Asus RT-AC87R, AC68U, N66U having major issues

[jmantn]

Since Sunday I've had some major connectivity issues where I live and am stumped. The last change I made to my network was factory resetting all Routers on New Year's and installing the latest software for each and everything ran perfectly until Sunday when my Ping would randomly shoot up to over 4,000MS and my DL speed of 60 dropped to .029 and this happened for most of the day Sunday and improved on Monday when my ISP Charter did a house visit which at that point they didn't see any issues inside or outside of my home. As luck would have it the issues came back later than night and are persisting to the present moment.

My setup is as follows:
Charter DOCIS 3 Modem connected via cat 6e cable to my ASUS RT-AC87R Router which also connects to two bridged Routers each in AP mode via two of it's ports via cat 6e cable to my ASUS RT-N66U (N66U has wireless radio's off, I'm using it as a switch basically) and to my ASUS RT-AC68U. The AC87R and N66U are downstairs along with my modem due to how the house is wired and the 68U is upstairs.

What I've done Sunday night and last night to try and fix:
My ASUS RT-AC87R Router which was running Merlin until the latest 3.0.0.4.378_3885 came out and I installed that and did an NVRAM erase and a factory reset and used Nathan's (I think that's his name) backup/restore utility to restore my settings I had backed up just prior to doing the reset.

My ASUS RT-N66U was updated from Merlin's 376.49_4 to 376.49_5 and NO factory reset was done on this. This router has it's wireless radios turned off and has a work computer attached which experienced Major connectivity issues on Sunday (but devices connected to other routers and via wifi all experienced the issue at the same time so NOT thinking the problem lies with this router).

My ASUS RT-AC68U is now running Merlin's 376.49_6_cfeupd which I erased the NVRAM and did a factory restore on and set to AP mode just like the N66U. This router is upstairs and does have it's wireless band's enabled and each band is on a separate channel than my 87R.

I've also posted about this before however I may have posted in the wrong places:http://forums.smallnetbuilder.com/showpost.php?p=159105&postcount=434

Tonight I look at my logs and I see this on my ASUS RT-AC87R (X'ing some of the Ip's as I don't know what's safe to post and what isn't):

Jan 13 23:21:56 dropbear[14251]: login attempt for nonexistent user from ::ffff:141.28.100.XXX:XXXX
Jan 13 23:21:56 dropbear[14249]: bad password attempt for 'admin' from ::ffff:122.225.109.XXX:XXXX
Jan 13 23:21:57 dropbear[14249]: bad password attempt for 'admin' from ::ffff:122.225.109.XXX:XXXX
Jan 13 23:21:57 dropbear[14251]: exit before auth: Disconnect received
Jan 13 23:21:57 dropbear[14252]: Child connection from ::ffff:141.28.100.XXX:XXXX
Jan 13 23:21:57 dropbear[14249]: bad password attempt for 'admin' from ::ffff:122.225.109.XXX:XXXX
Jan 13 23:21:58 dropbear[14249]: bad password attempt for 'admin' from ::ffff:122.225.109.XXX:XXXX
Jan 13 23:21:58 dropbear[14252]: login attempt for nonexistent user from ::ffff:141.28.100.XXX:XXXX
Jan 13 23:21:58 dropbear[14249]: bad password attempt for 'admin' from ::ffff:122.225.109.XXX:XXXX
Jan 13 23:21:59 dropbear[14252]: exit before auth: Disconnect received
Jan 13 23:21:59 dropbear[14253]: Child connection from ::ffff:141.28.100.XXX:XXXX
Jan 13 23:21:59 dropbear[14249]: bad password attempt for 'admin' from ::ffff:122.225.109.XXX:XXXX
Jan 13 23:22:00 dropbear[14249]: bad password attempt for 'admin' from ::ffff:122.225.109.XXX:XXXX
Jan 13 23:22:00 dropbear[14253]: login attempt for nonexistent user from ::ffff:141.28.100.XXX:XXXX
Jan 13 23:22:00 miniupnpd[824]: HTTP Connection from 192.168.XX.XXX closed unexpectedly
Jan 13 23:22:00 dropbear[14249]: bad password attempt for 'admin' from ::ffff:122.225.109.XXX:XXXX
Jan 13 23:22:01 dropbear[14253]: exit before auth: Disconnect received
Jan 13 23:22:01 dropbear[14249]: exit before auth (user 'admin', 10 fails): Max auth tries reached - user 'admin' from ::ffff:122.225.109.XXX:XXXX
Jan 13 23:22:01 dropbear[14254]: Child connection from ::ffff:141.28.100.XXX:XXXX
Jan 13 23:22:01 dropbear[14255]: Child connection from ::ffff:122.225.109.XXX:XXXX
Jan 13 23:22:02 dropbear[14254]: login attempt for nonexistent user from ::ffff:141.28.100.XXX:XXXX
Jan 13 23:22:03 dropbear[14254]: exit before auth: Disconnect received
Jan 13 23:22:03 dropbear[14256]: Child connection from ::ffff:141.28.100.XXX:XXXX
Jan 13 23:22:04 dropbear[14255]: bad password attempt for 'admin' from ::ffff:122.225.109.XXX:XXXX
Jan 13 23:22:04 dropbear[14256]: login attempt for nonexistent user from ::ffff:141.28.100.XXX:XXXX
Jan 13 23:22:04 dropbear[14255]: bad password attempt for 'admin' from ::ffff:122.225.109.XXX:XXXX
Jan 13 23:22:05 dropbear[14256]: exit before auth: Disconnect received
Jan 13 23:22:05 dropbear[14257]: Child connection from ::ffff:141.28.100.XXX:XXXX
Jan 13 23:22:05 miniupnpd[824]: HTTP Connection from 192.168.XX.XXX closed unexpectedly
Jan 13 23:22:06 dropbear[14255]: bad password attempt for 'admin' from ::ffff:122.225.109.XXX:XXXX
Jan 13 23:22:06 dropbear[14257]: login attempt for nonexistent user from ::ffff:141.28.100.XXX:XXXX
Jan 13 23:22:07 dropbear[14257]: exit before auth: Disconnect received
Jan 13 23:22:07 dropbear[14258]: Child connection from ::ffff:141.28.100.XXX:XXXX
Jan 13 23:22:07 miniupnpd[824]: HTTP Connection from 192.168.XX.XXX closed unexpectedly
Jan 13 23:22:08 dropbear[14258]: login attempt for nonexistent user from ::ffff:141.28.100.XXX:XXXX
Jan 13 23:22:08 miniupnpd[824]: HTTP Connection from 192.168.XX.XXX closed unexpectedly
Jan 13 23:22:08 dropbear[14255]: bad password attempt for 'admin' from ::ffff:122.225.109.XXX:XXXX
Jan 13 23:22:09 dropbear[14258]: exit before auth: Disconnect received
Jan 13 23:22:09 dropbear[14259]: Child connection from ::ffff:141.28.100.XXX:XXXX
Jan 13 23:22:10 dropbear[14259]: login attempt for nonexistent user from ::ffff:141.28.100.XXX:XXXX
Jan 13 23:22:11 dropbear[14259]: exit before auth: Disconnect received
Jan 13 23:22:11 dropbear[14260]: Child connection from ::ffff:141.28.100.XXX:XXXX
Jan 13 23:22:12 dropbear[14260]: login attempt for nonexistent user from ::ffff:141.28.100.XXX:XXXX
Jan 13 23:22:13 dropbear[14255]: bad password attempt for 'admin' from ::ffff:122.225.109.XXX:XXXX
Jan 13 23:22:13 dropbear[14260]: exit before auth: Disconnect received
Jan 13 23:22:13 dropbear[14261]: Child connection from ::ffff:141.28.100.XXX:XXXX
Jan 13 23:22:13 dropbear[14255]: bad password attempt for 'admin' from ::ffff:122.225.109.XXX:XXXX
Jan 13 23:22:14 dropbear[14255]: bad password attempt for 'admin' from ::ffff:122.225.109.XXX:XXXX
Jan 13 23:22:14 dropbear[14261]: login attempt for nonexistent user from ::ffff:141.28.100.XXX:XXXX
Jan 13 23:22:15 dropbear[14255]: bad password attempt for 'admin' from ::ffff:122.225.109.XXX:XXXX
Jan 13 23:22:15 dropbear[14261]: exit before auth: Disconnect received
Jan 13 23:22:15 miniupnpd[824]: HTTP Connection from 192.168.XX.XXX closed unexpectedly
Jan 13 23:22:15 dropbear[14262]: Child connection from ::ffff:141.28.100.XXX:XXXX
Jan 13 23:22:15 dropbear[14255]: bad password attempt for 'admin' from ::ffff:122.225.109.XXX:XXXX
Jan 13 23:22:16 dropbear[14255]: bad password attempt for 'admin' from ::ffff:122.225.109.XXX:XXXX
Jan 13 23:22:16 dropbear[14262]: login attempt for nonexistent user from ::ffff:141.28.100.XXX:XXXX
Jan 13 23:22:16 dropbear[14255]: exit before auth (user 'admin', 10 fails): Max auth tries reached - user 'admin' from ::ffff:122.225.109.XXX:XXXX
Jan 13 23:22:17 dropbear[14262]: exit before auth: Disconnect received
Jan 13 23:22:17 dropbear[14263]: Child connection from ::ffff:122.225.109.XXX:XXXX
Jan 13 23:22:17 dropbear[14264]: Child connection from ::ffff:141.28.100.XXX:XXXX
Jan 13 23:22:18 dropbear[14264]: login attempt for nonexistent user from ::ffff:141.28.100.XXX:XXXX
Jan 13 23:22:19 dropbear[14264]: exit before auth: Disconnect received
Jan 13 23:22:19 dropbear[14266]: Child connection from ::ffff:141.28.100.XXX:XXXX
Jan 13 23:22:20 dropbear[14266]: login attempt for nonexistent user from ::ffff:141.28.100.XXX:XXXX
Jan 13 23:22:20 miniupnpd[824]: HTTP Connection from 192.168.XX.XXX closed unexpectedly
Jan 13 23:22:21 dropbear[14266]: exit before auth: Disconnect received
Jan 13 23:22:21 dropbear[14267]: Child connection from ::ffff:141.28.100.XXX:XXXX
Jan 13 23:22:22 dropbear[14267]: login attempt for nonexistent user from ::ffff:141.28.100.XXX:XXXX
Jan 13 23:22:22 dropbear[14263]: bad password attempt for 'admin' from ::ffff:122.225.109.XXX:XXXX
Jan 13 23:22:22 miniupnpd[824]: HTTP Connection from 192.168.XX.XXX closed unexpectedly
Jan 13 23:22:23 dropbear[14263]: bad password attempt for 'admin' from ::ffff:122.225.109.XXX:XXXX
Jan 13 23:22:23 dropbear[14267]: exit before auth: Disconnect received
Jan 13 23:22:23 dropbear[14268]: Child connection from ::ffff:141.28.100.XXX:XXXX
Jan 13 23:22:24 dropbear[14263]: bad password attempt for 'admin' from ::ffff:122.225.109.XXX:XXXX
Jan 13 23:22:24 miniupnpd[824]: HTTP Connection from 192.168.XX.XXX closed unexpectedly
Jan 13 23:22:24 dropbear[14263]: bad password attempt for 'admin' from ::ffff:122.225.109.XXX:XXXX
Jan 13 23:22:24 dropbear[14268]: login attempt for nonexistent user from ::ffff:141.28.100.XXX:XXXX
Jan 13 23:22:25 dropbear[14263]: bad password attempt for 'admin' from ::ffff:122.225.109.XXX:XXXX
Jan 13 23:22:25 dropbear[14268]: exit before auth: Disconnect received

What's going on?!?!?!
The logs I posted in the link provided above where showing some weird activity but what I've posted in this post is something entirely new.

Edit:
I wanted to also say that within my ASUS RT-AC87R that all devices hard wired and wireless have an assigned IP if that matters.
Edit2:
Some errors may be due to leaving Terminal open on computer but issues still persist...

 

[EvilShubunkin]

Disable SSH, if you don't use it to access the console, and these should disappear - I had the same on the RT-AC68U and I have to telnet into the router and kill the dropbear process as there's a bug on the Administration page with the new firmware on the RT-AC68U preventing changes being saved.

 

[huotg01]

[...]
Tonight I look at my logs and I see this on my ASUS RT-AC87R (X'ing some of the Ip's as I don't know what's safe to post and what isn't):

...
Jan 13 23:22:02 dropbear[14254]: login attempt for nonexistent user from ::ffff:141.28.100.XXX:XXXX
Jan 13 23:22:03 dropbear[14254]: exit before auth: Disconnect received
Jan 13 23:22:03 dropbear[14256]: Child connection from ::ffff:141.28.100.XXX:XXXX
Jan 13 23:22:04 dropbear[14255]: bad password attempt for 'admin' from ::ffff:122.225.109.XXX:XXXX
Jan 13 23:22:04 dropbear[14256]: login attempt for nonexistent user from ::ffff:141.28.100.XXX:XXXX
Jan 13 23:22:04 dropbear[14255]: bad password attempt for 'admin' from ::ffff:122.225.109.XXX:XXXX
Jan 13 23:22:05 dropbear[14256]: exit before auth: Disconnect received
Jan 13 23:22:05 dropbear[14257]: Child connection from ::ffff:141.28.100.XXX:XXXX
Jan 13 23:22:05 miniupnpd[824]: HTTP Connection from 192.168.XX.XXX closed unexpectedly
Jan 13 23:22:06 dropbear[14255]: bad password attempt for 'admin' from ::ffff:122.225.109.XXX:XXXX
Jan 13 23:22:06 dropbear[14257]: login attempt for nonexistent user from ::ffff:141.28.100.XXX:XXXX
Jan 13 23:22:07 dropbear[14257]: exit before auth: Disconnect received
Jan 13 23:22:07 dropbear[14258]: Child connection from ::ffff:141.28.100.XXX:XXXX
Jan 13 23:22:07 miniupnpd[824]: HTTP Connection from 192.168.XX.XXX closed unexpectedly
Jan 13 23:22:08 dropbear[14258]: login attempt for nonexistent user from ::ffff:141.28.100.XXX:XXXX
Jan 13 23:22:08 miniupnpd[824]: HTTP Connection from 192.168.XX.XXX closed unexpectedly
Jan 13 23:22:08 dropbear[14255]: bad password attempt for 'admin' from ::ffff:122.225.109.XXX:XXXX
Jan 13 23:22:09 dropbear[14258]: exit before auth: Disconnect received
Jan 13 23:22:09 dropbear[14259]: Child connection from ::ffff:141.28.100.XXX:XXXX
Jan 13 23:22:10 dropbear[14259]: login attempt for nonexistent user from ::ffff:141.28.100.XXX:XXXX
Jan 13 23:22:11 dropbear[14259]: exit before auth: Disconnect received
Jan 13 23:22:11 dropbear[14260]: Child connection from ::ffff:141.28.100.XXX:XXXX
Jan 13 23:22:12 dropbear[14260]: login attempt for nonexistent user from ::ffff:141.28.100.XXX:XXXX
Jan 13 23:22:13 dropbear[14255]: bad password attempt for 'admin' from ::ffff:122.225.109.XXX:XXXX
Jan 13 23:22:13 dropbear[14260]: exit before auth: Disconnect received
Jan 13 23:22:13 dropbear[14261]: Child connection from ::ffff:141.28.100.XXX:XXXX
Jan 13 23:22:13 dropbear[14255]: bad password attempt for 'admin' from ::ffff:122.225.109.XXX:XXXX
Jan 13 23:22:14 dropbear[14255]: bad password attempt for 'admin' from ::ffff:122.225.109.XXX:XXXX
Jan 13 23:22:14 dropbear[14261]: login attempt for nonexistent user from ::ffff:141.28.100.XXX:XXXX
Jan 13 23:22:15 dropbear[14255]: bad password attempt for 'admin' from ::ffff:122.225.109.XXX:XXXX
Jan 13 23:22:15 dropbear[14261]: exit before auth: Disconnect received
Jan 13 23:22:15 miniupnpd[824]: HTTP Connection from 192.168.XX.XXX closed unexpectedly
Jan 13 23:22:15 dropbear[14262]: Child connection from ::ffff:141.28.100.XXX:XXXX
Jan 13 23:22:15 dropbear[14255]: bad password attempt for 'admin' from ::ffff:122.225.109.XXX:XXXX
Jan 13 23:22:16 dropbear[14255]: bad password attempt for 'admin' from ::ffff:122.225.109.XXX:XXXX
Jan 13 23:22:16 dropbear[14262]: login attempt for nonexistent user from ::ffff:141.28.100.XXX:XXXX
Jan 13 23:22:16 dropbear[14255]: exit before auth (user 'admin', 10 fails): Max auth tries reached - user 'admin' from ::ffff:122.225.109.XXX:XXXX
Jan 13 23:22:17 dropbear[14262]: exit before auth: Disconnect received
Jan 13 23:22:17 dropbear[14263]: Child connection from ::ffff:122.225.109.XXX:XXXX
Jan 13 23:22:17 dropbear[14264]: Child connection from ::ffff:141.28.100.XXX:XXXX
Jan 13 23:22:18 dropbear[14264]: login attempt for nonexistent user from ::ffff:141.28.100.XXX:XXXX
Jan 13 23:22:19 dropbear[14264]: exit before auth: Disconnect received
Jan 13 23:22:19 dropbear[14266]: Child connection from ::ffff:141.28.100.XXX:XXXX
Jan 13 23:22:20 dropbear[14266]: login attempt for nonexistent user from ::ffff:141.28.100.XXX:XXXX
Jan 13 23:22:20 miniupnpd[824]: HTTP Connection from 192.168.XX.XXX closed unexpectedly
Jan 13 23:22:21 dropbear[14266]: exit before auth: Disconnect received
Jan 13 23:22:21 dropbear[14267]: Child connection from ::ffff:141.28.100.XXX:XXXX
Jan 13 23:22:22 dropbear[14267]: login attempt for nonexistent user from ::ffff:141.28.100.XXX:XXXX
Jan 13 23:22:22 dropbear[14263]: bad password attempt for 'admin' from ::ffff:122.225.109.XXX:XXXX
Jan 13 23:22:22 miniupnpd[824]: HTTP Connection from 192.168.XX.XXX closed unexpectedly
Jan 13 23:22:23 dropbear[14263]: bad password attempt for 'admin' from ::ffff:122.225.109.XXX:XXXX
Jan 13 23:22:23 dropbear[14267]: exit before auth: Disconnect received
Jan 13 23:22:23 dropbear[14268]: Child connection from ::ffff:141.28.100.XXX:XXXX
Jan 13 23:22:24 dropbear[14263]: bad password attempt for 'admin' from ::ffff:122.225.109.XXX:XXXX
Jan 13 23:22:24 miniupnpd[824]: HTTP Connection from 192.168.XX.XXX closed unexpectedly
Jan 13 23:22:24 dropbear[14263]: bad password attempt for 'admin' from ::ffff:122.225.109.XXX:XXXX
Jan 13 23:22:24 dropbear[14268]: login attempt for nonexistent user from ::ffff:141.28.100.XXX:XXXX
Jan 13 23:22:25 dropbear[14263]: bad password attempt for 'admin' from ::ffff:122.225.109.XXX:XXXX
Jan 13 23:22:25 dropbear[14268]: exit before auth: Disconnect received

What's going on?!?!?!
The logs I posted in the link provided above where showing some weird activity but what I've posted in this post is something entirely new.

Edit:
I wanted to also say that within my ASUS RT-AC87R that all devices hard wired and wireless have an assigned IP if that matters.
Edit2:
Some errors may be due to leaving Terminal open on computer but issues still persist...

A few words about the login attempts. I had a month ago the same problem. It was a brute force attack (from China, based on the IP address).

If you use ssh, one basic trick is at least to change the port number for something else than the standard "22".

The best trick is simply to keep ssh enable but disable the ssh login and use the private/public key mechanism for the connect

 

[jmantn]

Thanks for the replies!

To my knowledge I was only utilizing Telnet but could be wrong as I had to do a lot to the routers when I factory reset them Monday night trying to troubleshoot this. I have since turned telnet and ssh off on all routers which I typically leave off anyways.

As I'm typing this I also noticed I can't log into my router yet I can browse other webpages pretty fast and I verified I'm connected to my router and have the assigned IP that I configured within my router.

The other errors I had been seeing were:

Jan 11 15:16:27 miniupnpd[733]: HTTP Connection from 192.XXX.X.XXX closed unexpectedly
Jan 11 15:31:27 miniupnpd[733]: HTTP Connection from 192.XXX.X.XXX closed unexpectedly
Jan 11 15:46:27 miniupnpd[733]: HTTP Connection from 192.XXX.X.XXX closed unexpectedly
Jan 11 15:49:37 miniupnpd[733]: Expired NAT-PMP mapping port 37370 UDP removed
Jan 11 15:49:37 miniupnpd[733]: Expired NAT-PMP mapping port 37370 TCP removed
Jan 11 15:56:14 kernel: br0: received packet on vlan1 with own address as source address
Jan 11 15:59:57 ntp: start NTP update
Jan 11 16:01:27 miniupnpd[733]: HTTP Connection from 192.XXX.X.XXX closed unexpectedly
Jan 11 16:18:28 kernel: br0: received packet on vlan1 with own address as source address
Jan 11 16:59:59 ntp: start NTP update
Jan 11 17:00:11 ntp: start NTP update
Jan 11 17:00:41 ntp: start NTP update
Jan 11 17:00:45 ntp: start NTP update
Jan 11 17:00:48 ntp: start NTP update
Jan 11 17:00:52 ntp: start NTP update
Jan 11 17:00:59 ntp: start NTP update
Jan 11 17:01:28 miniupnpd[733]: HTTP Connection from 192.XXX.X.XXX closed unexpectedly
Jan 11 17:06:32 miniupnpd[733]: Expired NAT-PMP mapping port 16403 UDP removed
Jan 11 17:06:34 miniupnpd[733]: Expired NAT-PMP mapping port 5900 TCP removed
Jan 11 17:06:36 miniupnpd[733]: Expired NAT-PMP mapping port 4500 UDP removed

If anyone has any help on that. Wanted to grab logs from today but currently can't even log in!?!?

Bottom line was the errors listed in my first post weren't the cause of my intermittent connectivity and dropout issues. Those just occurred after I reset everything and I tend to agree that was due to SSH/telnet being left open though disturbing China could be trying to hack me which isn't out of the question due to employer.

Any help solving the connectivity issues is greatly appreciated and luckily these are off days for me right now.

Edit:
Had to get on a device physically connected to the ASUS 87R to log in and here's highlights from my logs:

Jan 14 12:30:13 miniupnpd[824]: HTTP Connection from 192.168.XX.XXX closed unexpectedly
Jan 14 12:30:15 miniupnpd[824]: HTTP Connection from 192.168.XX.XXX closed unexpectedly
Jan 14 12:30:21 dnsmasq-dhcp[623]: DHCPREQUEST(br0) 192.168.1.21 80:be:XX:XX:XX:XX 
Jan 14 12:30:21 dnsmasq-dhcp[623]: DHCPACK(br0) 192.168.1.21 80:be:XX:XX:XX:XX Jmansione6Plus
Jan 14 12:30:28 miniupnpd[824]: HTTP Connection from 192.168.XX.XXX closed unexpectedly
Jan 14 12:30:28 miniupnpd[824]: HTTP Connection from 192.168.XX.XXX closed unexpectedly
Jan 14 12:30:28 miniupnpd[824]: HTTP Connection from 192.168.XX.XXXclosed unexpectedly
Jan 14 12:30:30 miniupnpd[824]: HTTP Connection from 192.168.XX.XXX closed unexpectedly

the 192 is all from same computer and not sure why so many logs for that

Edit3:
Assumptions regarding logs in first post were in fact correct. For whatever reason SSH wasn't turned off however I did go through and check last night and thought I saved my settings after disabling so not sure what happened. As previously mentioned that wasn't the cause for my issues, was just a concern since I hadn't seen that before and it appeared while I was troubleshooting the existing issues.

 

[RMerlin]

There's nothing wrong with these expiration messages. They indicate that a port that was forwarded through UPNP hasn't been used for a while, so the mapping expired and was removed my the UPNP daemon. This is the desired behaviour.

THe "Closed unexpectedly" would make me suspect you have a LAN device that's incorrectly interacting with UPNP. This isn't a problem of the router but of whatever program running on that private IP is causing it (BTW, there is no point in hiding the IP of a private LAN IP such as 192.168.x.y - it's not routable and only makes troubleshooting harder).

 

[jmantn]

Thanks Merlin some of this stuff I'm learning as I go.

I've had Asus products for years and did briefly switch to Netfesr but quickly came back.

The issues I've ran into have been hard to catch and my gut feeling was it was my ISP since I hadn't changed anything from New Years Eve to Sunday when the issues started but they checked my modem and my connection at my utility pole and found nothing.

I am using IPv6 tunnel from Charter using their DNS (for IPv4 &6) and wondering if IPv6 a possible culprit as others recently have suspected it but not sure.

I typically don't come on here and post much except recently as my GF works from home and any time the Internet goes down we have to schedule an ISP visit if there's not a major outage reported by my ISP so I'm having to do a crash course in a lot of areas lately that I usually would just suffer through or check posts for answers (which I'm trying to do still) but this is relatively a new job for her and its a major tech company and I don't want her to get in trouble from repeated issues hence the urgency. Not to mention I was recently laid off while on paternity leave so she's the only one bringing in income while I raise our child.

I have small amounts of free time to try and troubleshoot when she's not working but clueless as to what to do next aside from looking at logs. Everything but the N66U has been factory reset and all works fine until it doesn't. I've checked for interference with channels and dumbfounded.

 

[RMerlin]

At this point, the vast majority of ISP's IPv6 deployment (especially in the US) should be considered as experimental. If your Internet access is critical due to having someone working from home, I would recommend disabling IPv6 support.

 

[jmantn]

I'll give that a try but did want to note that up until Sunday it had worked flawlessly. Unfortunately I don't know enough about this to even suggest which end the issue was happening on. If issues continue I will report back and Thank You for your time.

 

[jmantn]

Disabled IPv6 and rebooted all routers and issue is still affecting my devices.

For example I have a DropCam wireless camera and it constantly states no connection or shows and upload warning stating it needs at least .5 upload bandwidth and I have 4. My apple devices frequently act like they're not connected to the Internet but shows they are in the settings.

Also my hard wired iMac had issues as well earlier.

Jan 15 23:30:18 dnsmasq-dhcp[2404]: DHCPDISCOVER(br0) 30:8c:fb:11:28:15 
Jan 15 23:30:18 dnsmasq-dhcp[2404]: DHCPOFFER(br0) 192.168.1.12 30:8c:fb:11:28:15 
Jan 15 23:30:18 dnsmasq-dhcp[2404]: DHCPREQUEST(br0) 192.168.1.12 30:8c:fb:11:28:15 
Jan 15 23:30:18 dnsmasq-dhcp[2404]: DHCPACK(br0) 192.168.1.12 30:8c:fb:11:28:15 
Jan 15 23:40:03 kernel: br0: received packet on eth1 with own address as source address
Jan 15 23:40:04 kernel: br0: received packet on eth1 with own address as source address
Jan 15 23:40:06 kernel: br0: received packet on eth1 with own address as source address
Jan 15 23:40:07 kernel: br0: received packet on eth1 with own address as source address
Jan 15 23:40:09 dnsmasq-dhcp[2404]: DHCPDISCOVER(br0) a0:ed:cd:e0:2f:c9 
Jan 15 23:40:09 dnsmasq-dhcp[2404]: DHCPOFFER(br0) 192.168.1.15 a0:ed:cd:e0:2f:c9 
Jan 15 23:40:10 dnsmasq-dhcp[2404]: DHCPREQUEST(br0) 192.168.1.15 a0:ed:cd:e0:2f:c9 
Jan 15 23:40:10 dnsmasq-dhcp[2404]: DHCPACK(br0) 192.168.1.15 a0:ed:cd:e0:2f:c9 GreatRomAppleTV
Jan 15 23:40:14 kernel: br0: received packet on eth1 with own address as source address
Jan 15 23:40:14 dnsmasq-dhcp[2404]: DHCPDISCOVER(br0) 70:9e:29:1f:e7:48 
Jan 15 23:40:14 dnsmasq-dhcp[2404]: DHCPOFFER(br0) 192.168.1.4 70:9e:29:1f:e7:48 
Jan 15 23:40:14 dnsmasq-dhcp[2404]: DHCPREQUEST(br0) 192.168.1.4 70:9e:29:1f:e7:48 
Jan 15 23:40:14 dnsmasq-dhcp[2404]: DHCPACK(br0) 192.168.1.4 70:9e:29:1f:e7:48 
Jan 15 23:40:15 dnsmasq-dhcp[2404]: DHCPDISCOVER(br0) a0:ed:cd:e0:2f:ca 
Jan 15 23:40:15 dnsmasq-dhcp[2404]: DHCPOFFER(br0) 192.168.1.16 a0:ed:cd:e0:2f:ca 
Jan 15 23:40:16 dnsmasq-dhcp[2404]: DHCPDISCOVER(br0) 30:8c:fb:11:28:15 
Jan 15 23:40:16 dnsmasq-dhcp[2404]: DHCPOFFER(br0) 192.168.1.12 30:8c:fb:11:28:15 
Jan 15 23:40:16 dnsmasq-dhcp[2404]: DHCPREQUEST(br0) 192.168.1.12 30:8c:fb:11:28:15 
Jan 15 23:40:16 dnsmasq-dhcp[2404]: DHCPACK(br0) 192.168.1.12 30:8c:fb:11:28:15 
Jan 15 23:40:17 dnsmasq-dhcp[2404]: DHCPDISCOVER(br0) a0:ed:cd:e0:2f:ca 
Jan 15 23:40:17 dnsmasq-dhcp[2404]: DHCPOFFER(br0) 192.168.1.16 a0:ed:cd:e0:2f:ca 
Jan 15 23:40:20 dnsmasq-dhcp[2404]: DHCPREQUEST(br0) 192.168.1.16 a0:ed:cd:e0:2f:ca 
Jan 15 23:40:20 dnsmasq-dhcp[2404]: DHCPACK(br0) 192.168.1.16 a0:ed:cd:e0:2f:ca GreatRomAppleTV
Jan 15 23:40:26 dnsmasq-dhcp[2404]: DHCPRELEASE(br0) 192.168.1.17 cc:95:d7:03:a8:08 
Jan 15 23:40:27 dnsmasq-dhcp[2404]: DHCPDISCOVER(br0) cc:95:d7:03:a8:08 
Jan 15 23:40:27 dnsmasq-dhcp[2404]: DHCPOFFER(br0) 192.168.1.17 cc:95:d7:03:a8:08 
Jan 15 23:40:27 dnsmasq-dhcp[2404]: DHCPREQUEST(br0) 192.168.1.17 cc:95:d7:03:a8:08 
Jan 15 23:40:27 dnsmasq-dhcp[2404]: DHCPACK(br0) 192.168.1.17 cc:95:d7:03:a8:08 
Jan 15 23:40:42 dnsmasq-dhcp[2404]: DHCPDISCOVER(br0) e0:3f:49:e5:b2:b8 
Jan 15 23:40:42 dnsmasq-dhcp[2404]: DHCPOFFER(br0) 192.168.1.150 e0:3f:49:e5:b2:b8 
Jan 15 23:40:42 dnsmasq-dhcp[2404]: DHCPREQUEST(br0) 192.168.1.150 e0:3f:49:e5:b2:b8 
Jan 15 23:40:42 dnsmasq-dhcp[2404]: DHCPACK(br0) 192.168.1.150 e0:3f:49:e5:b2:b8 RT-AC68U-B2B8
Jan 15 23:40:47 dnsmasq-dhcp[2404]: DHCPREQUEST(br0) 192.168.1.15 a0:ed:cd:e0:2f:c9 
Jan 15 23:40:47 dnsmasq-dhcp[2404]: DHCPACK(br0) 192.168.1.15 a0:ed:cd:e0:2f:c9 GreatRomAppleTV
Jan 15 23:40:47 dnsmasq-dhcp[2404]: DHCPDISCOVER(br0) 70:9e:29:1f:e7:48 
Jan 15 23:40:47 dnsmasq-dhcp[2404]: DHCPOFFER(br0) 192.168.1.4 70:9e:29:1f:e7:48 
Jan 15 23:40:47 dnsmasq-dhcp[2404]: DHCPREQUEST(br0) 192.168.1.4 70:9e:29:1f:e7:48 
Jan 15 23:40:47 dnsmasq-dhcp[2404]: DHCPACK(br0) 192.168.1.4 70:9e:29:1f:e7:48 
Jan 15 23:40:47 dnsmasq-dhcp[2404]: DHCPREQUEST(br0) 192.168.1.16 a0:ed:cd:e0:2f:ca 
Jan 15 23:40:47 dnsmasq-dhcp[2404]: DHCPACK(br0) 192.168.1.16 a0:ed:cd:e0:2f:ca GreatRomAppleTV
Jan 15 23:40:57 dnsmasq-dhcp[2404]: DHCPREQUEST(br0) 192.168.1.17 cc:95:d7:03:a8:08 
Jan 15 23:40:57 dnsmasq-dhcp[2404]: DHCPACK(br0) 192.168.1.17 cc:95:d7:03:a8:08 
Jan 15 23:41:04 dnsmasq-dhcp[2404]: DHCPDISCOVER(br0) 00:0d:c5:f9:99:84 
Jan 15 23:41:04 dnsmasq-dhcp[2404]: DHCPOFFER(br0) 192.168.1.2 00:0d:c5:f9:99:84 
Jan 15 23:41:04 dnsmasq-dhcp[2404]: DHCPREQUEST(br0) 192.168.1.2 00:0d:c5:f9:99:84 
Jan 15 23:41:04 dnsmasq-dhcp[2404]: DHCPACK(br0) 192.168.1.2 00:0d:c5:f9:99:84 Hopper_ETH1
Jan 15 23:45:17 dnsmasq-dhcp[2404]: DHCPREQUEST(br0) 192.168.1.52 68:5b:35:d5:74:2b 
Jan 15 23:45:17 dnsmasq-dhcp[2404]: DHCPACK(br0) 192.168.1.52 68:5b:35:d5:74:2b Tracie
Jan 15 23:45:30 dnsmasq-dhcp[2404]: DHCPREQUEST(br0) 192.168.1.52 68:5b:35:d5:74:2b 
Jan 15 23:45:30 dnsmasq-dhcp[2404]: DHCPACK(br0) 192.168.1.52 68:5b:35:d5:74:2b Tracie
Jan 15 23:45:39 dnsmasq-dhcp[2404]: DHCPREQUEST(br0) 192.168.1.52 68:5b:35:d5:74:2b 
Jan 15 23:45:39 dnsmasq-dhcp[2404]: DHCPACK(br0) 192.168.1.52 68:5b:35:d5:74:2b Tracie
Jan 15 23:45:56 miniupnpd[2466]: HTTP Connection from 192.168.1.52 closed unexpectedly

Tomorrow is a work day so hoping for a miracle.

When my connection drops I don't always have a message in my logs

 

[longstaff]

What I would do to try and troubleshoot the issue or issues is firstly swap out what I'm going to call the internet facing router which is the AC87 and use the AC68 in its place and see how that goes for a day or two. Don't do anything with the AC87 in case you need to swap it back.

Next I would try and simplify the configuration just to aid troubleshooting. But as as you have such a complex setup can you elaborate on how the work computer is connected. I guess this is the most important to keep a stable connection e.g. which router it is connected to, how it is connected wired or WiFi, which band is being used, OS its running, WiFi card if applicable, etc. Maybe post a quick sketch of your setup.

 

[jmantn]

Sorry for the delay at 145am I contacted Charter and they sent out a tech (second one so far) to my house first thing this morning.

From 8-9am I had a DL speed of less than 5Mbps and a Ping of 400Ms and so while awaiting on charter tech I called customer care And this time they seen an issue with the Modem. When the tech arrived my issues weren't present anymore however he swapped out my modem and something interesting happened.

The power level my Motorola SB6120 was using was around 2 for RX I believe and he put in a Cisco DPC3208 and the power level showed between 7-8 for RX. The way he explained it was that a different modem shouldn't have caused that big of a change in power levels and guessed that my Modem was incorrectly showing things were fine when in fact they weren't. If that's true then the tech support on the phone and even a tech would overlook the issue if the modem was saying it was fine when in fact it wasn't.

For the time being I'm not experiencing any issues however that's how it went the last time a tech came out so if and when it goes back down I will have all the requested info along with previous modem and current modem's stats as I screenshot'd all relevant info prior to exchanging and afterwards.

I'd post all that now however doing errands at the moment and GF is able to work for the time being.