Typical router behaviour with Cable ISP?

[jetpack42]

Hi there, I have an extremely dumb question. I have my GT-AX6000 connected to my ISP’s cable modem in bridge mode. I have noticed some unusual behaviour starting about a couple of months ago.

When I got my GT-AX6000 in 2022, up until August 2024, my router’s WAN light would only flash/flicker when a device on my network was accessing the internet (which is understandable). When there was no activity, the WAN light would be solid. However, starting two months ago, the WAN light is always flickering rapidly, even when no devices are connected to the network. I have tried several WPS resets and I have factory reset my ISP’s equipment (using the factory reset option that they give to customers) as well, however, it still seems to be doing this. I’ve also tried switch from Merlin to stock AsusWRT and this behaviour continues.

I am confident that no devices are connected to the network, as I rotate my wi-fi passwords with every reset and I ensure that wired devices are disconnected before rebooting after the initial setup. I also do not (and never have) used custom scripts or had SSH or Web Access from WAN enabled on this router. I do not use VPN’s on this router either. UPNP, network shares (Samba), and Asusnat tunnel is disabled. I do not notice any unusual connections using the router’s netstat command or under the classification tab (when using Asuswrt-Merlin). Lastly, I have also left my router disconnected for a long period of time to get a new IPv4 address and IPv6 prefix, but the behaviour continues.

Normally, I wouldn’t worry about this, however, it just seems unusual because this behaviour is new, and I am completely uneducated on what’s going on. Does anyone else with potentially know what is going on? Is it possible that this is standard cable internet behaviour and that something changed on my ISP’s end? Am I being paranoid over nothing? (Lol)

 

[Crimliar]

Can we assume that you have a cable modem/router from your ISP else it probably wouldn't have a bridge mode - and if so can we assume it's a proper bridge mode, labelled up as such? I guess knowing the make/model wouldn't help either.
Moving on constant, at the very least low intensity activity being indicated by the LEDs on a modem or other boundary device is quite normal as you'll be relying on the router to perform firewall filtering. Changes to the way the modem is indicating traffic could be down to something as simple as a change to the firmware on the device making it react differently.
As you sound worried about this, you could try installing Skynet when using the Merlin Firmware - which I believe is probably more than enough intervention for now.
*Personally I'd not be too worried - paranoia makes too many people do things that end up making their networks less secure!

 

[Justinh]

I have an extremely dumb question

I normally don't say this when I post. I just let the smarter folks tell me.

the WAN light is always flickering rapidly

Mine does this also, and I think it always has over the past 2 routers. It bothers me, too, so I am interested in this.

 

[jetpack42]

Thank you for responding! Yes, the device that my ISP requires its customers to use is a modem/router combo (technicolor XB8) but it does offer a true bridge mode that I can enable myself with the press of a button.

I somewhat figured that it might possibly be something on my ISP's end. They do push updates to the modem even when it is in bridge mode, and given the abruptness of the router showing constant WAN activity, I wondered if something changed with the modem's firmware, or if something happened at the ISP level. I also was curious if it was just firewall activity. At one point, I was worried it could be malware, even, but I know thats extremely unlikely given the fact that my router is up-to-date and is locked down as much as I can make it from the router's interface.

But since I am still a novice at all of this, I figured I would ask here to see if someone had a different perspective or to see if I was missing something on my end (I have used Skynet in the past, but most Merlin add-ons go beyond the needs of my network so I don't use them anymore). I noticed that the download meter on the main page also shows constant download activity of less than a kilobit per second at all times, but given that I need to have a device connected to even see that, I could not prove that my device wasn't causing that traffic. So, seeing the WAN light constantly rapidly flashing even with no devices connected caused some concern.

*Personally I'd not be too worried - paranoia makes too many people do things that end up making their networks less secure!

I think for now I will assume it is something beyond my control (I tend to worry myself sick when I think I misconfigured something, even though I have a simple configuration. Go figure!). Thanks again

 

[Tech9]

However, starting two months ago, the WAN light is always flickering rapidly, even when no devices are connected to the network.

This is exactly what I get with my home ISP.

Bridge mode - constant rapid flashing
Router mode - flashing on data down/up only

It's been like this for all Asus routers with WAN port detection LED (white/red) I have ever tested.

The cable Gateway is Rogers Canada famous Hitron CODA-4582U.

 

[jetpack42]

This is exactly what I get with my home ISP.

Bridge mode - constant rapid flashing
Router mode - flashing on data down/up only

It's been like this for all Asus routers with WAN port detection LED (white/red) I have ever tested.

The cable Gateway is Rogers Canada famous Hitron CODA-4582U.

Thank you! I really appreciate the posts on this thread, I feel better about it now.

I also have RoShawgers as my ISP (though in the west, it is still the Shaw system with the Rogers name slapped on), so it is good to hear that I am not the only one experiencing this with Rogers. I never got to experience this with my old Hitron gateway, they forced me onto the XB8 before I moved on to ASUS routers, but it looks like the experience is the same.

 

[Tech9]

As long as it works and doesn't disconnect - all good.