2
My ADSL router (a 10-ish years old Comtrend AR-5381u) keeps disconnecting from the Internet every few minutes. It's been like that for 3-4 days; the weird thing is that it only happens during the evenings.
I have tried rebooting the router from the software admin console (it doesn't help), and physically turning it off and on again (for the previous days, it solved the problem... today it didn't).
I have WiFi enabled (WPA2-PSK + AES, and MAC filtering). Not sure if that's secure enough, but anyway I'm checking the "WiFi authenticated devices" and the only one shown is my own phone, so it's not a bored neighbour messing up with my WiFi.
Also, I'm not running any P2P software, nor doing anything that could break the Internet. Just a couple open tabs in Google Chrome, and a few background apps in the phone. Other times I'm just watching Netflix or Youtube on my TV, no computer at all.
What could I do (if anything) to solve or at least diagnose the problem?
I don't even know if it's my router, or the ISP, or somebody taking my connection down (DDoS? It's not like I'm Microsoft, it's just my home...).
Here is the system log since the last (physical) reboot. There are a lot of "kernel intrussions", but from what I've read, I shouldn't worry about them, they're just attempts to access my router from the Internet (or aren't they?).
Jan 1 00:00:08 syslog emerg BCM96345 started: BusyBox v1.00 (2011.10.28-05:10+0000)
Jan 1 00:00:24 user crit kernel: Line 0: xDSL G.994 training
Jan 1 00:00:24 user crit kernel: eth0 Link UP 100 mbps full duplex
Jan 1 00:00:37 user crit kernel: Line 0: ADSL G.992 started
Jan 1 00:00:41 user crit kernel: Line 0: ADSL G.992 channel analysis
Jan 1 00:00:45 user crit kernel: Line 0: ADSL G.992 message exchange
Jan 1 00:00:46 user crit kernel: Line 0: ADSL link down
Jan 1 00:00:47 user crit kernel: Line 0: xDSL G.994 training
Jan 1 00:01:00 user crit kernel: Line 0: ADSL G.992 started
Jan 1 00:01:04 user crit kernel: Line 0: ADSL G.992 channel analysis
Jan 1 00:01:08 user crit kernel: Line 0: ADSL G.992 message exchange
Jan 1 00:01:10 user crit kernel: Line 0: ADSL link up, Bearer 0, us=842, ds=16590
Jan 1 00:01:34 daemon crit syslog: PPP server detected.
Jan 1 00:01:34 daemon crit syslog: PPP session established.
Jan 1 00:01:40 daemon crit syslog: PPP LCP UP.
Jan 1 00:03:22 daemon crit syslog: PPP server detected.
Jan 1 00:03:23 daemon crit syslog: PPP session established.
Jan 1 00:03:26 daemon crit syslog: PPP LCP UP.
Jan 1 00:03:26 daemon crit syslog: Received valid IP address from server. Connection UP.
Apr 7 20:30:00 user alert kernel: Intrusion -> IN=ppp0 OUT= MAC= SRC=77.72.82.94 DST=95.16.160.53 LEN=40 TOS=0x00 PREC=0x00 TTL=244 ID=20107 PROTO=TCP SPT=41720 DPT=8859 WINDOW=1024 RES=0x00 SYN URGP=0 MARK=0x8000000
Apr 7 20:30:00 user alert kernel: Intrusion -> IN=ppp0 OUT= MAC= SRC=46.161.55.108 DST=95.16.160.53 LEN=40 TOS=0x00 PREC=0x00 TTL=243 ID=19005 PROTO=TCP SPT=43447 DPT=2443 WINDOW=1024 RES=0x00 SYN URGP=0 MARK=0x8000000
Apr 7 20:30:01 user alert kernel: Intrusion -> IN=ppp0 OUT= MAC= SRC=5.188.11.37 DST=95.16.160.53 LEN=40 TOS=0x00 PREC=0x00 TTL=244 ID=38893 PROTO=TCP SPT=55797 DPT=5389 WINDOW=1024 RES=0x00 SYN URGP=0 MARK=0x8000000
Apr 7 20:30:29 user alert kernel: Intrusion -> IN=ppp0 OUT= MAC= SRC=59.38.100.155 DST=95.16.160.53 LEN=40 TOS=0x00 PREC=0x00 TTL=241 ID=61313 PROTO=TCP SPT=58121 DPT=1433 WINDOW=1024 RES=0x00 SYN URGP=0 MARK=0x8000000
Apr 7 20:30:45 user alert kernel: Intrusion -> IN=ppp0 OUT= MAC= SRC=223.100.148.74 DST=95.16.160.53 LEN=40 TOS=0x00 PREC=0x00 TTL=233 ID=33541 PROTO=TCP SPT=45265 DPT=1433 WINDOW=1024 RES=0x00 SYN URGP=0 MARK=0x8000000
Apr 7 20:40:01 user alert kernel: Intrusion -> IN=ppp0 OUT= MAC= SRC=50.2.190.138 DST=95.16.160.53 LEN=40 TOS=0x00 PREC=0x00 TTL=243 ID=8313 DF PROTO=TCP SPT=18013 DPT=1250 WINDOW=512 RES=0x00 SYN URGP=0 MARK=0x8000000
Apr 7 20:50:07 user alert kernel: Intrusion -> IN=ppp0 OUT= MAC= SRC=185.216.140.16 DST=95.16.160.53 LEN=40 TOS=0x00 PREC=0x00 TTL=243 ID=23593 DF PROTO=TCP SPT=32210 DPT=3308 WINDOW=512 RES=0x00 SYN URGP=0 MARK=0x8000000
Apr 7 21:00:03 user alert kernel: Intrusion -> IN=ppp0 OUT= MAC= SRC=211.152.60.146 DST=95.16.160.53 LEN=40 TOS=0x00 PREC=0x00 TTL=110 ID=256 PROTO=TCP SPT=49268 DPT=445 WINDOW=16384 RES=0x00 SYN URGP=0 MARK=0x8000000
Apr 7 21:02:01 user crit kernel: Line 0: ADSL link down
Apr 7 21:02:01 user crit kernel: Line 0: xDSL G.994 training
Apr 7 21:02:01 daemon crit syslog: Clear IP addresses. PPP connection DOWN.
Apr 7 21:02:01 daemon crit syslog: Clear IP addresses. Connection DOWN.
Apr 7 21:02:13 user crit kernel: Line 0: ADSL G.992 started
Apr 7 21:02:17 user crit kernel: Line 0: ADSL G.992 channel analysis
Apr 7 21:02:21 user crit kernel: Line 0: ADSL G.992 message exchange
Apr 7 21:02:22 user crit kernel: Line 0: ADSL link down
Apr 7 21:02:23 user crit kernel: Line 0: xDSL G.994 training
Apr 7 21:02:36 user crit kernel: Line 0: ADSL G.992 started
Apr 7 21:02:40 user crit kernel: Line 0: ADSL G.992 channel analysis
Apr 7 21:02:44 user crit kernel: Line 0: ADSL G.992 message exchange
Apr 7 21:02:45 user crit kernel: Line 0: ADSL link up, Bearer 0, us=888, ds=17075
Apr 7 21:03:12 daemon crit syslog: PPP server detected.
Apr 7 21:03:12 daemon crit syslog: PPP session established.
Apr 7 21:03:15 daemon crit syslog: PPP LCP UP.
Apr 7 21:03:17 daemon crit syslog: Received valid IP address from server. Connection UP.
Apr 7 21:03:28 user alert kernel: Intrusion -> IN=ppp0 OUT= MAC= SRC=185.216.140.16 DST=95.16.58.57 LEN=40 TOS=0x00 PREC=0x00 TTL=242 ID=29519 DF PROTO=TCP SPT=17817 DPT=3729 WINDOW=512 RES=0x00 SYN URGP=0 MARK=0x8000000
Apr 7 21:04:07 user alert kernel: Intrusion -> IN=ppp0 OUT= MAC= SRC=5.188.11.37 DST=95.16.58.57 LEN=40 TOS=0x00 PREC=0x00 TTL=245 ID=44709 PROTO=TCP SPT=55797 DPT=3382 WINDOW=1024 RES=0x00 SYN URGP=0 MARK=0x8000000
Apr 7 21:04:21 user crit kernel: Line 0: ADSL link down
Apr 7 21:04:21 user crit kernel: Line 0: xDSL G.994 training
Apr 7 21:04:21 daemon crit syslog: Clear IP addresses. PPP connection DOWN.
Apr 7 21:04:21 daemon crit syslog: Clear IP addresses. Connection DOWN.
Apr 7 21:04:33 user crit kernel: Line 0: ADSL G.992 started
Apr 7 21:04:37 user crit kernel: Line 0: ADSL G.992 channel analysis
Apr 7 21:04:42 user crit kernel: Line 0: ADSL G.992 message exchange
Apr 7 21:04:43 user crit kernel: Line 0: ADSL link down
Apr 7 21:04:44 user crit kernel: Line 0: xDSL G.994 training
Apr 7 21:04:56 user crit kernel: Line 0: ADSL G.992 started
Apr 7 21:05:00 user crit kernel: Line 0: ADSL G.992 channel analysis
Apr 7 21:05:05 user crit kernel: Line 0: ADSL G.992 message exchange
Apr 7 21:05:06 user crit kernel: Line 0: ADSL link up, Bearer 0, us=888, ds=16380
Apr 7 21:05:30 daemon crit syslog: PPP server detected.
Apr 7 21:05:30 daemon crit syslog: PPP session established.
Apr 7 21:05:33 daemon crit syslog: PPP LCP UP.
Apr 7 21:05:34 daemon crit syslog: Received valid IP address from server. Connection UP.
Apr 7 21:06:08 user alert kernel: Intrusion -> IN=ppp0 OUT= MAC= SRC=109.248.9.18 DST=87.218.25.144 LEN=40 TOS=0x00 PREC=0x00 TTL=243 ID=38071 PROTO=TCP SPT=50193 DPT=51391 WINDOW=1024 RES=0x00 SYN URGP=0 MARK=0x8000000
Apr 7 21:06:36 user alert kernel: Intrusion -> IN=ppp0 OUT= MAC= SRC=185.216.140.16 DST=87.218.25.144 LEN=40 TOS=0x00 PREC=0x00 TTL=243 ID=50787 DF PROTO=TCP SPT=50400 DPT=4509 WINDOW=512 RES=0x00 SYN URGP=0 MARK=0x8000000
Apr 7 21:06:45 user alert kernel: Intrusion -> IN=ppp0 OUT= MAC= SRC=139.162.115.7 DST=87.218.25.144 LEN=40 TOS=0x00 PREC=0x00 TTL=241 ID=54321 PROTO=TCP SPT=58362 DPT=110 WINDOW=65535 RES=0x00 SYN URGP=0 MARK=0x8000000
Apr 7 21:06:58 user alert kernel: Intrusion -> IN=ppp0 OUT= MAC= SRC=185.130.212.2 DST=87.218.25.144 LEN=40 TOS=0x00 PREC=0x00 TTL=243 ID=56833 DF PROTO=TCP SPT=2 DPT=8034 WINDOW=512 RES=0x00 SYN URGP=0 MARK=0x8000000
Apr 7 21:07:18 user crit kernel: Line 0: ADSL link down
Apr 7 21:07:18 user crit kernel: Line 0: xDSL G.994 training
Apr 7 21:07:19 daemon crit syslog: Clear IP addresses. PPP connection DOWN.
Apr 7 21:07:19 daemon crit syslog: Clear IP addresses. Connection DOWN.
Apr 7 21:07:30 user crit kernel: Line 0: ADSL G.992 started
Apr 7 21:07:34 user crit kernel: Line 0: ADSL G.992 channel analysis
Apr 7 21:07:39 user crit kernel: Line 0: ADSL G.992 message exchange
Apr 7 21:07:40 user crit kernel: Line 0: ADSL link down
Apr 7 21:07:41 user crit kernel: Line 0: xDSL G.994 training
Apr 7 21:07:53 user crit kernel: Line 0: ADSL G.992 started
Apr 7 21:07:57 user crit kernel: Line 0: ADSL G.992 channel analysis
Apr 7 21:08:02 user crit kernel: Line 0: ADSL G.992 message exchange
Apr 7 21:08:03 user crit kernel: Line 0: ADSL link up, Bearer 0, us=888, ds=16847
Apr 7 21:08:27 daemon crit syslog: PPP server detected.
Apr 7 21:08:27 daemon crit syslog: PPP session established.
Apr 7 21:08:30 daemon crit syslog: PPP LCP UP.
Apr 7 21:08:31 daemon crit syslog: Received valid IP address from server. Connection UP.
Apr 7 21:09:07 user alert kernel: Intrusion -> IN=ppp0 OUT= MAC= SRC=185.222.211.90 DST=87.218.24.53 LEN=40 TOS=0x00 PREC=0x00 TTL=244 ID=3613 PROTO=TCP SPT=53518 DPT=33392 WINDOW=1024 RES=0x00 SYN URGP=0 MARK=0x8000000
Apr 7 21:09:15 user alert kernel: Intrusion -> IN=ppp0 OUT= MAC= SRC=185.216.140.16 DST=87.218.24.53 LEN=40 TOS=0x00 PREC=0x00 TTL=243 ID=11129 DF PROTO=TCP SPT=6335 DPT=4869 WINDOW=512 RES=0x00 SYN URGP=0 MARK=0x8000000
Apr 7 21:09:27 user alert kernel: Intrusion -> IN=ppp0 OUT= MAC= SRC=181.214.87.248 DST=87.218.24.53 LEN=40 TOS=0x00 PREC=0x00 TTL=244 ID=33982 PROTO=TCP SPT=46326 DPT=3389 WINDOW=1024 RES=0x00 SYN URGP=0 MARK=0x8000000
Apr 7 21:09:39 user crit kernel: Line 0: ADSL link down
Apr 7 21:09:39 user crit kernel: Line 0: xDSL G.994 training
Apr 7 21:09:39 daemon crit syslog: Clear IP addresses. PPP connection DOWN.
Apr 7 21:09:39 daemon crit syslog: Clear IP addresses. Connection DOWN.
Apr 7 21:09:51 user crit kernel: Line 0: ADSL G.992 started
Apr 7 21:09:55 user crit kernel: Line 0: ADSL G.992 channel analysis
Apr 7 21:10:00 user crit kernel: Line 0: ADSL G.992 message exchange
Apr 7 21:10:01 user crit kernel: Line 0: ADSL link down
Apr 7 21:10:02 user crit kernel: Line 0: xDSL G.994 training
Apr 7 21:10:14 user crit kernel: Line 0: ADSL G.992 started
Apr 7 21:10:18 user crit kernel: Line 0: ADSL G.992 channel analysis
Apr 7 21:10:23 user crit kernel: Line 0: ADSL G.992 message exchange
Apr 7 21:10:24 user crit kernel: Line 0: ADSL link up, Bearer 0, us=888, ds=16953
Apr 7 21:10:48 daemon crit syslog: PPP server detected.
Apr 7 21:11:18 daemon crit syslog: PPP session established.
Apr 7 21:11:21 daemon crit syslog: PPP LCP UP.
Apr 7 21:11:22 daemon crit syslog: Received valid IP address from server. Connection UP.
Apr 7 21:11:51 user alert kernel: Intrusion -> IN=ppp0 OUT= MAC= SRC=77.72.82.103 DST=95.16.175.33 LEN=40 TOS=0x00 PREC=0x00 TTL=245 ID=20005 PROTO=TCP SPT=54206 DPT=49 WINDOW=1024 RES=0x00 SYN URGP=0 MARK=0x8000000
Apr 7 21:12:09 user alert kernel: Intrusion -> IN=ppp0 OUT= MAC= SRC=185.216.140.16 DST=95.16.175.33 LEN=40 TOS=0x00 PREC=0x00 TTL=243 ID=37390 DF PROTO=TCP SPT=18182 DPT=4929 WINDOW=512 RES=0x00 SYN URGP=0 MARK=0x8000000
Apr 7 21:12:41 user alert kernel: Intrusion -> IN=ppp0 OUT= MAC= SRC=141.105.71.116 DST=95.16.175.33 LEN=40 TOS=0x00 PREC=0x00 TTL=243 ID=55831 DF PROTO=TCP SPT=12970 DPT=8091 WINDOW=512 RES=0x00 SYN URGP=0 MARK=0x8000000
Apr 7 21:12:44 user alert kernel: Intrusion -> IN=ppp0 OUT= MAC= SRC=189.211.6.43 DST=95.16.175.33 LEN=52 TOS=0x00 PREC=0x00 TTL=114 ID=27155 DF PROTO=TCP SPT=61195 DPT=445 WINDOW=8192 RES=0x00 SYN URGP=0 MARK=0x8000000
Apr 7 21:12:52 user alert kernel: Intrusion -> IN=ppp0 OUT= MAC= SRC=5.101.2.205 DST=95.16.175.33 LEN=40 TOS=0x00 PREC=0x00 TTL=243 ID=38539 PROTO=TCP SPT=47669 DPT=3426 WINDOW=1024 RES=0x00 SYN URGP=0 MARK=0x8000000
Apr 7 21:13:37 user alert kernel: Intrusion -> IN=ppp0 OUT= MAC= SRC=5.188.11.43 DST=95.16.175.33 LEN=40 TOS=0x00 PREC=0x00 TTL=244 ID=23727 PROTO=TCP SPT=47504 DPT=4049 WINDOW=1024 RES=0x00 SYN URGP=0 MARK=0x8000000
Apr 7 21:13:42 user alert kernel: Intrusion -> IN=ppp0 OUT= MAC= SRC=77.72.82.88 DST=95.16.175.33 LEN=40 TOS=0x00 PREC=0x00 TTL=245 ID=6796 PROTO=TCP SPT=59153 DPT=3222 WINDOW=1024 RES=0x00 SYN URGP=0 MARK=0x8000000
Apr 7 21:13:44 user alert kernel: Intrusion -> IN=ppp0 OUT= MAC= SRC=93.174.93.218 DST=95.16.175.33 LEN=40 TOS=0x00 PREC=0x00 TTL=244 ID=22819 PROTO=TCP SPT=46685 DPT=20183 WINDOW=1024 RES=0x00 SYN URGP=0 MARK=0x8000000
Apr 7 21:13:59 user crit kernel: Line 0: ADSL link down
Apr 7 21:13:59 user crit kernel: Line 0: xDSL G.994 training
Apr 7 21:13:59 daemon crit syslog: Clear IP addresses. PPP connection DOWN.
Apr 7 21:13:59 daemon crit syslog: Clear IP addresses. Connection DOWN.
Apr 7 21:14:11 user crit kernel: Line 0: ADSL G.992 started
It seems like the line goes down shortly after there are a few "intrussions"... each time. So maybe it's some sort of attack taking it down, or at least making the router unresponsive so that it loses the connection. Can I somehow protect it from this?
Update:
I unplugged all the phones, and connected the router directly to the wall socket. It improved slightly, but it still keeps disconnecting.
The router statistics show a SNR margin of around 9dB whenever the connection goes up, and then it drops. Sometimes it keeps at 8 or 7, sometimes it drops to 5, 4, 3dB... The lowest I've seen it is 1.9. Sometimes it goes back up to 7, other times the connection is lost. Both downstream and upstream fluctuate like that, but downstream is usually lower. My connection is "up to 20Mbps download and up to 1Mbps upload", so I guess the upstream is not "as crowded".
Other thing I've noticed is that I have an insane number of HEC errors, mostly downstream. Like 5000 new errors every 15 seconds. And that's when the line is actually up and working...
Here is an screenshot of the statistics page right now. 1.8 million HEC errors... since the last reboot 8 hours ago:
1Might be time for a new router or a firmware upgrade if available. – Moab – 2018-04-07T19:49:25.647
4Call your ISP first before trying anything else. It looks like there may be an issue with your ADSL connection. – DavidPostill – 2018-04-07T19:50:12.810
1A decade is an incredible amount of time for that to be running. Does your modem show SNR readings? – Tim_Stewart – 2018-04-08T00:46:02.977
It shows "SNR margin", it starts around 9dB when it reconnects, then falls to somewhere around 3dB, and then the connection is lost. By the way it's 8 in the morning and the problem keeps happening, even worse than in the previous days. I guess the problem is a very noisy line on the ISP's end? – AJPerez – 2018-04-08T06:43:00.590
If you have access to your side of the wiring, it's never a bad idea to try and troubleshoot inside wiring. If you have any other phones or equipment on that line disconnect them when you troubleshoot. Sometimes it can be a faulty handset etc. – Tim_Stewart – 2018-04-08T06:57:37.600
3db of SNR is a very low level, and sounds like the reason of it disconnecting. That may be just a rusty connection, loose cable or a number of other things. If you have inside cabling, you may want to test the line attaching at the demarc, or w/o the phone and filters. – Carlos Mendioroz – 2018-04-08T15:33:24.077
What @DavidPostill says is correct. I would also add it could be something simpler such as your ADSL modem dying. If this modem is ISP equipment, contact your ISP and ask them to diagnose and possibly replace it. – JakeGould – 2018-04-08T17:06:07.980
3
CRC, FEC and HEC errors usually indicate noise problems on the line. See ::. Kitz - Linestat parameters & counters .:: for more info.
– DavidPostill – 2018-04-08T17:24:30.4031HEC Errors Router – DavidPostill – 2018-04-08T17:27:21.057