Dns issues

[Detanye]

Hi there,

 

I have owned a XR1000v2 for 2 years now. The last month or so I have been having strange DNS issues where it seems to drop out a fair few times a day. Sometimes it happens 3-4 times in a row. Only effects searching for some websites, ok there programs seem to run fine. My phone seems to trigger whatever it is the most, it is a Pixel 10 android.

 

I'm a real noob when it comes to networking but I have changed my DNS to use 8.8.8.8 and 8.8.4.4 which I was hoping would help but has not. I'm sorry if this is. Really easy issue to fix, once again network issues are one of the things I find cosmic for the most part.

[Netduma Fraser]

By strange DNS issues do you just mean that you're getting disconnects throughout the day? (Presumably you're taking the browser not loading page as the reference for DNS issues?)

How often is it happening throughout the day? Does it come back after a few seconds/minutes or do you need to reboot to regain proper access?

What is the model of the modem/router the XR is connected to and how have you set that to ensure all traffic flows to the XR? E.g XR in its DMZ, modem/bridge mode

[Detanye]

Webpages won't load but things like voice calls remain okay. 

I would 10 times a day at least. They fix themselves after a few minutes. 

I'm in Australia, so I'm plugged straight from our network distribution terminal. I have a Fibre to the Premises connection.

I'm unsure how I check the traffic flow?

[Netduma Fraser]

Are you using PPPoE or anything like that? Could you provide the logs when it next happens please? No worries that answered it.

[Detanye]

Is PPPoe a IPv6 thing? I have internet connection type in that page set to Auto if that helps?

It actually happened as soon as i turned my pc on just now and here are the logs.

[DHCP IP: (192.168.1.12)] to MAC address C2:61:51:C7:98:4E, Tuesday, Mar 17, 2026 10:28:08
[DoS attack: RST Scan] from source 20.43.111.112,port 443 Tuesday, Mar 17, 2026 10:27:18
[admin login] from source 192.168.1.13, Tuesday, Mar 17, 2026 10:25:20
[DHCP IP: (192.168.1.13)] to MAC address 48:68:4A:4C:DC:DB, Tuesday, Mar 17, 2026 10:25:10
[DHCP IP: (192.168.1.14)] to MAC address 0A:D5:79:2D:AE:9D, Tuesday, Mar 17, 2026 10:25:07
[DHCP IP: (192.168.1.4)] to MAC address F0:72:EA:D7:B1:ED, Tuesday, Mar 17, 2026 10:25:04
[DHCP IP: (192.168.1.4)] to MAC address F0:72:EA:D7:B1:ED, Tuesday, Mar 17, 2026 10:25:03
[DHCP IP: (192.168.1.14)] to MAC address 0A:D5:79:2D:AE:9D, Tuesday, Mar 17, 2026 10:25:03
[DHCP IP: (192.168.1.14)] to MAC address 0A:D5:79:2D:AE:9D, Tuesday, Mar 17, 2026 10:25:02
[DoS attack: RST Scan] from source 20.43.111.112,port 443 Tuesday, Mar 17, 2026 10:23:42
[DHCP IP: (192.168.1.9)] to MAC address AE:BD:1C:97:5C:2A, Tuesday, Mar 17, 2026 10:21:01
[DHCP IP: (192.168.1.9)] to MAC address AE:BD:1C:97:5C:2A, Tuesday, Mar 17, 2026 10:03:59

 

Is it maybe that DoS attack log?

[Netduma Fraser]

No not IPv6 but that's answered the question thanks.

In LAN Settings, set the DHCP range to start at .50, then assign reserved IP addresses to devices between .2 & .49 so they're out of the DHCP range, apply, reboot from the interface, wait 4 minutes and see if that stops the disconnects.

No it's not that, the XR routers show those a lot but they're actually just connections you've made - that one for example is just Microsoft.

[Detanye]

Does this look correct?

i dont seem to have many options in the reservations list, things like my chromecast didn't show up. Rebooting now and will tell you if anything changes

[Detanye]

Seems to still be doing it every now and then. I have tried disabling IPV6 to see if I can replicate it

[Netduma Fraser]

Yes that's correct it should be for every device though, if they're not showing for you to add them do something on said device and then it should appear for you to add. Is it happening less after doing this?

[Detanye]

I feel like it's less but It could be placebo. 

[Netduma Fraser]

That's good - grab another log and look at any repeated DHCP IP entries that are left, presumably they're going to devices that you haven't yet reserved an IP for in which case if you add those it should be better

[Detanye]

[admin login] from source 192.168.1.2, Wednesday, Mar 18, 2026 10:09:53
[DHCP IP: (192.168.1.2)] to MAC address 48:68:4A:4C:DC:DB, Wednesday, Mar 18, 2026 10:09:15
[DHCP IP: (192.168.1.8)] to MAC address AE:BD:1C:97:5C:2A, Wednesday, Mar 18, 2026 10:04:00
[DHCP IP: (192.168.1.8)] to MAC address AE:BD:1C:97:5C:2A, Wednesday, Mar 18, 2026 10:00:29
[DHCP IP: (192.168.1.15)] to MAC address DA:81:47:BE:43:67, Wednesday, Mar 18, 2026 09:51:39
[DHCP IP: (192.168.1.5)] to MAC address F0:72:EA:D7:B1:ED, Wednesday, Mar 18, 2026 09:50:18
[DHCP IP: (192.168.1.5)] to MAC address F0:72:EA:D7:B1:ED, Wednesday, Mar 18, 2026 09:50:17
[DHCP IP: (192.168.1.10)] to MAC address C2:61:51:C7:98:4E, Wednesday, Mar 18, 2026 09:47:11

 

does this look correct now?

[Detanye]

My phone seems to keep changing its ip even though im saving it as a device. Could that be the issue?

 

[Netduma Fraser]

Ah potentially - you may need to look up the specifics but if you look at the WiFi for the router on your phone you should have a setting - Private/Random MAC Address, disable that. Then you can assign an IP again and it will hold this time. 

[Detanye]

Just happened when i turned my pc on again. This was what my logs were at the time 

[DHCP IP: (192.168.1.2)] to MAC address 48:68:4A:4C:DC:DB, Wednesday, Mar 18, 2026 19:13:05
[DHCP IP: (192.168.1.8)] to MAC address AE:BD:1C:97:5C:2A, Wednesday, Mar 18, 2026 19:13:00
[DHCP IP: (192.168.1.10)] to MAC address C2:61:51:C7:98:4E, Wednesday, Mar 18, 2026 19:09:15
[DoS attack: ACK Scan] from source 184.28.9.100,port 80 Wednesday, Mar 18, 2026 19:09:15
[DHCP IP: (192.168.1.8)] to MAC address AE:BD:1C:97:5C:2A, Wednesday, Mar 18, 2026 19:02:43
[DHCP IP: (192.168.1.11)] to MAC address 9A:3A:8B:6E:22:D2, Wednesday, Mar 18, 2026 19:02:21
[DHCP IP: (192.168.1.11)] to MAC address 9A:3A:8B:6E:22:D2, Wednesday, Mar 18, 2026 19:02:18
[DHCP IP: (192.168.1.11)] to MAC address 9A:3A:8B:6E:22:D2, Wednesday, Mar 18, 2026 19:02:17

Cant really see anything out of the ordinary, this one had everything disconnect and give me a 'No Internet Access' error. 

[Detanye]

Happening a lot now with more people using the network, this is all the log says.

[DHCP IP: (192.168.1.5)] to MAC address F0:72:EA:D7:B1:ED, Wednesday, Mar 18, 2026 19:49:09
[DoS attack: RST Scan] from source 23.211.125.73,port 443 Wednesday, Mar 18, 2026 19:48:55
[DoS attack: RST Scan] from source 192.178.187.94,port 443 Wednesday, Mar 18, 2026 19:48:55
[DoS attack: ACK Scan] from source 54.186.23.98,port 443 Wednesday, Mar 18, 2026 19:47:08
[DHCP IP: (192.168.1.8)] to MAC address AE:BD:1C:97:5C:2A, Wednesday, Mar 18, 2026 19:44:36
[DoS attack: RST Scan] from source 20.43.111.112,port 443 Wednesday, Mar 18, 2026 19:44:06
[Time synchronized with NTP server] Wednesday, Mar 18, 2026 19:43:33
[Internet connected] IP address: 100.100.113.119, Wednesday, Mar 18, 2026 19:43:32

 

Seem to be unable to search for anything for longer amounts of time aswell, sorry for the spam.