FIbre Support

Get expert support with your Fibre connection.

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Intrusion Detected + Rebooting Constantly

Steve Brewster
First Timer
Message 6 of 6

I believe that my internet connection is under attack.

 

The router itself keeps rebooting, and shortly after reconnecting to the internet it reboots again.

If I disconnect the phone cable from the back of the router it boots and remains stable enough for me to use internal resources.

The logs on my router are constantly full of intrusion warnings.

 

i.e.

 

2021-11-15 10:20:39 Security Warning Intrusion -> src=144.76.224.215 DST=79.66.38.161 LEN=40 TOS=0x00 PREC=0x00 TTL=246 ID=20618 PROTO=TCP SPT=51590 DPT=3389 WINDOW
2021-11-15 10:10:29 Security Warning Intrusion -> src=185.191.34.207 DST=79.66.38.161 LEN=40 TOS=0x00 PREC=0x00 TTL=245 ID=62522 PROTO=TCP SPT=49688 DPT=3320 WINDOW
2021-11-15 10:00:37 Security Warning Intrusion -> src=89.248.165.97 DST=79.66.38.161 LEN=40 TOS=0x00 PREC=0x00 TTL=249 ID=24961 PROTO=TCP SPT=47247 DPT=24900 WINDOW
2021-11-15 09:50:23 Security Warning Intrusion -> src=185.191.34.205 DST=79.66.38.161 LEN=40 TOS=0x00 PREC=0x00 TTL=244 ID=12969 PROTO=TCP SPT=46163 DPT=366 WINDOW
2021-11-15 09:41:47 Security Warning Intrusion -> src=89.248.165.166 DST=79.66.38.161 LEN=40 TOS=0x00 PREC=0x00 TTL=249 ID=48840 PROTO=TCP SPT=47223 DPT=23519 WINDOW
2021-11-15 09:41:29 Security Warning Intrusion -> src=45.146.165.248 DST=79.66.38.161 LEN=40 TOS=0x00 PREC=0x00 TTL=245 ID=29210 PROTO=TCP SPT=41083 DPT=43389 WINDOW
2021-11-15 09:40:50 Security Warning Intrusion -> src=193.163.125.61 DST=79.66.38.161 LEN=44 TOS=0x00 PREC=0x00 TTL=246 ID=52716 PROTO=TCP SPT=43846 DPT=4524 WINDOW
2021-11-15 09:40:36 Security Warning Intrusion -> src=92.63.197.71 DST=79.66.38.161 LEN=40 TOS=0x00 PREC=0x00 TTL=250 ID=61627 PROTO=TCP SPT=47017 DPT=33890 WINDOW
 
My router is the HG633 running firmware v2.00t
0 Likes
5 REPLIES 5

Message 1 of 6

Hi Steve

 

The router is on its way, please allow 24-48hrs for this to arrive.

 

Let us know how the connection compares with this router.

 

Thanks

 

Debbie

0 Likes

Message 2 of 6

It doesn't do it all the time, but occasionally we get nights like Sunday when the router just continually reboots and the logs are flooded with intrusion detection warnings.

When it happens it is almost like someone is pressing the restart button on the router itself. All of the lights except for the power go out and the system slowly reboots over the next 60 or so seconds. About 10 or 20 seconds after the "internet" light goes green, it reboots again. repeat ad nauseam...

The only way to stop it seems to be to physically disconnect the broadband cable from the phone line and leave it off for a few hours.

It almost feels like someone is attacking the router/IP address and the router is either rebooting in response, or someone is breaching it and causing it to reboot. If I disconnect for a few hours then the DHCP lease on my IP address expires and I can safely re-connect.

0 Likes

Message 3 of 6

Yes please. I have had this same router for since I opened the account about 5 or more years ago. I am guessing it's a bit old now.

0 Likes

Debbie-TalkTalk
Support Team
Message 4 of 6

Hi Steve

 

Sorry for the delay.

 

Would you like me to send a different router for testing?

 

Thanks

 

Debbie

0 Likes

Skynet_TX
Community Star
Message 5 of 6

Hi @Steve Brewster,

 

The Intrusion detection is likely nothing to worry about, that is just your router logging the fact that its built in firewall has blocked some incoming traffic. This is a perfectly normal thing and will be happening all the time to everyone, not all routers show it so clearly in their logs, but the HG633 does show these.

 

When you say the router is rebooting, can you describe exactly what the lights do, does the power light actually go out, or is it just the 'broadband' and 'internet' lights that go out ?.

 

It would be worth going to the Service Centre to run a connection test on your line, this will indicate if there is currently a fault affecting your service. You can also access this from the ‘My Account’ site.

 

Also, if you have a landline phone can you check to see if that is working normally (i.e. you have a clear dial tone and no noise on the line).

 

If your master phone socket has a test socket then you could also try the router in there, that would then eliminate any of the phone wiring in your home as being a possible cause of the problem.

 

The TalkTalk staff on this community will be able to help, they will hopefully be able to respond to this post tomorrow.

0 Likes