Typical router behaviour with Cable ISP?

[jetpack42]

Hi there, I have an extremely dumb question. I have my GT-AX6000 connected to my ISP’s cable modem in bridge mode. I have noticed some unusual behaviour starting about a couple of months ago.

When I got my GT-AX6000 in 2022, up until August 2024, my router’s WAN light would only flash/flicker when a device on my network was accessing the internet (which is understandable). When there was no activity, the WAN light would be solid. However, starting two months ago, the WAN light is always flickering rapidly, even when no devices are connected to the network. I have tried several WPS resets and I have factory reset my ISP’s equipment (using the factory reset option that they give to customers) as well, however, it still seems to be doing this. I’ve also tried switch from Merlin to stock AsusWRT and this behaviour continues.

I am confident that no devices are connected to the network, as I rotate my wi-fi passwords with every reset and I ensure that wired devices are disconnected before rebooting after the initial setup. I also do not (and never have) used custom scripts or had SSH or Web Access from WAN enabled on this router. I do not use VPN’s on this router either. UPNP, network shares (Samba), and Asusnat tunnel is disabled. I do not notice any unusual connections using the router’s netstat command or under the classification tab (when using Asuswrt-Merlin). Lastly, I have also left my router disconnected for a long period of time to get a new IPv4 address and IPv6 prefix, but the behaviour continues.

Normally, I wouldn’t worry about this, however, it just seems unusual because this behaviour is new, and I am completely uneducated on what’s going on. Does anyone else with potentially know what is going on? Is it possible that this is standard cable internet behaviour and that something changed on my ISP’s end? Am I being paranoid over nothing? (Lol)

 

[Crimliar]

Can we assume that you have a cable modem/router from your ISP else it probably wouldn't have a bridge mode - and if so can we assume it's a proper bridge mode, labelled up as such? I guess knowing the make/model wouldn't help either.
Moving on constant, at the very least low intensity activity being indicated by the LEDs on a modem or other boundary device is quite normal as you'll be relying on the router to perform firewall filtering. Changes to the way the modem is indicating traffic could be down to something as simple as a change to the firmware on the device making it react differently.
As you sound worried about this, you could try installing Skynet when using the Merlin Firmware - which I believe is probably more than enough intervention for now.
*Personally I'd not be too worried - paranoia makes too many people do things that end up making their networks less secure!