Constant infuriating stalling of ADSL connection.

Forums › Spark New Zealand (including Skinny and BigPipe) › Constant infuriating stalling of ADSL connection.

1 | 2 | 3

1550 posts

Uber Geek
+1 received by user: 322

ID Verified

Trusted

#1354168 29-Jul-2015 09:56

freitasm: Have you run a full anti-spyware scan with Malwarebytes yet?

No Windows machines in the house, Macs are on 10.10.4 and one updating from 10.10.3 as we speak. Not sure what to check on them? Don't run any browser extensions except uBlock
Otherwise there's an Apple TV, an Epson printer, and various iPhones and iPads etc.

Jase2985

13730 posts

Uber Geek
+1 received by user: 6202

ID Verified

Lifetime subscriber

#1354173 29-Jul-2015 10:01

are you just pulling that posted info from the logs?

can you try disconnecting everything and turning off the wifi. then leave it for maybe an hour then reconnect 1 device and check the logs again and see if there are still entries in there. that should tell you if its a device or modem issue. then maybe connect one pc back at a time slowly, say every 30 mins and keep checking the logs and see if/when it comes back.

josephhinvest

1550 posts

Uber Geek
+1 received by user: 322

ID Verified

Trusted

#1354845 29-Jul-2015 20:34

Ok what next? I've disconnected almost all devices in the house, shut down all computers, Apple TV, chromecast, printer, receiver with wifi, tv with wifi. Upon rebooting the router, three devices only connect. 2 x iPhones running iOS 8.4 and one iPad running iOS 8.3. Nothing else is connected via Ethernet or wifi.
And I still get an intrusion attempt after a couple of minutes after rebooting the router. Wtf is going on. What next, contact Spark?

Nov 19 00:00:59 daemon crit syslog: Received valid IP address from server. Connection UP.
Nov 19 00:03:26 daemon alert kernel: Intrusion -> IN=pppoa0 OUT= MAC= SRC=82.221.105.7 DST=122.57.187.189 LEN=40 TOS=0x08 PREC=0x00 TTL=109 ID=61585 PROTO=TCP SPT=34680 DPT=9080 WINDOW=43199 RES=0x00 SYN URGP=0 MARK=0x8000000

Excuse the incorrect date and time. Despite setting NZ time server pool it doesn't get the correct time.

RunningMan

9185 posts

Uber Geek
+1 received by user: 4838

#1354850 29-Jul-2015 20:57

Are the intrusion attempts actually causing a problem? May just be bots probing random IPs looking for vulnerabilities, and not related to your original problem.

ubergeeknz

3344 posts

Uber Geek
+1 received by user: 1041

Trusted

Vocus

#1354851 29-Jul-2015 20:58

josephhinvest: Ok what next? I've disconnected almost all devices in the house, shut down all computers, Apple TV, chromecast, printer, receiver with wifi, tv with wifi. Upon rebooting the router, three devices only connect. 2 x iPhones running iOS 8.4 and one iPad running iOS 8.3. Nothing else is connected via Ethernet or wifi.
And I still get an intrusion attempt after a couple of minutes after rebooting the router. Wtf is going on. What next, contact Spark?

Nov 19 00:00:59 daemon crit syslog: Received valid IP address from server. Connection UP.
Nov 19 00:03:26 daemon alert kernel: Intrusion -> IN=pppoa0 OUT= MAC= SRC=82.221.105.7 DST=122.57.187.189 LEN=40 TOS=0x08 PREC=0x00 TTL=109 ID=61585 PROTO=TCP SPT=34680 DPT=9080 WINDOW=43199 RES=0x00 SYN URGP=0 MARK=0x8000000

Excuse the incorrect date and time. Despite setting NZ time server pool it doesn't get the correct time.

Intrusion attempts are normal, you're on the Internet. Don't get hung up on it.

Please try disabling DNS proxy. I'm pretty sure it will help. Have seen this problem on NF4V.

Talkiet

4819 posts

Uber Geek
+1 received by user: 3934

Trusted

#1354853 29-Jul-2015 21:00

Why haven't you followed my advice to test if it's IP connectivity being interrupted or just at the application level (like DNS)?

Cheers - N

Please note all comments are from my own brain and don't necessarily represent the position or opinions of my employer, previous employers, colleagues, friends or pets.

Lego

Shop now for Lego sets and other gifts (affiliate link).

josephhinvest

1550 posts

Uber Geek
+1 received by user: 322

ID Verified

Trusted

#1354854 29-Jul-2015 21:01

ubergeeknz:
josephhinvest: Ok what next? I've disconnected almost all devices in the house, shut down all computers, Apple TV, chromecast, printer, receiver with wifi, tv with wifi. Upon rebooting the router, three devices only connect. 2 x iPhones running iOS 8.4 and one iPad running iOS 8.3. Nothing else is connected via Ethernet or wifi.
And I still get an intrusion attempt after a couple of minutes after rebooting the router. Wtf is going on. What next, contact Spark?

Nov 19 00:00:59 daemon crit syslog: Received valid IP address from server. Connection UP.
Nov 19 00:03:26 daemon alert kernel: Intrusion -> IN=pppoa0 OUT= MAC= SRC=82.221.105.7 DST=122.57.187.189 LEN=40 TOS=0x08 PREC=0x00 TTL=109 ID=61585 PROTO=TCP SPT=34680 DPT=9080 WINDOW=43199 RES=0x00 SYN URGP=0 MARK=0x8000000

Excuse the incorrect date and time. Despite setting NZ time server pool it doesn't get the correct time.

Intrusion attempts are normal, you're on the Internet. Don't get hung up on it.

Please try disabling DNS proxy. I'm pretty sure it will help. Have seen this problem on NF4V.

Ta, I have disabled the DNS proxy yesterday, no change.

josephhinvest

1550 posts

Uber Geek
+1 received by user: 322

ID Verified

Trusted

#1354856 29-Jul-2015 21:02

ubergeeknz:
josephhinvest: Ok what next? I've disconnected almost all devices in the house, shut down all computers, Apple TV, chromecast, printer, receiver with wifi, tv with wifi. Upon rebooting the router, three devices only connect. 2 x iPhones running iOS 8.4 and one iPad running iOS 8.3. Nothing else is connected via Ethernet or wifi.
And I still get an intrusion attempt after a couple of minutes after rebooting the router. Wtf is going on. What next, contact Spark?

Nov 19 00:00:59 daemon crit syslog: Received valid IP address from server. Connection UP.
Nov 19 00:03:26 daemon alert kernel: Intrusion -> IN=pppoa0 OUT= MAC= SRC=82.221.105.7 DST=122.57.187.189 LEN=40 TOS=0x08 PREC=0x00 TTL=109 ID=61585 PROTO=TCP SPT=34680 DPT=9080 WINDOW=43199 RES=0x00 SYN URGP=0 MARK=0x8000000

Excuse the incorrect date and time. Despite setting NZ time server pool it doesn't get the correct time.

Intrusion attempts are normal, you're on the Internet. Don't get hung up on it.

Please try disabling DNS proxy. I'm pretty sure it will help. Have seen this problem on NF4V.

Accepted that they are a normal part of life, but after rebooting modem, and getting a new IP address, is it reasonable to start getting these attempt after just a couple of minutes?

ubergeeknz

3344 posts

Uber Geek
+1 received by user: 1041

Trusted

Vocus

#1354857 29-Jul-2015 21:03

josephhinvest:
ubergeeknz:
josephhinvest: Ok what next? I've disconnected almost all devices in the house, shut down all computers, Apple TV, chromecast, printer, receiver with wifi, tv with wifi. Upon rebooting the router, three devices only connect. 2 x iPhones running iOS 8.4 and one iPad running iOS 8.3. Nothing else is connected via Ethernet or wifi.
And I still get an intrusion attempt after a couple of minutes after rebooting the router. Wtf is going on. What next, contact Spark?

Nov 19 00:00:59 daemon crit syslog: Received valid IP address from server. Connection UP.
Nov 19 00:03:26 daemon alert kernel: Intrusion -> IN=pppoa0 OUT= MAC= SRC=82.221.105.7 DST=122.57.187.189 LEN=40 TOS=0x08 PREC=0x00 TTL=109 ID=61585 PROTO=TCP SPT=34680 DPT=9080 WINDOW=43199 RES=0x00 SYN URGP=0 MARK=0x8000000

Excuse the incorrect date and time. Despite setting NZ time server pool it doesn't get the correct time.

Intrusion attempts are normal, you're on the Internet. Don't get hung up on it.

Please try disabling DNS proxy. I'm pretty sure it will help. Have seen this problem on NF4V.

Ta, I have disabled the DNS proxy yesterday, no change.

OK, that done, suggest starting a machine to ping both the router and something stable on the Internet (eg. 8.8.8.8 which is Google DNS) continuously to see where it's going wrong

josephhinvest

1550 posts

Uber Geek
+1 received by user: 322

ID Verified

Trusted

#1354860 29-Jul-2015 21:05

Talkiet: Why haven't you followed my advice to test if it's IP connectivity being interrupted or just at the application level (like DNS)?

Cheers - N

Ta for your advice. At this stage all proper computers connected to the network are turned off. The stalling issue seems to have abated for the time being and the only devices are 2 iPhones and one iPad (all now on 8.4).

Cheers,
Joseph

ubergeeknz

3344 posts

Uber Geek
+1 received by user: 1041

Trusted

Vocus

#1354887 29-Jul-2015 21:24

josephhinvest:
ubergeeknz:
josephhinvest: Ok what next? I've disconnected almost all devices in the house, shut down all computers, Apple TV, chromecast, printer, receiver with wifi, tv with wifi. Upon rebooting the router, three devices only connect. 2 x iPhones running iOS 8.4 and one iPad running iOS 8.3. Nothing else is connected via Ethernet or wifi.
And I still get an intrusion attempt after a couple of minutes after rebooting the router. Wtf is going on. What next, contact Spark?

Nov 19 00:00:59 daemon crit syslog: Received valid IP address from server. Connection UP.
Nov 19 00:03:26 daemon alert kernel: Intrusion -> IN=pppoa0 OUT= MAC= SRC=82.221.105.7 DST=122.57.187.189 LEN=40 TOS=0x08 PREC=0x00 TTL=109 ID=61585 PROTO=TCP SPT=34680 DPT=9080 WINDOW=43199 RES=0x00 SYN URGP=0 MARK=0x8000000

Excuse the incorrect date and time. Despite setting NZ time server pool it doesn't get the correct time.

Intrusion attempts are normal, you're on the Internet. Don't get hung up on it.

Please try disabling DNS proxy. I'm pretty sure it will help. Have seen this problem on NF4V.

Accepted that they are a normal part of life, but after rebooting modem, and getting a new IP address, is it reasonable to start getting these attempt after just a couple of minutes?

Yes. IP addresses are constantly being scanned. Unfortunately these swines have access to massive botnets, thanks to insecure websites, servers, and PCs

AliExpress

Shop now on AliExpress (affiliate link).

matisyahu

1639 posts

Uber Geek
+1 received by user: 355

Trusted

#1354899 29-Jul-2015 21:42

ubergeeknz:
josephhinvest:
ubergeeknz:
josephhinvest: Ok what next? I've disconnected almost all devices in the house, shut down all computers, Apple TV, chromecast, printer, receiver with wifi, tv with wifi. Upon rebooting the router, three devices only connect. 2 x iPhones running iOS 8.4 and one iPad running iOS 8.3. Nothing else is connected via Ethernet or wifi.
And I still get an intrusion attempt after a couple of minutes after rebooting the router. Wtf is going on. What next, contact Spark?

Nov 19 00:00:59 daemon crit syslog: Received valid IP address from server. Connection UP.
Nov 19 00:03:26 daemon alert kernel: Intrusion -> IN=pppoa0 OUT= MAC= SRC=82.221.105.7 DST=122.57.187.189 LEN=40 TOS=0x08 PREC=0x00 TTL=109 ID=61585 PROTO=TCP SPT=34680 DPT=9080 WINDOW=43199 RES=0x00 SYN URGP=0 MARK=0x8000000

Excuse the incorrect date and time. Despite setting NZ time server pool it doesn't get the correct time.

Intrusion attempts are normal, you're on the Internet. Don't get hung up on it.

Please try disabling DNS proxy. I'm pretty sure it will help. Have seen this problem on NF4V.

Accepted that they are a normal part of life, but after rebooting modem, and getting a new IP address, is it reasonable to start getting these attempt after just a couple of minutes?

Yes. IP addresses are constantly being scanned. Unfortunately these swines have access to massive botnets, thanks to insecure websites, servers, and PCs

Awww, that is pretty mean to pigs - at lest pigs provide delicious bacon where as these bot masters provide nothing beneficial to society :P

"When the people are being beaten with a stick, they are not much happier if it is called 'the People's Stick'"

BarTender

3629 posts

Uber Geek
+1 received by user: 2572

ID Verified

Trusted

Lifetime subscriber

#1355193 30-Jul-2015 12:02

josephhinvest:
Talkiet: Why haven't you followed my advice to test if it's IP connectivity being interrupted or just at the application level (like DNS)?

Cheers - N

Ta for your advice. At this stage all proper computers connected to the network are turned off. The stalling issue seems to have abated for the time being and the only devices are 2 iPhones and one iPad (all now on 8.4).

Cheers,
Joseph

That to me sounds very much like you have malware, or some untwoard application running on a machine that is killing your internet.

I wouldn't be surprised if it was a torrent client as they love to use random ports. Or just some generic grade of malware.

Switch each machine on systematically until you find the culprit and........

josephhinvest

1550 posts

Uber Geek
+1 received by user: 322

ID Verified

Trusted

#1355292 30-Jul-2015 13:53

BarTender:
josephhinvest:
Talkiet: Why haven't you followed my advice to test if it's IP connectivity being interrupted or just at the application level (like DNS)?

Cheers - N

Ta for your advice. At this stage all proper computers connected to the network are turned off. The stalling issue seems to have abated for the time being and the only devices are 2 iPhones and one iPad (all now on 8.4).

Cheers,
Joseph

That to me sounds very much like you have malware, or some untwoard application running on a machine that is killing your internet.

I wouldn't be surprised if it was a torrent client as they love to use random ports. Or just some generic grade of malware.

Switch each machine on systematically until you find the culprit and........

Yep it's possible, the only torrents are done on a brand new Mac mini using Transmission. I don't think any malware has crept onto the machine but will check.
I'm still confused about the port scanning. Would be interested if another Spark customer could examine their logs an see if they are getting continuously scanned like me?

Talkiet

4819 posts

Uber Geek
+1 received by user: 3934

Trusted

#1355293 30-Jul-2015 13:55

josephhinvest:
BarTender:
josephhinvest:
Talkiet: Why haven't you followed my advice to test if it's IP connectivity being interrupted or just at the application level (like DNS)?

Cheers - N

Ta for your advice. At this stage all proper computers connected to the network are turned off. The stalling issue seems to have abated for the time being and the only devices are 2 iPhones and one iPad (all now on 8.4).

Cheers,
Joseph

That to me sounds very much like you have malware, or some untwoard application running on a machine that is killing your internet.

I wouldn't be surprised if it was a torrent client as they love to use random ports. Or just some generic grade of malware.

Switch each machine on systematically until you find the culprit and........

Yep it's possible, the only torrents are done on a brand new Mac mini using Transmission. I don't think any malware has crept onto the machine but will check.
I'm still confused about the port scanning. Would be interested if another Spark customer could examine their logs an see if they are getting continuously scanned like me?

Being scanned on a public broadband IP is completely expected and normal, unfortunately. Unless you are receiving meaningful amounts of traffic (hundreds of connections per second, sustained) then it's pretty likely to be normal.

Cheers - N

Please note all comments are from my own brain and don't necessarily represent the position or opinions of my employer, previous employers, colleagues, friends or pets.

1 | 2 | 3