XR500 losing internet connection

[slojogger]

My XR500 (purchased Sep 2020; firmware: v2.3.2.66) began consistently losing internet connection a week ago with nightly occurrences around 11:15PM (internet light turns from white to red/amber). At no time does the modem show a loss of internet signal to the home (all lights green), and only rebooting both the router and cable modem almost simultaneously seemed to resolve the issue for another ~24hrs with the identical process having to be repeated again each night. The logs showed an extraordinarily high number of DOS attacks with WhoIs traces showing source IPs for the DOS attacks assigned to seemingly legit sources (e.g., Google Nest) across commonly used/assigned ports and no disabling of DOS or any other protections within the admin settings. These DOS attacks (SYN, SYN/ACK, etc.) are quite common and never seemed to bother my previous router (Apple AirPort Extreme), but then the Extreme has no native logging function to see this kind of activity in the first place. My ISP's tech support suggested this weekend that the cable modem (DOCSIS 3.0) is outdated and offered a free replacement; I'm picking up a new modem with DOCSIS 3.1 this morning. The most recent internet drop was unable to be resolved with the usual router/modem reboot, so I reset the router. This seemed to work at first, but after a subsequent repeat of the issue a few mins later I replaced the XR500 with the Apple AirPort Extreme, which has been running without issue since. 

The only changes to the base XR500 setup are/were as follows:

1. NetDuma Tech Support tweaked keep alive settings in VPN config files for HybridVPN due to consistent VPN disconnects. Only one, two max, devices added to the VPN at any time.

2. Reserved IP address assignments given (thus far) to approx half of my devices.

3. Recent unsuccessful attempt to setup of the email feature to receive logs at time 0000 each day; no logs have been successfully emailed to date despite entering the supposed correct details for my email service (iCloud) SMTP outgoing mail server. 

Any assistance you could provide would be greatly appreciated. Thanks. 

 

[Netduma Liam]

Thanks for posting!

Do the devices with statically assigned IPs also suffer from the drops?

Perhaps you could try increasing the DHCP lease time to 168 hours and check if the drop are resolved/less consistent?

[Lewisprotips]

Same with me and weirdly enough at the same time

[Netduma Liam]

13 hours ago, Lewisprotips said:

Same with me and weirdly enough at the same time

I've replied to you in the separate post you made  

[raf1212]

I suspect that this qos disconnects, because after turning off there are no disconnections, and could you explain how to increase the time of lease of addresses

[Netduma Fraser]

21 minutes ago, raf1212 said:

I suspect that this qos disconnects, because after turning off there are no disconnections, and could you explain how to increase the time of lease of addresses

That doesn't seem to be the case for everyone so may be a coincidence. You can't do that on the XR routers, just the R2.

[slojogger]

Ref the other devices using static IPs, I haven't checked every device, but walking around and doing a visual inspection shows that is everything that is networked is no longer connected. Normally the first sign of signal loss is when the Hulu live TV stream stops in the middle of programming, plus our portable devices lose wifi connectivity. All the TVs and streaming devices in the house are hardwired via ethernet Cat6; normally only one TV is on at a time.

[Netduma Liam]

9 hours ago, slojogger said:

Ref the other devices using static IPs, I haven't checked every device, but walking around and doing a visual inspection shows that is everything that is networked is no longer connected. Normally the first sign of signal loss is when the Hulu live TV stream stops in the middle of programming, plus our portable devices lose wifi connectivity. All the TVs and streaming devices in the house are hardwired via ethernet Cat6; normally only one TV is on at a time.

OK great, thank you.

Are you able to capture a log file when this happens at 23:15?

This might tell us why the drop is occurring.