random XR450 disconnects after factory reset?

[stateofstatic]

Just upgraded from Comcast to a local Fiber internet provider...was having slow speed so I started troubleshooting (200mb down/up, was getting 90mb) and though I determined the issue was a few bad CAT5 cables, during the process I did a hard reset of my XR450 to see if that would help.  Now, I'm randomly getting dropped connections on different ethernet ports and wifi connections randomly.  Sometimes it will be all connections, sometimes it will just be one port, sometimes just the wifi signal, sometimes a combination.  I can either power cycle the router to resolve, or it generally clears up on its own after a few minutes, but its incredibly annoying.  On firmware V2.3.2.114.  Suggestions?

[Netduma Fraser]

Hey, welcome to the forum!

Has your speed issue been resolved now? Do you still have access to the interface when you get the disconnections? Is it possible you've knocked or not tightly put in the ethernet cables when changing them around? If you have access to the interface could you grab the log file from the System Information page and post it here?

[stateofstatic]

Yes, the speed issue (90mb when service rate was 200mb) was a result of faulty cables...I since upgraded all cables including my through-wall patches to CAT8.  I have access to the DumaOS UI IF a computer still has a connection, no access on computers that lose their connection.  All ethernet connections are secure, and as I said it can occur with wifi as well.  Never had this issue in over a year of owning the XR450 till after the hard reset which I had actually never done before, though I have performed several firmware updates through ownership.  There are 4 PCs connected, as well as 3 phones, a chromecast and a wifi garage door opener:

PC #1 direct ethernet
PC #2 direct ethernet
PC #3 wifi over 2.4ghz

PC#4 ethernet over powerline adaptor (Extollo Communications LANsocket 1500)

all phones and chromecast and garage door opener wifi over 2.4ghz (I disabled 5ghz radio to troubleshoot, issue persists)

The symptom is very random, sometimes the disconnect will occur on PC #3 and #4, sometimes just PC #1, sometimes #1, 2, and 4, sometimes just wifi, sometimes #2 and #4, there seems to be no rhyme or reason to it.  It occurs once every 1-3 days at random times of day.  If there is no attempt to resolve, it will usually establish a connection within 3-5minutes, or I can simple power cycle the router immediately to resolve once it fully boots.

 

Something odd I noticed: despite performing a full factory reset (30-30-30 reset...hold reset button for 30 seconds, unplug power for 30 seconds, plug power back in while still holding reset button for 30 seconds) it still had device names I had previously assigned for different PCs and Phones to be able to tell them apart?   All settings were set to default however.

[Newfie]

When you reset originally did you perform a 30.30.30? This type of reset was for the old type routers where it would clear the NVRam but on all modern routers it can corrupt them. The rear reset button is your safest option.

You may have to perform a TFTP install then test again. 

[Netduma Fraser]

It's possible that as it restores the connection itself that it is a DHCP lease renewal. Set DHCP to start at .50 instead of .2 then give reserved IPs to devices - between .2 and .49, then reboot the router from the interface and wait 2 minutes before you attempt to access it. See if it is more stable after that, if not try the above.

[stateofstatic]

TFTP install unfortunately failed, router never accepts the send command...did another 30-30-30 and assigned static IPs for everything under 50, we'll see how that goes 🤞

[Newfie]

33 minutes ago, stateofstatic said:

TFTP install unfortunately failed, router never accepts the send command...did another 30-30-30 and assigned static IPs for everything under 50, we'll see how that goes 🤞

Does the rear reset not work?

[Netduma Fraser]

35 minutes ago, stateofstatic said:

TFTP install unfortunately failed, router never accepts the send command...did another 30-30-30 and assigned static IPs for everything under 50, we'll see how that goes 🤞

It can be quite hard to get the timing right so you may get it if you try again - also to double check did you enable TFTP in Windows first?

Let us know how you get on.

[stateofstatic]

On 10/23/2021 at 2:44 PM, Newfie said:

Does the rear reset not work?

Yes, it does.  I'm using TFTPD64 to push the firmware.  Only one ethernet connection, static ip of 192.168.1.10, subnet 255.255.255.0, gateway 192.168.1.1. Sequences attempted have been: power off for 10 seconds, power on...power light goes orange 3-4sec, blinks off once, goes orange and stays solid till boot is complete.  Unplug power for 30 seconds, and plug back in, same light sequence.  Hit reset, same light sequence.  Attempting to push during any point of the light sequence results in eventual timeout of the TFTPD64 attempt.  

 

On 10/23/2021 at 2:47 PM, Netduma Fraser said:

It can be quite hard to get the timing right so you may get it if you try again - also to double check did you enable TFTP in Windows first?

Let us know how you get on.

I will double check about enabling TFTP in Windows features, its possible something is blocking communication there since I generally disable all remote services post win10 install.  Disconnects are still occurring with reserved IPs below .50, more frequently now actually, 3-4 times a day now but it will re-establish connection within only 10 seconds now.  Worse, and better in some respect but still annoying.  Interesting observation after the last 30-30-30 reset, now ethernet activity lights on all three ports all blink in unison...there is no time when they blink independently, very odd.

[Netduma Fraser]

If you're having trouble with the software, try the Windows method to TFTP https://kb.netgear.com/000059634/How-to-upload-firmware-to-a-NETGEAR-router-using-Windows-TFTP?article=000059634

Did you change the DHCP range to start at .50? If the reserved IPs aren't outside the range it wouldn't work as well. Definitely odd it is behaving like that, as above that kind of reset can cause more issues than it solves. If you can get TFTP to work that will bypass the boot process and any issues there so will be the best bet.

[stateofstatic]

Thanks for that link, was able to put firmware image successfully through windows command prompt...so full factory reset, then TFTP with XR450-V2.3.2.114.img  Will have to test for a day or two...

[stateofstatic]

So it looks like issue is resolved, I've had some brief dropouts but the reconnect is within seconds and only once every couple days so I'll call it a success. Thanks for the help Newfie and Fraser!

[Netduma Liam]

6 hours ago, stateofstatic said:

So it looks like issue is resolved, I've had some brief dropouts but the reconnect is within seconds and only once every couple days so I'll call it a success. Thanks for the help Newfie and Fraser!

Interesting, OK let us know if becomes a problem and we'll be happy to help.

[stateofstatic]

ok something really weird happened today...connection dropped, was lazy on my laptop not wanting to run down two flights of stairs to the bottom floor and decided to disable/enable my Ethernet adaptor to resolve.  It worked (briefly) but when I lost internet again 30 seconds later I attempted to log into the DumaOS UI (192.168.1.1) and it instead directed me to an ASUS login for a completely different router, model RT-AC68U...I'll remind you that I have a Netgear XR450.  Also, this was a direct ethernet connection not wireless.  Needless to say I didn't enter login credentials,  power-cycled my ONT and the router to resolve, but what the hell is that ASUS screen all about????

[Netduma Fraser]

9 hours ago, stateofstatic said:

ok something really weird happened today...connection dropped, was lazy on my laptop not wanting to run down two flights of stairs to the bottom floor and decided to disable/enable my Ethernet adaptor to resolve.  It worked (briefly) but when I lost internet again 30 seconds later I attempted to log into the DumaOS UI (192.168.1.1) and it instead directed me to an ASUS login for a completely different router, model RT-AC68U...I'll remind you that I have a Netgear XR450.  Also, this was a direct ethernet connection not wireless.  Needless to say I didn't enter login credentials,  power-cycled my ONT and the router to resolve, but what the hell is that ASUS screen all about????

That's odd, you don't have an Asus connected between the ONT and XR450 at all? Does your PC allow you to connect to WiFi at the same time as ethernet and if so is there a WiFi network from an Asus router?

[stateofstatic]

No, no other routers on the network and wifi adapter on laptop was disabled...this was something coming through the Ethernet connection.  On my phone via wifi I was able to connect to router gateway and access the dumaos ui correctly when this was occurring.  

A scary thought: since that ASUS router is also a gaming router, could it be that a hacker scraped limited info somewhere from my network describing the xr450 as a "gaming router" and then presented a false login page for what he guessed was the brand to capture my credentials?

[Netduma Fraser]

It's unlikely but it could be possible. Does the Asus interface come up every time you try to access using this device? Apart from the phone do any other devices get access to DumaOS or the Asus interface? If it's just this one device then it is more likely what you've theorized and would recommend doing an Anti-Virus scan on that device.

[stateofstatic]

It only came up on the laptop, and after going through a power cycle procedure on the ont and router (unplug both for a minute, plug in ont and wait a minute, plug in router) laptop was connecting to duma ui correctly...I haven't seen the ASUS login screen since when accessing 192.168.1.1

I will perform an exhaustive scan on the laptop today, any recommendations for tools?

[Netduma Fraser]

Okay good, very weird, definitely never seen that before. I don't have any specific recommendations myself, I just use the basic Windows Firewall.

[stateofstatic]

It's baaaack...

I ran sophos hitmanpro (pretty deep level AV) and it found nothing, went about my business. This morning, I notice my connection is sluggish so I check the UI to see network traffic and get this again!

Decided to check the router as well, noticed the port my laptop is connected to is orange.  Again, wifi adaptor is disabled.  An interesting thing of note, when I removed all ethernet connections from the router physically, anything I connected with via wifi would go back to DUMA UI, but the moment I reconnected them it would revert back to the fake login.  Would I be correct in assuming one of the connected PCs is redirecting traffic to the fake login?

[Netduma Liam]

Hmm, so all device are getting served this page or is it still just the laptop? Are other devices able to get to the DumaOS interface as usual while you're experiencing this problem?

If you remove devices one-by-one from the ethernet switch on the XR, can you narrow it down to a specific device that causes you to see this behaviour?

[stateofstatic]

All connected PC devices exhibit the behavior on ethernet of wifi connections, android and iOS phones to not...can still connect to the correct gateway through them.

I think I may have narrowed it down...I can reproduce the behavior on whatever device connects to one of my Extollo 1500 powerline adaptors?!?!  I have it set up for an upstairs room I couldn't wire CAT5 to.  Once a powerline connection exists on network, all other PCs are affected.  So traffic is being redirected from the router through a powerline adaptor connection??? Wouldn't that mean an intruder would either have to push a compromised firmware update to it, bypass the 128bit AES encryption, or have to be physically hooked up to the same electrical circuit as my house?!?!?!  That would be some black belt level stuff, in no way am I important enough for someone to make that kind of effort, yet...

[Netduma Liam]

7 minutes ago, stateofstatic said:

All connected PC devices exhibit the behavior on ethernet of wifi connections, android and iOS phones to not...can still connect to the correct gateway through them.

I think I may have narrowed it down...I can reproduce the behavior on whatever device connects to one of my Extollo 1500 powerline adaptors?!?!  I have it set up for an upstairs room I couldn't wire CAT5 to.  Once a powerline connection exists on network, all other PCs are affected.  So traffic is being redirected from the router through a powerline adaptor connection??? Wouldn't that mean an intruder would either have to push a compromised firmware update to it, bypass the 128bit AES encryption, or have to be physically hooked up to the same electrical circuit as my house?!?!?!  That would be some black belt level stuff, in no way am I important enough for someone to make that kind of effort, yet...

OK, so without the powerline adapters you're not running into this problem? When you're experiencing the issue, can you connect to the XR450 from a device that's not using the powerline adapters and get to the interface normally?

Have you recommended the powerline adapters your using to anyone, perhaps a neighbour? Is it possible someone hasn't quite configured theirs properly and you're actually getting moved on to a neighbours network who uses an ASUS router?

[stateofstatic]

5 minutes ago, Netduma Liam said:

OK, so without the powerline adapters you're not running into this problem? When you're experiencing the issue, can you connect to the XR450 from a device that's not using the powerline adapters and get to the interface normally?

Have you recommended the powerline adapters your using to anyone, perhaps a neighbour? Is it possible someone hasn't quite configured theirs properly and you're actually getting moved on to a neighbours network who uses an ASUS router?

Yes, running laptop with direct connection to router works, running through powerline redirects...unless I physically carry the upstairs PC down to the first floor (of 3) I won't be able to test direct to router.

I thought about that second part, but I already reset the powerline adaptors which means they should have created a new private AVLN correct?

UPDATE: you may be on to something...network map shows a GOOGLE-HOME-MINI connected to LAN, we do not own one.

[Netduma Liam]

6 minutes ago, stateofstatic said:

Yes, running laptop with direct connection to router works, running through powerline redirects...unless I physically carry the upstairs PC down to the first floor (of 3) I won't be able to test direct to router.

I thought about that second part, but I already reset the powerline adaptors which means they should have created a new private AVLN correct?

UPDATE: you may be on to something...network map shows a GOOGLE-HOME-MINI connected to LAN, we do not own one.

I think it probably depends on the make and model of the PLAs, if you can let me know I'll see if there's any way we can reconfigure them in case they're getting confused.