Zippy

Hey CR could you clarify what you mean by your ISP hands out new IPs every 2-3 hours? Do you mean they hand out new public IPs every 2-3 hours? Also what do you men by some IPs change the location? What IP are you referring too when you say closest to your ISP? Thanks! Zippy..

No worries Fraser please do if you can get better clarification.. It would help understand things better.. There has to be something to this.. I do think your first answer is correct.. I know you use to play Halo5.. What type of traffic do you show in NM when playing Halo5? Whats really confusing me is the fact when playing Halo5 it use to show up as Skype.. And when it did the game played what I would call amazing.. But yet NM doesnt always pick it up as Skype.. It usually picks it up as Unknown.. I think ive stumbled on some old youtube videos of you btw.. And one I think you were playing H5! Thanks! Zippy.

Out of curiosity what do you get on NM when playing games? Do you show unknown or uncat.? Thanks! Zippy.

Interesting Fraser.. I have a question then on your above answer.. If say when playing a game like Halo5 and Network Monitor is showing it as unknown does that mean also that on the QoS page the game is unknown as well? Does this have any effect on how the game performs? Being labeled as unknown? You say you detect the traffic but why would a game like Halo not be at least added to gaming? Does Halo operate differently and make it difficult to add it to gaming? There are times when I do see Halo5 pop up as Skype in the NM.. strange thing there is when it does show this the game performs quite well.. When it doesnt show it or shows unknown it doesnt perform as well.. strange tbh why theres no consistency there.. Thanks! Zippy.

If your internet is going down then it is likely a misidentifying of that IP by your router.. I had a similar situation on my XR500 where is would start to do that to my ISP dns.. You could always call your ISP and ask them about that IP.. You could also possibly make a static route rule and try to block that IP that way... You will know really quick if its tied to you in some sort of fashion.. To me its either a dns IP or its a WAN IP from a range you may have if you have a Dynamic IP from your ISP.. How close is that IP to your WAN IP that your Netgear shows? Also double check to make sure it isnt a dns IP from your ISP.. I just find it really strange that you have Comcast as your ISP and that IP is from them and the router is calling it a form of a DOS Attack or Fraggle Attack.. Im sure either Fraser or Liam will be able to help you further or give some better advice.. Good luck! Zippy.

Do an IP lookup and see who that IP is.. Thats what I would do first.. Is Comcast your ISP? Thanks! Zippy.

Hey Liam.. I believe the Op said he had a arrow sb8200.. But I think what he might have meant was he had a Arris sb8200 modem DOCSIS 3.1.. Which in that case is a pure modem only and is not a modem router combo.. Zippy.

I tried that and it didnt eliminate the attacks.. My situation is unique because of my NAT type reporting Open on my Xbox when everything is locked down.. In your case you are likely fine.. Im sure Fraser can give you better guidance.. As a test you can always set that to Secure and shut Upnp off and have no port forwarding no DMZ and see if the device you play on is still reporting an Open NAT.. It should not show Open at that point.. Thanks! Zippy.

Exactly! This isnt meant to scare anybody.. It was just my situation was odd with my NAT reporting Open when it shouldnt have been.. Zippy.

That is true.. As long as they dont get through the firewall.. In my case I was doubting if my firewall was properly working.. There was a few things that occurred when I had these attacks.. One was it brought my network to a halt because of the ports that were being targeted.. Simple web pages wouldnt load, Updates wouldnt get through, things like that.. The router also began to scan and block ports that were from also know IPs.. Its common to see these attacks.. But not very common to see them on ports such as 80, 8080, 443, 53 ect.. And not common to see them flood those ports.. Which will cause a network performance issue like it did to myself.. I was on the most current beta firmware 120 and what was concerning on my XR500 was that my NAT type was still reporting Open when everything was locked down in the router.. When that occurred and given these attacks taking place I didnt feel comfortable at this point because I felt the firewall may not be properly working at this point.. So I took my XR out of my Network.. I much rather be safe then sorry.. Specially when running beta firmwares.. Because anything can happen during betas.. Zippy.

Thanks for sharing this! It will help alot that im likely not alone on this.. Not to mention it should help Netgear as well.. Fraser will know what to do.. Thanks Will Zippy.

@Will That doesnt look normal.. You are showing some of the same DOS Attacks I had.. Specially if those are coming from known IPs.. It might be best to have Fraser take a peek.. After closer look you are also getting DOS Attacks on port 443.. I definetily would be careful at this point because you are showing very similar events taking place as myself.. Thanks! Zippy.

Thanks Fraser! I do appreciate all your help.. If the lead XR needs any info or what not im here for you guys! I would think im likely not the only one experiencing this.. Specially if one is having a hard time getting a clean factory reset on the XR.. If I think of any other info I may have forgot or might help I will post here for you.. Thanks! Zippy.

@Netduma FraserI do have one question for you.. Do you see any reason that I shouldnt use the XR500 as a AP under my circumstance? I was thinking on putting it into AP mode and run that to the R2 for wifi.. Just your thoughts.. I would think that it would be safe to do that with out issue.. Thanks! Zippy.

Welcome Fraser! Yes that is what concerns me as well.. With an Open NAT under those circumstances makes one wonder if the firewall is enabling properly or at all.. That is why I went back to the R2 atm.. I didnt feel comfortable with the current operation of the XR500 in that sense and with what was going on with it.. Its very possible the firewall isnt loading or reloading properly.. As far as when this has taken place I would say its either this most current firmware .120 or the prior firmware.. That was the time frame it happened at.. But it wasnt until this most current firmware where I was getting those DOS Attacks like I have been on key ports.. Things really point to this most current firmware.. Do you happen to know who else is having this trouble with QoS on this firmware? It might not hurt to have them to try to see if they can get there NAT to do the same as mine.. See if there is a connection there.. Either way its something most might not even know is an issue because they assume an Open NAT is good to go when in this situation it might not be.. If you have any other questions Fraser im here! Thanks! Zippy.

Hey turbosi92.. After you installed the beta firmware 102 did you factory reset after? It is key to factory reset after a firmware.. specially a beta firmware.. A reboot wont likely work.. A full factory reset is needed.. Just not sure if you did that or not! Thanks! Zippy.

Hello Fraser! Wanted to give you a recap of my issues with the XR500.. All devices in our home had updates blocked by the XR500 in some sort or fashion. It wasn't just MS products.. It was also apple products like our IPhones as well and smart tvs.. In some cases there were multiple updates for some devices.. I did also check to see if my NAT type was still reporting Open even after the factory reset and everything was locked down.. Meaning no port forwarding, No DMZ, No port triggering, NAT type set to secure and my Xbox was still reporting open NAT.. That also was with just IPV4.. No IPV6 enabled.. I even hard reset my Xbox to make sure it wasnt miss reporting.. But it wasnt.. All devices and even the Xbox were reporting a Local IP that was assigned by the XR500.. The Xbox was using 192.168.1.3 and it was reporting an Open NAT under the circumstances I mentioned above.. I even noticed DOS Attacks happening on my Xbox while playing a game.. The port number caught my eye because its one of the ports that game uses.. Along with the IP it was coming from.. Which started with a 52.. Which was a Azure MS server.. I even got DOS Attacks on my ISP DNS on port 53 and thats when things really got ugly.. Which would make total sense.. I watched my logs and notice since 53 was being blocked it kept trying other port numbers like 54 55 56 57 ect ect.. And everything was showing as being DOS Attack in the logs.. One of my biggest concerns was that my Xbox was reporting an Open NAT.. I felt uneasy about that because if my Xbox is showing that what other devices on my Network maybe exposed to a wide open NAT.. That was a security issue I was afraid of and didnt want to chance it.. Currently I have taken my XR500 out of my Network and am using the R2 atm.. I feel more comfortable with that.. Not to mention I dont get those DOS Attacks where my whole Network comes to a crawl.. Hopefully there is something from this that might help NG find a cause or solution.. Fraser if there is anything you or Liam have questions on please feel free to ask.. In case there are other questions that may help! Thats what im here to do is help out in anyway possible.. PS.. I had no Traffic Controller Rules.. Thanks again! Zippy..

@Dialatech and @UK Sentinel My Dos Attacks weren't what I would say security threats but more of the problem of them being either filtered or blocked to known trusted sites.. So what would happen was it would slow down my network or basically bring it to an unusable state.. Ports to watch for are your basic ports like 443, 80, 53 and others that you know that are used on your own network.. There were other ports I noticed that were tied to my gaming as well.. Which made it impossible to game then.. Either I would get kicked from a game or the game was just unplayable.. With any beta firmware one does want to be careful and watch for things.. Id watch for these DOS Attacks and just check a few if you get any.. See what exactly they are.. If your getting large numbers then I would pay attention more to see if any of them occur during whatever your doing on your network.. Like gaming and or working from your laptop/computer.. Hopefully that helps! Feel free to share your thoughts or experiences with the new firmware.. Things that may seem off to you ect ect.. Thanks! Zippy..

Also I did just try this again and I already have these Dos Attacks pilling up! Just took a quick look.. Zippy.

Hello Fraser! I just wanted to give you an update after trying that method of factory resetting.. It did not work.. 😕 I tried it a few times with no luck.. after each time I noticed that my QoS settings were all still present after each factory reset.. My biggest concern is with these Dos Attacks because it basically brings my Network to a complete halt.. Even when I go into WAN and disable Dos and Port scan protect my Network doesnt seem to recover.. Do you want me to see if my Xbox NAT type is still Open? I can report that back to you quick if need be.. Every time I had checked before it was always Open.. With no option enabled that would normally get one an Open NAT.. I will try to wait to hear back from you.. I know you maybe off already.. But if not let me know.. Thanks! Zippy.

Thanks Fraser! I will give it a go! Ive tried the traditional way of factory resetting and have had no luck at all.. Ive tried that several times.. I think this is likely causing alot of issues.. Hopefully that is also why I get those odd Dos Attacks on ports 443, 80 along with others.. The minute those take place its basically game over type deal.. One other strange thing I noticed after trying to factory reset from the back of the router is with no port forwarding no upnp no DMZ no port triggering NAT set to secured using IPV4 only my Xbox still reports Open NAT.. Which is not correct at all.. I will try your method soon here.. Thanks for the detailed method.. Im assuming once I click the erase button that will begin the factory reset? I just want to document this properly to make sure im doing everything as you stated.. And to see if we can get this to fully factory reset.. Thanks my friend! Zippy.

Hey Fraser, When you say factory reset from there what do you exactly mean? Log into the router with the above then push the little reset button from the back? Thanks! Zippy.

Your last screenshot looks promising! Stay wired and open your web browser and enter 192.168.77.1 You should get the R2 setup wizard then.. Go through the setup wizard of the R2 and you should be good to go.. If not post back and Fraser or Liam can assist you further! Good luck! Zippy.

BLC4K OPS I seem to have the same issue as yourself.. But mine does tend to stay Open a tad longer.. When using IPV6 no port forwarding no DMZ everything set to secured should still give you an Open NAT on the Xbox.. I still need to test this with the latest new beta firmware myself.. Curious to see what results you get! Thanks! Zippy.

Thanks Fraser! Will do! Zippy.