Asus aimesh node disconnects frequently, corresponding log entries recorded. Need help understanding the log.

[proskater_101]

As title reads, I'm having a problem with part of my network and have isolated the problem down a bit. I just need someone to look at my log file and help me understand what some of it means.

Question one: I have 2 repeating lines of "httpd_login_lock: Detect abnormal logins at 5 times. The newest one was from 179.60.147.41 in login." and "httpd_login_lock: Detect abnormal logins at 5 times. The newest one was from 179.60.147.41 in login lock." should I be concerned about those attempted logins? Seems to happen often before the eth2 link goes down

Question two: eth2 is a physical port on my dhcp router correct? I understand that they are labeled backwards example:

Port 1 -> eth4
Port 2 -> eth3
Port 3 -> eth2
Port 4 -> eth1

Port EWAN -> eth0

I'm also confused what this means "eth2 (Ext switch port: 1) (Logical Port: 9) Link DOWN." ext switch port 1, is this a port on one of my network switches? I do have two wired switches in my setup to give me more lan ports.

I am good with computers I just need help interpreting my router log.

My network consists of a bridged modem connected rt-ac86u running merlin, 3 rt-ax55 mesh nodes non merlin and 2 wired switches. all nodes are hardwired and configured for ethernet backhaul.

Here's my attached log file.

Thanks so much in advance.

 

[bennor]

It may help if you include the firmware version(s) running on the various Asus routers. Also may help others diagnose if you include additional information like Asus-Merlin addon scripts that may be installed.

For the HTTP login question, do you have your router login page exposed to the internet by using the Remote Access Config options?

 

[ColinTaylor]

Question one: I have 2 repeating lines of "httpd_login_lock: Detect abnormal logins at 5 times. The newest one was from 179.60.147.41 in login." and "httpd_login_lock: Detect abnormal logins at 5 times. The newest one was from 179.60.147.41 in login lock." should I be concerned about those attempted logins?

Yes. You have enabled web access to the router from the internet. Disable that immediately.

Question two: eth2 is a physical port on my dhcp router correct? I understand that they are labeled backwards example:

Port 1 -> eth4
Port 2 -> eth3
Port 3 -> eth2
Port 4 -> eth1

Port EWAN -> eth0

Correct.

I'm also confused what this means "eth2 (Ext switch port: 1) (Logical Port: 9) Link DOWN." ext switch port 1, is this a port on one of my network switches? I do have two wired switches in my setup to give me more lan ports.

It's just the mapping between the external and internal physical and logical names. Just stick with eth0, eth1, etc.

 

[proskater_101]

Rt-ac86u is running merlin version 386.13_2 firmware which is the main router connected to my modem. I am not running any Asus-Merlin addon scripts.

Rt-ax55 all 3 of them running stock asus 3.0.0.4.386_52303 firmware

I have taken the advice above of disabling web access to the router. Will that stop those suspicious 5X login attempts ? Will I still be able to use the asus phone app if I'm on the local network wifi to access like before?

So I should focus on troubleshooting everything connected to eth2, I'm going to just connect one Rt-ax55 node to eth2 and only connect the 1 PC I use to that Rt-ax55 node connected to eth2 and see if problem resurfaces. It seems to happen when there is high traffic flowing through eth2 when the dropout happens. If problem still happens then i'll switch to Lan port 4 (eth1) from port 3 (eth2) to see if that makes a difference.

Would it be a good assumption that something connected to my wired nodes that flow through eth2 is causing the disconnects resulting in errors in my log? link down etc.?

Thank you all for the replies.

 

[proskater_101]

Also this has been happening for a year off and on and usually I can just reboot all routers and it goes away for months. Recently is been happening more often almost every month. so this last time it started I decided to give the 3 rt-ax55 nodes static IPs outside of the dhcp pool to avoid IP address conflicts.

 

[ColinTaylor]

I have taken the advice above of disabling web access to the router. Will that stop those suspicious 5X login attempts ?

Yes.

Will I still be able to use the asus phone app if I'm on the local network wifi to access like before?

You should be able to.