cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Highlighted
Contributor
2,358 Views
Message 1 of 39

Internet disconnections,event log full!

hi all,iv been having trtouble with my internet for quite a few months.used to get 60 up 20 down,now getting 50 down 6 up,but the speed can drop to say for example 18 and then bad up,as well as packet loss sometimes etc.disconnecting me from games.Bt said as im only getting 1 disconnection a day its ok and not much can be done.in the event log its filling up by the second! and i mean every second or so.heres a few examples of the errors.are these ok or am i getting DDOS'ed or sumin lol.these events are all in the firewall cat.its opening a port then closing it? im confused lol just thought it may give us more info on the internet problems,

 

PUT STARS WERE SOME NUMBERS ARE AS NOT SURE IF I SHOULD ETC 😛

 

BLOCKED 1 more packets (because of Spoofing protection)

BLOCK [12] Spoofing protection (IGMP 192.168.*.***->2*4.0.0.*2 on eth1)

 

IN: ACCEPT [54] Connection opened (Port Forwarding: TCP 192.168.1.67:58100 <-->31.54.65.**2:58100 [109.1**.85.157:5**35] CLOSED/SYN_SENT ppp1 NAPT)

 

N: ACCEPT [57] Connection closed (Port Forwarding: (loads of ips here) CLOSED/SYN_SENT ppp1 NAPT)

 

IN: BLOCK [12] Spoofing protection (IGMP **.**.**.***->***.0.0.22 on ppp1)

 

 

 

0 Ratings
38 REPLIES 38
Highlighted
Contributor
2,353 Views
Message 2 of 39

Re: Internet disconnections,event log full!

internet just disconnected again,loads of event log things again lol

 


dsl light on bt infnity modem flashing green,bt home hub 3 broadband light orange

BLOCKED 1 more packets (because of UDP Flood Protection)

11:47:16, 11 Nov.    IN: BLOCK [12] Spoofing protection (IGMP 192.168.1.254->224.0.0.22 on eth1)
11:46:38, 11 Nov.    IN: BLOCK [12] Spoofing protection (IGMP 86.167.**.170->224.0.0.22 on ppp1)
11:45:31, 11 Nov.    IN: BLOCK [12] Spoofing protection (IGMP 192.168.1.254->224.0.0.22 on eth1)
11:44:31, 11 Nov.    IN: BLOCK [12] Spoofing protection (IGMP 86.167.**.170->224.0.0.22 on ppp1)
11:43:23, 11 Nov.    IN: BLOCK [12] Spoofing protection (IGMP 192.168.1.254->224.0.0.22 on eth1)
11:42:58, 11 Nov.    (64087.690000) CWMP: session completed successfully
11:42:58, 11 Nov.    (64087.470000) CWMP: HTTP authentication success from https://pbthdm.bt.mo
11:42:55, 11 Nov.    IN: BLOCK [12] Spoofing protection (IGMP 192.168.1.254->224.0.0.22 on eth1)
11:42:55, 11 Nov.    BLOCKED 3 more packets (because of Spoofing protection)
11:42:55, 11 Nov.    IN: BLOCK [12] Spoofing protection (IGMP 192.168.1.254->224.0.0.22 on eth1)
11:42:50, 11 Nov.    (64079.800000) CWMP: Server URL: https://pbthdm.bt.mo; Connecting as user: ACS username
11:42:50, 11 Nov.    (64079.800000) CWMP: Session start now. Event code(s): '4 VALUE CHANGE'
11:42:45, 11 Nov.    (64074.910000) WAN operating mode is Ethernet
11:42:45, 11 Nov.    (64074.910000) Last WAN operating mode was Ethernet
11:42:45, 11 Nov.    (64074.850000) PPPoE is up
11:42:44, 11 Nov.    (64073.920000) PPP IPCP Receive Configuration ACK
11:42:44, 11 Nov.    (64073.920000) PPP IPCP Send Configuration Request
11:42:44, 11 Nov.    (64073.910000) PPP IPCP Receive Configuration NAK
11:42:44, 11 Nov.    (64073.910000) PPP IPCP Send Configuration ACK
11:42:44, 11 Nov.    (64073.910000) PPP IPCP Receive Configuration Request
11:42:44, 11 Nov.    (64073.900000) PPP IPCP Send Configuration Request
11:42:44, 11 Nov.    (64073.900000) CHAP authentication successful
11:42:44, 11 Nov.    (64073.430000) CHAP Receive Challenge
11:42:44, 11 Nov.    (64073.430000) Starting CHAP authentication with peer
11:42:44, 11 Nov.    (64073.430000) PPP LCP Receive Configuration ACK
11:42:44, 11 Nov.    (64073.420000) PPP LCP Send Configuration Request
11:42:44, 11 Nov.    (64073.420000) PPP LCP Receive Configuration Reject
11:42:44, 11 Nov.    (64073.420000) PPP LCP Send Configuration ACK
11:42:44, 11 Nov.    (64073.420000) PPP LCP Receive Configuration Request
11:42:44, 11 Nov.    (64073.410000) PPP LCP Send Configuration Request
11:39:28, 11 Nov.    IN: BLOCK [12] Spoofing protection (IGMP 192.168.1.254->224.0.0.22 on eth1)
11:39:02, 11 Nov.    (63851.210000) Lease for IP 192.168.1.69 renewed by host dhcpcd 4.0.15(4c-bc-a5-c9-fe-23) (MAC 4c:bc:a5:c9:fe:23). Lease duration: 1440 min
11:39:02, 11 Nov.    (63851.210000) Device connected: Hostname: dhcpcd 4.0.15(4c-bc-a5-c9-fe-23) IP: 192.168.1.** MAC: 4c:bc:a5:c9:fe:23 Lease time: 1440 min. Link rate: 39.0 Mbps
11:39:02, 11 Nov.    (63851.190000) Lease requested
11:39:02, 11 Nov.    ath0: STA 4c:bc:a5:c9:fe:23 IEEE 802.11: Client associated
11:38:54, 11 Nov.    (63843.820000) Device disconnected: Hostname: dhcpcd 4.0.15(4c-bc-a5-c9-fe-23) IP: 192.168.1.** MAC: 4c:bc:a5:c9:fe:23
11:38:53, 11 Nov.    ath0: STA 4c:bc:a5:c9:fe:23 IEEE 802.11: Client disassociated
11:37:04, 11 Nov.    (63733.310000) Lease for IP 192.168.1.** renewed by host dhcpcd 4.0.15(4c-bc-a5-c9-fe-23) (MAC 4c:bc:a5:c9:fe:23). Lease duration: 1440 min
11:37:04, 11 Nov.    (63733.310000) Device connected: Hostname: dhcpcd 4.0.15(4c-bc-a5-c9-fe-23) IP: 192.168.1.** MAC: 4c:bc:a5:c9:fe:23 Lease time: 1440 min. Link rate: 39.0 Mbps
11:37:04, 11 Nov.    (63733.300000) Lease requested
11:37:03, 11 Nov.    ath0: STA 4c:bc:a5:c9:fe:23 IEEE 802.11: Client associated
11:37:03, 11 Nov.    ath0: STA 4c:bc:a5:c9:fe:23 IEEE 802.11: Client disassociated
11:36:42, 11 Nov.    (63711.010000) CWMP: session closed due to error: Could not resolve host
11:36:42, 11 Nov.    (63710.980000) CWMP: Server URL: https://pbthdm.bt.mo; Connecting as user: ACS username
11:36:42, 11 Nov.    (63710.980000) CWMP: Session start now. Event code(s): '4 VALUE CHANGE'

0 Ratings
Highlighted
Contributor
2,330 Views
Message 3 of 39

Re: Internet disconnections,event log full!

Seems like you are being flooded with spoof packets I'd contact the mods about that.

0 Ratings
Highlighted
Contributor
2,311 Views
Message 4 of 39

Re: Internet disconnections,event log full!

how though lol? whats it do etc?

0 Ratings
Highlighted
Contributor
2,301 Views
Message 5 of 39

Re: Internet disconnections,event log full!

The contact E-Mail; http://bt.custhelp.com/app/contact_email/c/4951

 

and it's basicly someone flooding your IP with spoof packets nocking you offline.

0 Ratings
Highlighted
Distinguished Expert
2,300 Views
Message 6 of 39

Re: Internet disconnections,event log full!

224.0.0.22 is the multicast address for Internet Group Management Protocol. This is normal traffic, and it stays on your local network.
0 Ratings
Highlighted
Contributor
2,294 Views
Message 7 of 39

Re: Internet disconnections,event log full!

Must be something on his network causing the spoofing?
0 Ratings
Highlighted
Contributor
2,290 Views
Message 8 of 39

Re: Internet disconnections,event log full!

wow im confused lol event log doesnt have any spoofing in atm just opening and closing ports ever second

0 Ratings
Highlighted
Distinguished Expert
2,288 Views
Message 9 of 39

Re: Internet disconnections,event log full!

probably a badly configured firewall
0 Ratings
Highlighted
Distinguished Expert
2,287 Views
Message 10 of 39

Re: Internet disconnections,event log full!


@sunzzofman wrote:

wow im confused lol event log doesnt have any spoofing in atm just opening and closing ports ever second


can you post an extract?

 

0 Ratings