynetworked.com/networking/fixing_double_nat.htm) and How NAT Works (http://cognitiveanomalies.com/cisco-nat-how-nat-works/). To tell if the modem is bridged or not, look at the routers web page, Status/Device Info/Wan Section, if there is a 192.168.0.# address in the WAN IP address field, then the modem is not bridged. If the modem can't be bridged then see if the modem has a DMZ option and input the IP address the router gets from the modem and put that into the modems DMZ. Also check the routers DHCP IP address maybe conflicting with the ISP modems IP address 192.168.0.1. Check to see if this is the same on the ISP modem and if modem can't be bridged. If so, change the DIR router to 192.168.1.1 or .0.254.
Example of a D-Link router configured for PPPoE with ISP Modem bridged: PPPoE Configuration on Router (http://forums.dlink.com/index.php?topic=56344.msg219023#msg219023)
I can't see a Wan Section under Status/Device Info/. I only see Lan, Internet and Wireless 802.11n.
-
I can't see a Wan Section under Status/Device Info/. I only see Lan, Internet and Wireless 802.11n.
Wait the Internet section would be the Wan section right? hehe. If that's the case, then no, there's not a 192.168.0.# address in the WAN IP address field, its more like 190.14#.###.###.
So I guess the modem is bridged.
-
But right now, my believe is that the modem is being hacked through internet, through the ip adress which is on Status/Device Info/Wan Section.
I was checking the logs and I got a data that looked weird. Here's some of it:
"Mar 26 14:49:12 ","Xmas port scan attack from WAN (ip:201.218.212.175) detected."
"Mar 26 14:49:10 ","Xmas port scan attack from WAN (ip:157.55.130.171) detected."
"Mar 26 14:49:05 ","Xmas port scan attack from WAN (ip:201.218.212.175) detected."
"Mar 26 14:48:51 ","Xmas port scan attack from WAN (ip:157.55.56.143) detected."
"Mar 26 14:48:51 ","Xmas port scan attack from WAN (ip:201.218.212.175) detected."
"Mar 26 14:48:45 ","Xmas port scan attack from WAN (ip:201.218.212.175) detected."
"Mar 26 14:48:43 ","Xmas port scan attack from WAN (ip:201.218.212.175) detected."
"Mar 26 14:48:27 ","Xmas port scan attack from WAN (ip:157.55.56.143) detected."
What do you think of this data?
-
The router is reporting what is going on and this is good and the firewall on the router is doing it job of blocking it or detecting it.
-
The router is reporting what is going on and this is good and the firewall on the router is doing it job of blocking it or detecting it.
But what should I do?
Even if the firewall on the router is blocking it or detecting it, I'm still having this "no access to the internet" problem.
What do you recommend?
-
I would ask the ISP if there is an upgrade to this modem. I recommend getting into a stand alone modem if you can. Something with out any built in router. Ask the ISP for a new IP address on the modem as well...
- If this modem has a built in router, it's best to bridge the modem. Having 2 routers on the same line can cause connection problems: Link>Double NAT (http://www.practicallynetworked.com/networking/fixing_double_nat.htm) and How NAT Works (http://cognitiveanomalies.com/cisco-nat-how-nat-works/). To tell if the modem is bridged or not, look at the routers web page, Status/Device Info/Wan Section, if there is a 192.168.0.# address in the WAN IP address field, then the modem is not bridged. If the modem can't be bridged then see if the modem has a DMZ option and input the IP address the router gets from the modem and put that into the modems DMZ. Also check the routers DHCP IP address maybe conflicting with the ISP modems IP address 192.168.0.1. Check to see if this is the same on the ISP modem and if modem can't be bridged. If so, change the DIR router to 192.168.1.1 or .0.254.
Example of a D-Link router configured for PPPoE with ISP Modem bridged: PPPoE Configuration on Router (http://forums.dlink.com/index.php?topic=56344.msg219023#msg219023)
I'd test the router at a different location, say at a friends or families or nieghbor with a different ISP modem. See if the problem follows, if it does, then you'll know and go from there...
-
Ask the ISP for a new IP address on the modem as well...
Hi, I talked to the ISP, and explained them the problem I'm having. And I asked them to change the modem's IP adress. But they told me that they cannot change it like that. That the ip is generated dynamic.
Then I asked them which was the IP address that they could see from there for the modem. And they gave it to me, and when I compared it with the one located in the DIR-600 administrator web page under the Status/Device Info/Wan(Internet) section I realized it was the same.
The thing is that this ip was generated by me on that very same page doing a DHCP Release and DHCP renew. I have changed it about 4 times now recently doing some tests, giving the problems I'm having.
So, let me get this right, the Status/Device Info/Lan section displays info about the router, and the Status/Device Info/Wan(Internet) displays info about the modem? Is that correct?
I thought that this very ip address was for the router not the modem.
-
Yes.
You could unplug the ISP modem and the router for say 5 minutes or more...see if the IP address on the modem gets changed...
-
Yes.
You could unplug the ISP modem and the router for say 5 minutes or more...see if the IP address on the modem gets changed...
I unplugged the ISP modem and the router for 20 minutes and the IP address on the modem did not change.
But like I said, I can generate a new ip address for the ISP modem by going to the router's web page under Status/Device Info/Wan(Internet) and clicking on the DHCP Release button and then on the DHCP renew button. I have done this several times and it always gives me a new ip adress for the ISP modem.
I don't know if this is the correct way of changing the IP address for an ISP modem though.
-
As long as your getting a public IP address and it's changing then it sounds like your getting a different WAN IP address ON the router which is good..
-
As long as your getting a public IP address and it's changing then it sounds like your getting a different WAN IP address ON the router which is good..
There's is another IP address for the modem that if you access it, it shows the model of the modem, the log for the modem and other info. But this seems like a local ip to manage the modem settings.
I guess this IP address is just for administrative purposes of the modem and is not a public ip that can be changed or one that is subject to hacking from the internet right?
-
Is there a software I could use for the situation I'm having?
Like a software that monitors weird activity like this and blocks it?
-
I presume there is...I don't use such SW...you might check out ComodoDragon SW.
-
I presume there is...I don't use such SW...you might check out ComodoDragon SW.
thanks.
Should I do a firmware update?
the version I have is the 2.01. The latest firmware version available is the 2.16b05.
-
If the router is working well for you, I would not update it unless you have problems and the release notes state what it fixes that applies to you.
You can if you wish however please follow this for doing any FW updates:
FW Update Process (http://forums.dlink.com/index.php?topic=42457.0)
-
Hi, I haven't done a firmware update yet.
This issue hasn't been so frequent lately, but what I think is happening is a DDoS attack.
Last time it happened the router and modem crashed.
I tried to enter to the router admin web page via the router's local IP address, but I get an error saying the page is not available.
After restarting the router, I had access again.
The modem had only two lights turned on when it crashed, when it normally should have about five lights on.
The "online" light and the "link" light were off.
After restarting the modem all the lights were normal again.
So, restarting the modem and the router helped.
So, did the modem and router crashed because of the DDoS attacks?
-
IF the ISP modem is crashing or not working right after a period of time, I recommend that you contact your ISP support desk and explain the problem to them and have them look into your service and see if there is any problems going on with your connection.
-
Any status on this?
Hi, I haven't done a firmware update yet.
This issue hasn't been so frequent lately, but what I think is happening is a DDoS attack.
Last time it happened the router and modem crashed.
I tried to enter to the router admin web page via the router's local IP address, but I get an error saying the page is not available.
After restarting the router, I had access again.
The modem had only two lights turned on when it crashed, when it normally should have about five lights on.
The "online" light and the "link" light were off.
After restarting the modem all the lights were normal again.
So, restarting the modem and the router helped.
So, did the modem and router crashed because of the DDoS attacks?
-
Any status on this?
Hi, I've downloaded the new firmware, which is version 2.17b02 from here:
http://www.dlink.com/uk/en/support/product/dir-600-wireless-n-150-home-router?revision=deu_revb1b2#downloads (http://www.dlink.com/uk/en/support/product/dir-600-wireless-n-150-home-router?revision=deu_revb1b2#downloads)
the exact link is:
ftp://ftp.dlink.eu/Products/dir/dir-600/driver_software/DIR-600_fw_revBx_2-17b02_all_en_20140317.zip (ftp://ftp.dlink.eu/Products/dir/dir-600/driver_software/DIR-600_fw_revBx_2-17b02_all_en_20140317.zip)
My current firmware version is 2.01.
When I try to update to version 2.17b02, in the admin website for the router I got the message "The chosen file is not a valid config file.".
The firmware file that I downloaded has this name: DIR-600Bx_FW217b02.bin.
So why do I get this message when I'm updating?
thanks..
-
Have you tried to upload v2.05 first to see if a less recent version will update?
DIR-600_fw_revb12_205b01_ALL_de_20101123
Please follow the FW update process:
>FW Update Process (http://forums.dlink.com/index.php?topic=42457.0)
-
Have you tried to upload v2.05 first to see if a less recent version will update?
DIR-600_fw_revb12_205b01_ALL_de_20101123
Please follow the FW update process:
>FW Update Process (http://forums.dlink.com/index.php?topic=42457.0)
Where can I download version 2.05?
-
Try that FTP link you posted...
-
Have you tried to upload v2.05 first to see if a less recent version will update?
DIR-600_fw_revb12_205b01_ALL_de_20101123
Please follow the FW update process:
>FW Update Process (http://forums.dlink.com/index.php?topic=42457.0)
I've just updated to version 2.05. The update was successful.
-
Hope it works well. Enjoy,. ;)
-
After using the router for some days with the firmware update, I'm still having the disconnections problem.
-
Is the disconnects your seeing between the router and modem or wired and wireless connections with the router and your client devices? ???
-
Is the disconnects your seeing between the router and modem or wired and wireless connections with the router and your client devices? ???
The disconnections take place in the wired connection with the router and my pc network device.
-
Maybe someone can review your router settings with you using Link> teamviewer (http://www.teamviewer.com) if your interested. Its safe and secure.
-
Maybe someone can review your router settings with you using Link> teamviewer (http://www.teamviewer.com) if your interested. Its safe and secure.
I've just managed to update the firmware to the latest version which is 2.17.
When I had the 2.01 firmware version I tried to update to the 2.17 and I got the message "The chosen file is not a valid config file.".
So, I tried to update from 2.01 to 2.05 and the update was successful.
When I tried to update from 2.05 to 2.17 I got the message "The chosen file is not a valid firmware image file.".
That's because an intermediate firmware need to be installed first in order to upgrade firmware version 2.06 or lower to the latest firmware.
I found out about this downloading different firmware updates from here:
ftp://ftp.dlink.eu/Products/dir/dir-600/driver_software/ (ftp://ftp.dlink.eu/Products/dir/dir-600/driver_software/)
So, I downloaded this update:
ftp://ftp.dlink.eu/Products/dir/dir-600/driver_software/DIR_600_fw_revb1_215b01_ALL_en_20130430_instructions.zip (ftp://ftp.dlink.eu/Products/dir/dir-600/driver_software/DIR_600_fw_revb1_215b01_ALL_en_20130430_instructions.zip)
And updated the firmware with the intermediate firmware update file and then updated the firmware to the 2.15 version with the file which is included in the same zip file.
And then updated the firmware to the latest version which is 2.17.
I think this information should be posted as a sticky because lots of people have come with this firmware update problem.
So I will test the router with this latest update to see how it goes.
If it keeps disconnecting then we could try TeamViewer to see the router settings, thanks.
-
Awesome information. I'll make sure this gets posted.
Let us know how it goes. ;)
-
Awesome information. I'll make sure this gets posted.
Let us know how it goes. ;)
The disconnections have continued with the latest firmware.
Can we try the TeamViewer meeting?
-
When are you available?
-
When are you available?
Let me test the router for a few more days. I'll let you know then.
-
;)
-
Ok. I finished testing the router.
Let's do the TeamViewer meeting. I will be available on Friday 26.
I'm on Eastern Standard Time:
http://www.timeanddate.com/time/zones/est (http://www.timeanddate.com/time/zones/est)
At the time of writing this message is 11:37 pm.
So, for my time I will be available on Friday from 8 am to 6 pm.
What's your time zone?
-
I'm Mountain time here.
Lets try for AM Friday morning. I'm in the office around 9am MST so lets give that a try. Should only take about 30 Mins or less. Just wanna look over your router settings and see if I notice anything. Send me a PM with TVs ID and pw. ;)
-
I'm Mountain time here.
Lets try for AM Friday morning. I'm in the office around 9am MST so lets give that a try. Should only take about 30 Mins or less. Just wanna look over your router settings and see if I notice anything. Send me a PM with TVs ID and pw. ;)
Something has showed up and I won't be able to do the meeting on Friday.
I'm available any other day after Friday, you tell me which day.
-
Understand...My schedule is kind of busy this weekend so maybe lets try for next week? Monday or Tuesday a.m.?
-
Understand...My schedule is kind of busy this weekend so maybe lets try for next week? Monday or Tuesday a.m.?
Ok. Let's do it on Tuesday at 9 a.m. Mountain time.
-
Sounds good. ;)
-
I've sent you my TeamViewer id and password in a PM.
-
It would be good also to have instant messages between us in case the TeamViewer connection fails or if we need to talk about something else.
Like skype or a chat room.
-
TV has in app chat. See you tomorrow...
-
TV has in app chat. See you tomorrow...
Ok. hehe, I didn't knew that. See you tomorrow.
-
I've sent you a new TeamViewer password in a pm.
-
I have TeamViewer open and waiting for the connection.
-
the ISP modem has a built in router, it's best to bridge the modem. Having 2 routers on the same line can cause connection problems: Link>Double NAT (http://www.practicallynetworked.com/networking/fixing_double_nat.htm) and How NAT Works (http://computer.howstuffworks.com/nat.htm). Call the ISP and ask to see if the ISP modem can be bridged. To tell if the modem is bridged or not, look at the routers web page, Status/Device Info/Wan Section, if there is a 192.168.0.# address in the WAN IP address field, then the modem is not bridged. If the modem can't be bridged then see if the modem has a DMZ option and input the IP address the router gets from the modem and put that into the modems DMZ.
-
the ISP modem has a built in router, it's best to bridge the modem. Having 2 routers on the same line can cause connection problems: Link>Double NAT (http://www.practicallynetworked.com/networking/fixing_double_nat.htm) and How NAT Works (http://computer.howstuffworks.com/nat.htm). Call the ISP and ask to see if the ISP modem can be bridged. To tell if the modem is bridged or not, look at the routers web page, Status/Device Info/Wan Section, if there is a 192.168.0.# address in the WAN IP address field, then the modem is not bridged. If the modem can't be bridged then see if the modem has a DMZ option and input the IP address the router gets from the modem and put that into the modems DMZ.
The IP address in the Status/Device Info/Wan Section IP address field is 190.218.96.110.
So, the modem is bridged.
I'm going to test the router a little more to see how it goes.
I gotta ask, is it possible that the router is just too old?
Maybe I could buy a new D-Link model like the AC1900 Wi-Fi Router:
http://us.dlink.com/products/connect/ac1900-wi-fi-router/ (http://us.dlink.com/products/connect/ac1900-wi-fi-router/)
What do you think?
-
It would be a great improvement. ::)