Flakey internet connection - help!

[mwpmorris]

Hi all,

I'm a bit of an amateur with these kind of things so I was hoping that someone may be able to help diagnose some connection problems I'm having.

I have an Asus RT-N66U, which accesses the Internet over PPPOE via a Draytek Vigor 120. My ISP is Sky Broadband in the UK which is PPPOA only.

I'm Using AsusWRT-Merlin 374.42, and have been having strange problems for a few weeks. Quite often the connection simply drops for no apparent reason and will not re connect for an hour or so. Sometimes I get some luck with a reboot of the router or modem but it usually doesn't last.

Bit of background - had no issues for around a year using a different modem when my ISP used PPPOE. My ISP was then bought out and taken over by Sky, meaning that I had to move over to using the Draytek. I'm not sure whether this problem is caused by the modem, the router, the ISP or any combination thereof. There is also work going on in my area to upgrade the exchange to fibre, with FTTC being available to customers at some point soon.

I have pasted some suspect looking parts of the syslog below. Could someone have a look and give me some ideas? Thanks a lot!

Jul 4 11:50:01 kernel: DROP <4>DROP IN=ppp0 OUT= MAC= <1>SRC=173.194.66.125 DST=MY.IP.ADD.RESS <1>LEN=74 TOS=0x00 PREC=0x00 TTL=51 ID=21047 PROTO=TCP <1>SPT=5222 DPT=62385 SEQ=1110380950 ACK=177706264 WINDOW=670 RES=0x00 ACK PSH URGP=0 OPT (0101080A8E2C57313BE5224E)
Jul 4 11:50:01 ddns update: Asus update entry:: return: HTTP/1.1 200 OK^M Date: Fri, 04 Jul 2014 11:28:51 GMT^M Server: Apache/2.4.9 (Unix) PHP/5.4.14 OpenSSL/1.0.1h^M X-Powered-By: PHP/5.4.14^M Content-Length: 0^M Connection: close^M Content-Type: text/html^M ^M
Jul 4 11:50:01 ddns update: retval= 0, ddns_return_code (,200)
Jul 4 11:50:01 ddns update: asusddns_update: 0
Jul 4 11:50:01 ddns: ddns update ok
Jul 4 11:50:02 WAN Connection: WAN was restored.
Jul 4 11:50:07 kernel: DROP <4>DROP IN=ppp0 OUT= MAC= <1>SRC=108.160.165.14 DST=MY.IP.ADD.RESS <1>LEN=321 TOS=0x00 PREC=0x00 TTL=50 ID=35266 DF PROTO=TCP <1>SPT=443 DPT=51502 SEQ=2145280804 ACK=4152773133 WINDOW=34 RES=0x00 ACK PSH URGP=0 OPT (0101080A47C39EA00307F02A)
Jul 4 11:50:08 kernel: DROP <4>DROP IN=ppp0 OUT= MAC= <1>SRC=212.227.15.138 DST=MY.IP.ADD.RESS <1>LEN=52 TOS=0x00 PREC=0x00 TTL=58 ID=5072 DF PROTO=TCP <1>SPT=143 DPT=62363 SEQ=207118599 ACK=1104381269 WINDOW=31 RES=0x00 ACK URGP=0 OPT (0101080A15EE7F403BE5258B)
Jul 4 11:50:11 kernel: DROP <4>DROP IN=ppp0 OUT= MAC= <1>SRC=173.194.66.125 DST=MY.IP.ADD.RESS <1>LEN=74 TOS=0x00 PREC=0x00 TTL=51 ID=21021 PROTO=TCP <1>SPT=5222 DPT=62385 SEQ=1110380950 ACK=177706264 WINDOW=670 RES=0x00 ACK PSH URGP=0 OPT (0101080A8E2C7E413BE5224E)
Jul 4 11:50:18 kernel: DROP <4>DROP IN=ppp0 OUT= MAC= <1>SRC=212.227.15.138 DST=MY.IP.ADD.RESS <1>LEN=52 TOS=0x00 PREC=0x00 TTL=58 ID=37866 DF PROTO=TCP <1>SPT=143 DPT=62413 SEQ=666103610 ACK=3641978880 WINDOW=29 RES=0x00 ACK URGP=0 OPT (0101080A15BF30C13BE52850)
Jul 4 11:50:21 kernel: DROP <4>DROP IN=ppp0 OUT= MAC= <1>SRC=173.194.66.125 DST=MY.IP.ADD.RESS <1>LEN=74 TOS=0x00 PREC=0x00 TTL=51 ID=21021 PROTO=TCP <1>SPT=5222 DPT=62385 SEQ=1110380950 ACK=177706264 WINDOW=670 RES=0x00 ACK PSH URGP=0 OPT (0101080A8E2CA5513BE5224E)
Jul 4 11:50:31 kernel: DROP <4>DROP IN=ppp0 OUT= MAC= <1>SRC=173.194.66.125 DST=MY.IP.ADD.RESS <1>LEN=74 TOS=0x00 PREC=0x00 TTL=51 ID=21022 PROTO=TCP <1>SPT=5222 DPT=62385 SEQ=1110380950 ACK=177706264 WINDOW=670 RES=0x00 ACK PSH URGP=0 OPT (0101080A8E2CCC613BE5224E)
Jul 4 11:50:31 kernel: DROP <4>DROP IN=ppp0 OUT= MAC= <1>SRC=85.219.172.50 DST=MY.IP.ADD.RESS <1>LEN=60 TOS=0x00 PREC=0x00 TTL=46 ID=2318 DF PROTO=TCP <1>SPT=37893 DPT=16941 SEQ=1751382482 ACK=0 WINDOW=5840 RES=0x00 SYN URGP=0 OPT (020405B40402080AE8A734090000000001030306)
Jul 4 11:50:34 kernel: DROP <4>DROP IN=ppp0 OUT= MAC= <1>SRC=85.219.172.50 DST=MY.IP.ADD.RESS <1>LEN=60 TOS=0x00 PREC=0x00 TTL=46 ID=2319 DF PROTO=TCP <1>SPT=37893 DPT=16941 SEQ=1751382482 ACK=0 WINDOW=5840 RES=0x00 SYN URGP=0 OPT (020405B40402080AE8A73FC10000000001030306)
Jul 4 11:50:40 kernel: DROP <4>DROP IN=ppp0 OUT= MAC= <1>SRC=85.219.172.50 DST=MY.IP.ADD.RESS <1>LEN=60 TOS=0x00 PREC=0x00 TTL=46 ID=2320 DF PROTO=TCP <1>SPT=37893 DPT=16941 SEQ=1751382482 ACK=0 WINDOW=5840 RES=0x00 SYN URGP=0 OPT (020405B40402080AE8A757310000000001030306)
Jul 4 11:50:41 kernel: DROP <4>DROP IN=ppp0 OUT= MAC= <1>SRC=173.194.66.125 DST=MY.IP.ADD.RESS <1>LEN=74 TOS=0x00 PREC=0x00 TTL=51 ID=21023 PROTO=TCP <1>SPT=5222 DPT=62385 SEQ=1110380950 ACK=177706264 WINDOW=670 RES=0x00 ACK PSH URGP=0 OPT (0101080A8E2CF3713BE5224E)
Jul 4 11:50:43 kernel: DROP <4>DROP IN=ppp0 OUT= MAC= <1>SRC=108.160.165.14 DST=MY.IP.ADD.RESS <1>LEN=321 TOS=0x00 PREC=0x00 TTL=50 ID=35268 DF PROTO=TCP <1>SPT=443 DPT=51502 SEQ=2145280804 ACK=4152773133 WINDOW=34 RES=0x00 ACK PSH URGP=0 OPT (0101080A47C3C1C00307F02A)
Jul 4 11:50:52 kernel: DROP <4>DROP IN=ppp0 OUT= MAC= <1>SRC=85.219.172.50 DST=MY.IP.ADD.RESS <1>LEN=60 TOS=0x00 PREC=0x00 TTL=46 ID=2321 DF PROTO=TCP <1>SPT=37893 DPT=16941 SEQ=1751382482 ACK=0 WINDOW=5840 RES=0x00 SYN URGP=0 OPT (020405B40402080AE8A786110000000001030306)
Jul 4 11:51:08 kernel: DROP <4>DROP IN=ppp0 OUT= MAC= <1>SRC=212.227.15.138 DST=MY.IP.ADD.RESS <1>LEN=52 TOS=0x00 PREC=0x00 TTL=58 ID=5073 DF PROTO=TCP <1>SPT=143 DPT=62363 SEQ=207118599 ACK=1104381269 WINDOW=31 RES=0x00 ACK URGP=0 OPT (0101080A15EEBA003BE5258B)
Jul 4 11:51:19 kernel: DROP <4>DROP IN=ppp0 OUT= MAC= <1>SRC=212.227.15.138 DST=MY.IP.ADD.RESS <1>LEN=52 TOS=0x00 PREC=0x00 TTL=58 ID=37867 DF PROTO=TCP <1>SPT=143 DPT=62413 SEQ=666103610 ACK=3641978880 WINDOW=29 RES=0x00 ACK URGP=0 OPT (0101080A15BF6B803BE52850)
Jul 4 11:52:02 kernel: DROP <4>DROP IN=ppp0 OUT= MAC= <1>SRC=173.252.113.2 DST=MY.IP.ADD.RESS <1>LEN=97 TOS=0x00 PREC=0x00 TTL=81 ID=29302 DF PROTO=TCP <1>SPT=443 DPT=62378 SEQ=3829173932 ACK=2302627128 WINDOW=73 RES=0x00 ACK PSH URGP=0 OPT (0101080A47525D063BE51BFC)
Jul 4 11:52:02 kernel: DROP <4>DROP IN=ppp0 OUT= MAC= <1>SRC=173.252.113.2 DST=MY.IP.ADD.RESS <1>LEN=83 TOS=0x00 PREC=0x00 TTL=81 ID=29303 DF PROTO=TCP <1>SPT=443 DPT=62378 SEQ=3829173977 ACK=2302627128 WINDOW=73 RES=0x00 ACK PSH URGP=0 OPT (0101080A47525D063BE51BFC)
Jul 4 11:52:19 kernel: DROP <4>DROP IN=ppp0 OUT= MAC= <1>SRC=212.227.15.138 DST=MY.IP.ADD.RESS <1>LEN=52 TOS=0x00 PREC=0x00 TTL=58 ID=37868 DF PROTO=TCP <1>SPT=143 DPT=62413 SEQ=666103610 ACK=3641978880 WINDOW=29 RES=0x00 ACK URGP=0 OPT (0101080A15BFA6403BE52850)
Jul 4 11:56:47 dnsmasq-dhcp[2677]: DHCPREQUEST(br0) 192.168.0.6 00:88:65:49:a5:35
Jul 4 11:56:47 dnsmasq-dhcp[2677]: DHCPNAK(br0) 192.168.0.6 00:88:65:49:a5:35 wrong address
Jul 4 11:56:49 dnsmasq-dhcp[2677]: DHCPREQUEST(br0) 192.168.0.63 00:88:65:49:a5:35
Jul 4 11:56:49 dnsmasq-dhcp[2677]: DHCPACK(br0) 192.168.0.63 00:88:65:49:a5:35 ****iPhone
Jul 4 11:56:56 kernel: DROP <4>DROP IN=ppp0 OUT= MAC= <1>SRC=2.216.22.116 DST=MY.IP.ADD.RESS <1>LEN=95 TOS=0x00 PREC=0x00 TTL=124 ID=31210 PROTO=UDP <1>SPT=24943 DPT=58891 LEN=75
Jul 4 11:57:21 dnsmasq-dhcp[2677]: DHCPREQUEST(br0) 192.168.0.9 90:b9:31:79:2b:a3
Jul 4 11:57:21 dnsmasq-dhcp[2677]: DHCPACK(br0) 192.168.0.9 90:b9:31:79:2b:a3 ****iPhone
Jul 4 11:57:52 kernel: DROP <4>DROP IN=ppp0 OUT= MAC= <1>SRC=204.42.253.2 DST=MY.IP.ADD.RESS <1>LEN=220 TOS=0x00 PREC=0x00 TTL=56 ID=62544 DF PROTO=UDP <1>SPT=33577 DPT=123 LEN=200
Jul 4 11:57:52 kernel: DROP <4>DROP IN=ppp0 OUT= MAC= <1>SRC=204.42.253.2 DST=MY.IP.ADD.RESS <1>LEN=40 TOS=0x00 PREC=0x00 TTL=56 ID=62545 DF PROTO=UDP <1>SPT=33577 DPT=123 LEN=20
Jul 4 11:58:43 kernel: DROP <4>DROP IN=ppp0 OUT= MAC= <1>SRC=212.227.15.154 DST=MY.IP.ADD.RESS <1>LEN=52 TOS=0x00 PREC=0x00 TTL=59 ID=52831 DF PROTO=TCP <1>SPT=143 DPT=62436 SEQ=2207119704 ACK=4031776078 WINDOW=31 RES=0x00 ACK URGP=0 OPT (0101080A15F03C803BE53BFD)
Jul 4 11:59:44 kernel: DROP <4>DROP IN=ppp0 OUT= MAC= <1>SRC=212.227.15.154 DST=MY.IP.ADD.RESS <1>LEN=52 TOS=0x00 PREC=0x00 TTL=59 ID=52832 DF PROTO=TCP <1>SPT=143 DPT=62436 SEQ=2207119704 ACK=4031776078 WINDOW=31 RES=0x00 ACK URGP=0 OPT (0101080A15F077403BE53BFD)
Jul 4 12:00:44 kernel: DROP <4>DROP IN=ppp0 OUT= MAC= <1>SRC=212.227.15.154 DST=MY.IP.ADD.RESS <1>LEN=52 TOS=0x00 PREC=0x00 TTL=59 ID=52833 DF PROTO=TCP <1>SPT=143 DPT=62436 SEQ=2207119704 ACK=4031776078 WINDOW=31 RES=0x00 ACK URGP=0 OPT (0101080A15F0B2003BE53BFD)
Jul 4 12:03:06 pppd[369]: No response to 10 echo-requests
Jul 4 12:03:06 pppd[369]: Serial link appears to be disconnected.
Jul 4 12:03:06 pppd[369]: Connect time 13.2 minutes.
Jul 4 12:03:06 pppd[369]: Sent 4818146 bytes, received 4835082 bytes.
Jul 4 12:03:06 miniupnpd[2716]: Failed to get IP for interface ppp0
Jul 4 12:03:06 miniupnpd[2716]: SendNATPMPPublicAddressChangeNotification: cannot get public IP address, stopping
Jul 4 12:03:07 dnsmasq[2677]: read /etc/hosts - 5 addresses
Jul 4 12:03:07 dnsmasq[2677]: read /etc/hosts.dnsmasq - 8 addresses
Jul 4 12:03:07 dnsmasq-dhcp[2677]: read /etc/ethers - 9 addresses
Jul 4 12:03:07 dnsmasq[2677]: using nameserver 192.168.2.1#53
Jul 4 12:03:07 pppd[369]: Connection terminated.
Jul 4 12:03:07 pppd[369]: Sent PADT
Jul 4 12:03:07 WAN Connection: Fail to connect with some issues.
Jul 4 12:03:07 stop_nat_rules: apply the redirect_rules!
Jul 4 12:03:07 dnsmasq[2677]: exiting on receipt of SIGTERM
Jul 4 12:03:08 dnsmasq[2739]: started, version 2.69 cachesize 1500
Jul 4 12:03:08 dnsmasq[2739]: asynchronous logging enabled, queue limit is 5 messages
Jul 4 12:03:08 dnsmasq-dhcp[2739]: DHCP, IP range 192.168.0.2 -- 192.168.0.254, lease time 1d
Jul 4 12:03:08 dnsmasq-dhcp[2739]: DHCP, sockets bound exclusively to interface br0
Jul 4 12:03:08 dnsmasq[2739]: read /etc/hosts - 5 addresses
Jul 4 12:03:08 dnsmasq[2739]: read /etc/hosts.dnsmasq - 8 addresses
Jul 4 12:03:08 dnsmasq-dhcp[2739]: read /etc/ethers - 9 addresses

 

[ColinTaylor]

This seems to be the relevant part of the log:

Jul 4 12:03:06 pppd[369]: No response to 10 echo-requests
Jul 4 12:03:06 pppd[369]: Serial link appears to be disconnected.
Jul 4 12:03:06 pppd[369]: Connect time 13.2 minutes.
Jul 4 12:03:06 pppd[369]: Sent 4818146 bytes, received 4835082 bytes.
Jul 4 12:03:06 miniupnpd[2716]: Failed to get IP for interface ppp0
Jul 4 12:03:06 miniupnpd[2716]: SendNATPMPPublicAddressChangeNotification: cannot get public IP address, stopping

I would

a) check the logs in the draytek to see if the line is dropping.

b) replace the cable between the asus and the draytek

c) replace the cable between the phone socket and the draytek

d) replace the microfilter

Also, see here: http://www.smallnetbuilder.com/forums/showthread.php?t=14210

 

[mwpmorris]

Are the "Drop" reports of any significance? I don't think these are simply blocked packets (as I've read) as the source IP addresses are from online services that I use, i.e. Dropbox etc.

 

[ColinTaylor]

Are the "Drop" reports of any significance? I don't think these are simply blocked packets (as I've read) as the source IP addresses are from online services that I use, i.e. Dropbox etc.

I would still suggest that the first thing you should do is check the Draytek logs to see if the line is going down.

As for the dropped packets, I don't know. I'm guessing that you have set the ASUS to log dropped packets. Have you also set "Enable DoS protection"? If so it might be worth turning that off for a while to see if that's the problem.

You say the dropped packets are from services you use. Are you really running an email server?

 

[mwpmorris]

No, not running an email server. I just checked the IP address of some of the source IPs, one of which was Dropbox, which I use. I assumed the others were just general other bits that I'm using.

I am using DOS protection on the N66U as I thought at one point that maybe I was under attack. I do run a SFTP server for my work (with Asus' DynDNS service) and get lots brute force attempts, for which I then have an IP blocking policy set up on my NAS.

 

[RMerlin]

This is the public Internet. Random port scanning on well-known services (such as 80, 25, 22, etc...) is normal.

Disable firewall logging of dropped packets if it annoys you. Honestly there is no point in enabling that logging option, it will merely slow your router down.

The DoS protection simply throttles certain types of packets to limit the impact of DoS attacks. It has no impact on logging.

 

[mwpmorris]

Ok, I didn't realise that the "Drop" reports were actually from the router firewall rejecting incoming packets. I thought they could have been something to do with my problem in the original post. I'll disable the logging if it will speed things up a tad, and I'll also install the syslog on the modem to see if it will shed some light.

As usual with these things, I haven't had any problems at all since I started this thread so we'll see.....