My trusty RT-AX82U seems to be crashing daily

[PDCDUK]

Hi all,

I have been using the above router for over 2 years and mostly without issue.

However, recently my internet kept dropping which I initially blamed on virgin media.

However, looking at the syslogs , i can see that the router is crashing a few times a day, even though ive not made any recent changes.

I would like to interpret the crashlogs but not sure where to start.

Can anyone shed any light ?

Thank you

 

[degrub]

You can try replacing the wall wart power brick. Sometimes, they fail gradually causing all kinds of random issues.

 

[ColinTaylor]

Your router crashed because the wred process hung. That's the malicious website detection part of AiProtection. So as a workaround you could try disabling that.

However, it could be crashing because you do have a malware issue somewhere. I'd be concerned about the high volume of UPnP ports apparently being opened on your router. According to the log it looks like something (possibly a Nest IoT device or the device with IP 192.168.0.210) is opening more than one port every minute. I would go to System Log - Port Forwarding and try and determine what's happening.

 

[PDCDUK]

Your router crashed because the wred process hung. That's the malicious website detection part of AiProtection. So as a workaround you could try disabling that.

However, it could be crashing because you do have a malware issue somewhere. I'd be concerned about the high volume of UPnP ports apparently being opened on your router. According to the log it looks like something (possibly a Nest IoT device or the device with IP 192.168.0.210) is opening more than one port every minute. I would go to System Log - Port Forwarding and try and determine what's happening.

I've checked and it seems I have AiProtection disabled:

As the parent toggle (Enabled AI protection) is off, i would hope that means the Malicious sites Blocking would be off (even the the picture shows it as on)

Also, even though I have QOS off, i can see this option is on:

Should I turn that off ?

I do have a Nest Door bell but when I just checked the system log - port forwarding now, i only see about 20 items in there and none are Nest. However, my kids due sometimes download torrents (a couple of hours in the late evening) - maybe that would explain why so many ports were being Open?

Thank you

 

[Tech9]

What is the Danger warning about in Security Assessment?

 

[PDCDUK]

What is the Danger warning about in Security Assessment?

That i still have the default user name "admin"

 

[ColinTaylor]

I do have a Nest Door bell but when I just checked the system log - port forwarding now, i only see about 20 items in there and none are Nest. However, my kids due sometimes download torrents (a couple of hours in the late evening) - maybe that would explain why so many ports were being Open?

"Only 20 items" (but constantly changing?). If you don't know what they're for I would be concerned. What I'm seeing in the logs is port forwarding happening 24x7, not just in the evenings.

I've checked and it seems I have AiProtection disabled:

It's likely that wred runs when any of the TrendMicro functions are enabled. So to be sure all of that is disabled go to Administration - Policy and "Withdraw" from the agreement.

 

[PDCDUK]

"Only 20 items" (but constantly changing?). If you don't know what they're for I would be concerned. What I'm seeing in the logs is port forwarding happening 24x7, not just in the evenings.


It's likely that wred runs when any of the TrendMicro functions are enabled. So to be sure all of that is disabled go to Administration - Policy and "Withdraw" from the agreement.

Thanks, i've withdrawn the Trendmicro agreement.

I just refreshed the port forwarding screen and I now see

However, i know that there are no torrent clients running in my network at the moment. I could start one and see what happens ?

 

[Tech9]

I've seen torrenting crashing the router when μTP transport protocol is used. Try changing to TCP and see what happens.

 

[ColinTaylor]

Thanks, i've withdrawn the Trendmicro agreement.

I just refreshed the port forwarding screen and I now see

View attachment 63469

However, i know that there are no torrent clients running in my network at the moment. I could start one and see what happens ?

You should start by determining what the devices are with IP addresses 192.168.0.215, 192.168.0.105 and 192.168.0.117. That may provide clues to the cause.

 

[PDCDUK]

I've seen torrenting crashing the router when μTP transport protocol is used. Try changing to TCP and see what happens.

Ive changed this to TCP:

You can see the torrent client is using port 43358 for incoming connections, this correlates to what I now see in the port forwarding: