cancel
Showing results for 
Search instead for 
Did you mean: 

disconnects and wierd event log messages

alanalpha
Dabbler
Posts: 22
Registered: ‎24-07-2016

disconnects and wierd event log messages

i normaly never notice disconnects since getting fibre but saw one 2 days ago but couldnt find it in the event log on my router

just had another one now and got this on the event log

 

03:03:54, 04 Dec. (948448.310000) CWMP: session closed due to error: Could not resolve host
03:03:54, 04 Dec. (948448.290000) CWMP: Server URL: https://pbthdm.bt.mo; Connecting as user: ACS username
03:03:54, 04 Dec. (948448.290000) CWMP: Session start now. Event code(s): '4 VALUE CHANGE'
03:03:54, 04 Dec. (948448.020000) CWMP: Initializing transaction for event code 4 VALUE CHANGE
03:03:52, 04 Dec. (948446.550000) PTM over DSL is down after 2884 minutes uptime
03:03:52, 04 Dec. (948446.550000) PPPoE is down after 2883 minutes uptime [Waiting for Underlying Connection (WAN Ethernet 7 -​ Down)]
03:03:50, 04 Dec.

(948443.810000) PPP LCP Send Termination Request [User request]

 

 

question is what is the item with user request?

i was in an online game and had been for hours i didnt (and haddnt) touched my router settings since the last disconnect 

 

also after reconnecting im getting these in the event log

03:07:15, 04 Dec. BLOCKED 1 more packets (because of Packet invalid in connection)
03:07:14, 04 Dec. IN: BLOCK [9] Packet invalid in connection (tcp reset attack is suspected: TCP [212.159.3.147]:443-​>[150.143.224.123]:53835 on ppp3)
03:07:14, 04 Dec. BLOCKED 4 more packets (because of Packet invalid in connection)
03:07:13, 04 Dec. BLOCKED 1 more packets (because of Packet invalid in connection)
03:07:12, 04 Dec. IN: BLOCK [9] Packet invalid in connection (tcp reset attack is suspected: TCP [212.159.8.2]:443-​>[150.143.224.123]:53860 on ppp3)
03:07:07, 04 Dec. OUT: BLOCK [9] Packet invalid in connection (Invalid tcp flags for current tcp state: TCP [192.168.1.64]:53816-​>[5.62.54.83]:80 on ppp3)
03:07:06, 04 Dec. OUT: BLOCK [65] First packet is Invalid (Invalid tcp flags for current tcp state: TCP [192.168.1.64]:53816-​>[5.62.54.83]:80 on ppp3)
03:06:43, 04 Dec. OUT: BLOCK [9] Packet invalid in connection (Invalid tcp flags for current tcp state: TCP [192.168.1.64]:53820-​>[178.249.97.70]:443 on ppp3)
03:06:38, 04 Dec. OUT: BLOCK [65] First packet is Invalid (Invalid tcp flags for current tcp state: TCP [192.168.1.64]:53820-​>[178.249.97.70]:443 on ppp3)
03:06:06, 04 Dec. IN: BLOCK [9] Packet invalid in connection (tcp reset attack is suspected: TCP [212.159.8.2]:443-​>[150.143.224.123]:53780 on ppp3)
03:05:58, 04 Dec.

IN: BLOCK [9] Packet invalid in connection (Invalid tcp flags for current tcp state: TCP [192.124.249.41]:80-​>[150.143.224.123]:53798 on ppp3)

 

any ideas?

3 REPLIES 3
alanalpha
Dabbler
Posts: 22
Registered: ‎24-07-2016

Re: disconnects and wierd event log messages

didnt even last a full 24 hours b4 the next disconnect (atleast this time i wasnt ingame or streaming on twitch)

 

event logs

00:48:34, 05 Dec. (1026728.390000) CWMP: session closed due to error: Could not resolve host
00:48:34, 05 Dec. (1026728.370000) CWMP: Server URL: https://pbthdm.bt.mo; Connecting as user: ACS username
00:48:34, 05 Dec. (1026728.370000) CWMP: Session start now. Event code(s): '4 VALUE CHANGE'
00:48:34, 05 Dec. (1026728.100000) CWMP: Initializing transaction for event code 4 VALUE CHANGE
00:48:32, 05 Dec. (1026726.630000) PTM over DSL is down after 1304 minutes uptime
00:48:32, 05 Dec. (1026726.630000) PPPoE is down after 1303 minutes uptime [Waiting for Underlying Connection (WAN Ethernet 7 -​ Down)]
00:48:30, 05 Dec. (1026723.890000) PPP LCP Send Termination Request [User request]
23:40:49, 04 Dec. IN: BLOCK [9] Packet invalid in connection (Invalid tcp flags for current tcp state: TCP [213.123.252.73]:80-​>[150.143.224.123]:56574 on ppp3)
23:16:34, 04 Dec. BLOCKED 1 more packets (because of Packet invalid in connection)
23:16:32, 04 Dec. IN: BLOCK [9] Packet invalid in connection (Invalid tcp flags for current tcp state: TCP [216.58.213.3]:443-​>[150.143.224.123]:56420 on ppp3)
23:16:28, 04 Dec. IN: BLOCK [9] Packet invalid in connection (Invalid tcp flags for current tcp state: TCP [172.217.16.227]:443-​>[150.143.224.123]:56409 on ppp3)
23:16:27, 04 Dec. IN: BLOCK [9] Packet invalid in connection (Invalid tcp flags for current tcp state: TCP [142.250.178.1]:443-​>[150.143.224.123]:56408 on ppp3)
23:16:19, 04 Dec. IN: BLOCK [9] Packet invalid in connection (Invalid tcp flags for current tcp state: TCP [130.211.30.54]:443-​>[150.143.224.123]:56391 on ppp3)
23:16:17, 04 Dec. IN: BLOCK [9] Packet invalid in connection (Invalid tcp flags for current tcp state: TCP [142.250.200.4]:443-​>[150.143.224.123]:56390 on ppp3)
23:16:17, 04 Dec. BLOCKED 1 more packets (because of Packet invalid in connection)

 

 

is my hub starting to kick the bucket? is there an issue at the local exchange or green box at the top of my road? am i being portscanned for an attack?

jab1
Legend
Posts: 19,061
Thanks: 6,244
Fixes: 287
Registered: ‎24-02-2012

Re: disconnects and wierd event log messages

@alanalpha You do have a problem, but the LAN tab of your event log doesn't really help here. For any Community member to try and help, the WAN tab is much more helpful, along with (1) the result of the 'Additional Diagnostics' report from BTW Performance Tester , and (2) your Hubs Help Desk page, with personal detail obscured.

BTW, you are not under attack, those 'BLOCK' entries merely indicate that the Hub is doing what it is designed to do and BLOCKING unsolicited attempts at at entry - everyone gets them.

John
TheMightyAJ
Plusnet Alumni (retired)
Plusnet Alumni (retired)
Posts: 2,511
Fixes: 126
Registered: ‎26-03-2018

Re: disconnects and wierd event log messages

Hey @alanalpha, I'm sorry to see that you're experiencing issues with the connection dropping out. I've had a look into the account this morning and upon testing your line I've discovered that there's potentially a fault with the equipment in the property. Have you had a chance to carry out any troubleshooting checks yet and if so, what have you tried? My biggest recommendation right now would be to set the router up within the test socket of the property, which we have a guide on here.

If this post resolved your issue please click the 'This fixed my problem' button
 Alex H
 Plusnet Help Team