Print

Please login or register.
1 Hour 1 Day 1 Week 1 Month Forever
Login with username, password and session length

[elsporko]

Alright, here we go  I bought a DIR-655 router a while ago and it worked great for a while, both wired and wireless. Recently, my connection started dropping randomly (anywhere from 2 minutes to 12 hours). Thinking the problem was my DIR-655, I tried different firmwares, factory resetting, messing with the QoS engine, UPnP, different IP ranges, turning off wireless completely, and it still happened. To get my connection back, I had to reboot my DSL Modem (Modem is a Speedstream 5200, and my ISP is MTS) as well as my router to get the connection back.

I switched to my old DI-604 router to test to see if it was my DIR-655 or not. The next morning, I woke up to find my internet down again. I rebooted my router, it was still down. Rebooted my modem, and it came back up. A few hours later, my internet dropped again, this time requiring a reboot of both the modem and router.

So, thinking maybe the problem is an old, flaky modem, I went to my ISP's store and got a new modem. Hooked it up with my DI-604, and it worked good for a while. About  2 hours later the connection dropped again. So right now, I've taken both my routers out of the mix, and am going straight from my modem to my PC. So far it hasn't dropped yet, but I'll have to wait a few hours/days to see if it stays up or not.

I'm at a loss of what to test next. I was thinking maybe it's a software issue with my PC, but I've had times where I've turned off my PC when the connection was up, and woken up with the connection dropped, so the PC wasn't on when it dropped. Anyone have any ideas as to what I could do? I'm going to phone my ISP soon and see if they can think of anything, but I'd rather fix it myself. Long post, I know, sorry guys 

Thanks in advance, and I'm not sure if this is the right forum, but I couldn't find just a general help thread.

[Lycan]

Who is the maker of the modem?

[bluenote]

Are you running torrents?

[elsporko]

Modem is:
Speedstream 5200
Part # 060-E270-A19
also has an Efficient Networks logo on the top left.

And yes, I do run torrents sometimes, but I doubt that's the problem. I've ran torrents before without it disconnecting, and it disconnects even if I haven't torrented in days.

Yesterday I connected my PC directly to my modem, and the connection didn't drop once in 21 hours and I was torrenting at max speeds the entire night. I just hooked up my DIR-655 again, hoping to find the problem. I just checked, and I have the timeserver option disabled.

Also a few minutes ago, I got the following messages (bubbles in the bottom right of the screen):
Local area connection 2 (my main connection through my router) is now connected. Speed: 1.0gbps
A network cable is unplugged
Local area connection 2 (my main connection through my router) is now connected. Speed: 1.0gbps
A network cable is unplugged
Local area connection 2 (my main connection through my router) is now connected. Speed: 1.0gbps
A network cable is unplugged
(These messages were about 1 second after eachother.)

and then it stayed connected fine. This is also weird, since usually the speed shows 100mbps, not 1.0gbps. When I went into Network Connections and disabled the LAN2 connection and re-enabled it, it switched back to 100mbps.

[bluenote]

When you get one of those bubbles, does the router uptime reset?  (in which case, the router is rebooting).

If it is rebooting I recommend the latest beta b05.  (seems to have fixed my reboots)

Cory

[elsporko]

I'm not sure if it's reset during that or not, but I don't think I've seen the uptime counter reset before (at least when my internet dies). I have noticed, though, when the internet goes down, where it normally says this:

Cable Status :  Connected
Network Status : Established

It stays like that. Despite me not being able to go online at all (or even ping an IP address, leaving out a simple DNS issue), it still says I'm connected. After I click the disconnect button just underneathe it, and try to reconnect, it can't, and says it's disconnected until I reset my modem.

Edit: Also, I've tried a few different firmwares, and I think I am on the most current one.

About 4 hours ago, I set my Windows XP PC to not get DNS and IP addresses automatically from my router (I still have it set to DHCP on my router since I usually use it with my 360 and Wii), and instead use a static IP, but use the router's gateway address. The connection is up and running, and I've had no troubles for the past few hours, so maybe it was just an IP conflict issue? Again, it's still too early to say anything, and I might just have jinxed myself :x I will leave it on overnight and see if it disconnects.

[elsporko]

Moooooore to add, woot.

Parents phoned our ISP today, I was at school so I was unable to talk to them, but I had wrote them a few things to mention. I asked about what they said, and they just said that everything pointed towards a router problem.

So today, I just updated the firmware on the DIR-655 to the new 1.22 beta firmware, and set my PC to automatically get an IP from the router, and use specific DNS servers (doing everything I can think of at the moment ._.)

I left my PC on while at school and checked the logs of the router. One thing I see almost every time after it disconnects is this:

[INFO] Wed Mar 04 09:27:48 2009 Blocked incoming TCP packet from 71.60.37.49:43633 to 142.161.xxx.xxx:3992 as RST received but there is no active connection

There are a few messages with "but there is no active connection" after it when it disconnects. There were also a few new ones, though.

[INFO] Wed Mar 04 09:30:14 2009 Blocked incoming TCP packet from 118.136.8.51:30509 to 142.161.xxx.xx:3992 with unexpected sequence 447785366 (expected 4294901761 to 65536)
[INFO] Wed Mar 04 14:31:31 2009 Dropped packet from 5.116.216.100 to 74.52.201.106(IP protocol 17) as unable to create new session (quite a few of these near the most recent logs)

I've seen the IP Protocol 17 mentioned before on here for the same router, and he was having random disconnects as well? Does anyone know what this means?

[lotacus]

The most likely cause is wireless hijacking or sniffing. Do a scan of your computer, uninstall wireshark, clean up your computer. It's not router issues, it's issues outside your router. IE: your doing it yourself unintentionally/Intentionally using packet sniffing / wireless hijacking software or someone else in your vicinitiy is.

[elsporko]

Internet just disconnected. I checked my router's device info, and the connection uptime had reset, as well as my time (Jan31st 2004 D:). Cable status was connected, but the network status was disconnected and trying to re-establish. Underneathe, my IP address, gateway, and DNS all showed up as 0.0.0.0. I checked my logs, and found this (it's never said this before. Before when it disconnected, it never said any of this, maybe new with 1.22b?) These few messages repeated constantly. Resetting the router did nothing, and it just kept repeating. After resetting the modem, it connected right aways.

[INFO] Sat Jan 31 11:30:57 2004 Attempting to re-connect on-demand WAN connection
[CRIT] Sat Jan 31 11:30:56 2004 INTERNET PPPoE session timed out waiting for connection.  Connection attempt failed.
[INFO] Sat Jan 31 11:30:50 2004 Discovering PPPoE servers for INTERNET PPPoE Session
[INFO] Sat Jan 31 11:30:44 2004 Above message repeated 5 times
[INFO] Sat Jan 31 11:30:44 2004 Trying to establish INTERNET PPPoE connection
[INFO] Sat Jan 31 11:30:44 2004 Attempting to re-connect on-demand WAN connection
[CRIT] Sat Jan 31 11:30:44 2004 INTERNET PPPoE session timed out waiting for connection.  Connection attempt failed.
[INFO] Sat Jan 31 11:30:37 2004 Discovering PPPoE servers for INTERNET PPPoE Session
[INFO] Sat Jan 31 11:30:31 2004 Above message repeated 5 times
[INFO] Sat Jan 31 11:30:31 2004 Trying to establish INTERNET PPPoE connection
[INFO] Sat Jan 31 11:30:31 2004 Attempting to re-connect on-demand WAN connection
[INFO] Sat Jan 31 11:30:30 2004 Terminating INTERNET PPPoE session ID 600
[INFO] Sat Jan 31 11:30:30 2004 PPP network down
[INFO] Sat Jan 31 11:30:30 2004 LCP sets remote auth: 00000000
[INFO] Sat Jan 31 11:30:30 2004 LCP sets remote options: ACCM: FFFFFFFF, ACFC: 1, PFC: 0, MRU: 1492
[INFO] Sat Jan 31 11:30:30 2004 LCP sets local options: ACCM: 00000000, ACFC: 1, PFC: 0, MRU: 1492
[INFO] Sat Jan 31 11:30:25 2004 Stopping securespot services.
[INFO] Sat Jan 31 11:30:25 2004 PPP network down

Sorry for the huge, constant posts guys. I'm really thankful for the help and suggestions, and I'm trying to provide as much info as possible.

@lotacus. Yeah, that's what I had assumed too at first. Although, the first thing I did when I started having this problem was simply turn wireless off, and it's been off since. Could this still be a problem even if wireless is turned off?

Also, We got some new phones a while back, so I just now disconnected all of them, they might be causing some sort of issue. Hopefully x_x

Edit: Disconnected :\ so it's not the phones. Put an old 1.10 firmware on it, now. We'll see how this runs ._. I'm running out of ideas. If I get a chance to, I'll bring my router to a friends place and see if it does the same thing to see if it's the router itself or not.

[lotacus]

do a netstat -b in the command console and paste the results

[elsporko]

Lotacus, did you mean when the internet is connected and everything's fine, or when it's down? Or does it not make a difference Here's what it says right now with pretty much every app I normally have open.

Active Connections

  Proto  Local Address          Foreign Address          State              PID
  TCP    Pwn:1181               Pwn:1182               ESTABLISHED     3972
  [firefox.exe]

  TCP    Pwn:1182               Pwn:1181               ESTABLISHED     3972
  [firefox.exe]

  TCP    Pwn:1193               Pwn:1194               ESTABLISHED     3972
  [firefox.exe]

  TCP    Pwn:1194               Pwn:1193               ESTABLISHED     3972
  [firefox.exe]

  TCP    Pwn:1845               Pwn:12080              ESTABLISHED     3972
  [firefox.exe]

  TCP    Pwn:1986               Pwn:12080              ESTABLISHED     3972
  [firefox.exe]

  TCP    Pwn:2045               Pwn:12080              ESTABLISHED     3972
  [firefox.exe]

  TCP    Pwn:2047               Pwn:12080              ESTABLISHED     3972
  [firefox.exe]

  TCP    Pwn:2095               Pwn:12080              ESTABLISHED     3972
  [firefox.exe]

  TCP    Pwn:2314               Pwn:12080              ESTABLISHED     3972
  [firefox.exe]

  TCP    Pwn:2316               Pwn:12080              ESTABLISHED     3972
  [firefox.exe]

  TCP    Pwn:12080              Pwn:2047               ESTABLISHED     3768
  [ashWebSv.exe]

  TCP    Pwn:12080              Pwn:2316               ESTABLISHED     3768
  [ashWebSv.exe]

  TCP    Pwn:12080              Pwn:2314               ESTABLISHED     3768
  [ashWebSv.exe]

  TCP    Pwn:12080              Pwn:2045               ESTABLISHED     3768
  [ashWebSv.exe]

  TCP    Pwn:12080              Pwn:2095               ESTABLISHED     3768
  [ashWebSv.exe]

  TCP    Pwn:12080              Pwn:1845               ESTABLISHED     3768
  [ashWebSv.exe]

  TCP    Pwn:12080              Pwn:1986               ESTABLISHED     3768
  [ashWebSv.exe]

  TCP    Pwn:1070               cs.xfire.com:25999     ESTABLISHED     3436
  [xfire.exe]

  TCP    Pwn:1738               acd4129913.rit.edu:https  ESTABLISHED     2916
  [digsby-app.exe]

  TCP    Pwn:1806               by2msg3020513.phx.gbl:1863  ESTABLISHED     2916

  [digsby-app.exe]

  TCP    Pwn:2046               dp4.mail.live.com:http  ESTABLISHED     3768
  [ashWebSv.exe]

  TCP    Pwn:2048               origin.sn103w.snt103.mail.live.com:http  ESTABLI
SHED     3768
  [ashWebSv.exe]

  TCP    Pwn:2311               by1msg5096011.phx.gbl:1863  ESTABLISHED     2916

  [digsby-app.exe]

  TCP    Pwn:2317               qb-in-f127.google.com:http  ESTABLISHED     3768

  [ashWebSv.exe]

  TCP    Pwn:5152               Pwn:1192               CLOSE_WAIT      2860
  [jqs.exe]

  TCP    Pwn:1256               a205-200-78-69.deploy.akamaitechnologies.com:htt
p  CLOSE_WAIT      2000
  [jusched.exe]

  TCP    Pwn:2315               i.dslr.net:http        CLOSE_WAIT      3768
  [ashWebSv.exe]

[lotacus]

When you installed the Digsby Instant Messenger program, did you "unsubscribe" or decline from all their advertisment options?

check this out: http://www.downloadsquad.com/2008/11/24/new-digsby-installer-loaded-with-bloat-and-adverts/3

Now, it doesn't directly relate to the problem your having, but it is a possibility, that if you just installe digsby by blindly clicking next, next, install, yes, yes, etc, then you will not even know what malware was installed with Digsby.

You may also want to check out your Avast logs to see if it's dropping connections, or blocking needed processes required to maintain a connection.

With a computer name as Pwn, is someone concerning,

The line: [INFO] Wed Mar 04 09:30:14 2009 Blocked incoming TCP packet from 118.136.8.51:30509 to 142.161.xxx.xx:3992 with unexpected sequence 447785366 (expected 4294901761 to 65536)
 those malformed packets you are seeing from ip: 118.136.8.51 is from indonesia, which is also concerning, pointing at what your "internet environment" is regarding to your online habits.


You line: [INFO] Wed Mar 04 14:31:31 2009 Dropped packet from 5.116.216.100 to 74.52.201.106(IP protocol 17) as unable to create new session (quite a few of these near the most recent logs)
 is the router dropping packets being sent to Avast. For whatever reason it may be.

My suggestion would be to run another A/V program just incase Avast has been compromised, as well as download adaware S&D from www.lavasoft.com.

I would also hope that you obtained your software from a reliable source and one that has not been infected itself.

Run Adaware first and see if it detects anything. I would also hope that you are not infected with the conficker trojan. http://en.wikipedia.org/wiki/Conficker.

[elsporko]

I've ran a scan a few days ago with Avast, Spybot, and Malwarebytes and didn't find much. I just installed Ad-aware, and I'll try out another antivirus program as well. Tonight, I'll reboot into safemode and do a full system scan all night with a few different programs and see if I can find anything.

I do remember something like that when I installed digsby, but I'm pretty sure I either said no to the different offers (Well, "offers" ) in the installer, or I cleaned then up after installing. I've been on the fence between staying with digsby or switching back to trillian anyways, so I just uninstalled digsby to see if it affects anything.

Also, I checked Avast's logs, and the only logs I could find were of past virus scans and virus definition updates. However, just in case, I'll try uninstalling it as well and see if anything happens.

[Reinvented]

Since you swapped out your modem already, you may have an actual LINE problem, which isn't related to the router rebooting or anything.  When the connection/uptime resets, then that means it hasn't established an IP address.  So, one of two things can be occurring here. 

1) There is line attenuation, causing your disconnects, and you should ask your ISP to run some tests to see if the lines are corroded or something.  This can easily cause service interruptions.  It happens with DSL a lot!

2) Since you are using DSL, PPPoE is required to connect, and sometimes requires a username and password.  It may not, and if it doesn't, then make sure you set your "Reconnect Mode" to "Always On", and "Maximum Idle Time" to "0".  This way, regardless of activity, it'll stay on and not disconnect you.  I had noticed that it was trying to do "On Demand"...so of course while it's not being used, it would disconnect you.

Also, if you are going to set DNS servers, please set them in the router. 

If I also recall correctly, you should make sure that the modem is setup properly.  It's pretty much an entire gateway, with firewall and all.  Make sure that it's in bridge mode.

Hope some of that helps.

[bluenote]

Since you've seen the router HAS rebooted I would continue down that road rather than jumping to wild and silly conclusions like you're being hacked over wireless thats not even turned on.

FYI, other torrent clients can keep your IP around for quite a while, and they can produce messages such as you were seeing, long after you turn off YOUR torrent program.  You may be able to confirm that (some of it) by checking your torrent port against some of the packets.  Either way its doubtful that external traffic is causing your problem.

I suspect whats going on is your router is rebooting, and then (for some reason) the authentication is unsynced between modem/router/isp requiring a reboot of the modem.  You ARE using PPPOE as your log states right?

I would continue to pursue eliminating or confirming this behaviour by tracking whether your router is in fact rebooting when this happens most/all instances.  You can probably do this by finding the event log ID on your PC for when it loses connection.

If that is the case then you want to fix the rebooting.  Im running 1.22b05 (just released a few days ago.. check the beta forum for links) and it fixed my remaining reboots.  (combined with simplified settings, turning off everything I wasnt using, or anything that I thought could be stressing the hardware).  As well you need to make sure your torrent settings are such that they wont cause reboots because of too many connections -- there's about 5 settings in utorrent that affect this.  Global connections is one, DHT is another.

Good luck