RT-AC1200 Stopped functioning Randomly

[Sean X Torres]

RT-AC1200
Firmware Version: 3.0.0.4.380_9474

--

We had an issue this afternoon that took our Control room machine connection to the inventory server, down.

A restart seemed to fix the issue but I am unaware at the moment if they did a hard reset or if the router reset it's self.

Jul  9 20:07:43 rc_service: ntp 336:notify_rc restart_upnp
Jul  9 20:07:43 miniupnpd[335]: shutting down MiniUPnPd
Jul  9 20:07:43 miniupnpd[346]: version 1.9 started
Jul  9 20:07:43 miniupnpd[346]: HTTP listening on port 54695
Jul  9 20:07:43 miniupnpd[346]: Listening for NAT-PMP/PCP traffic on port 5351
Jul  9 20:07:44 kernel: DROP IN=vlan2 OUT= MAC=4c:ed:fb:d7:9a:84:b0:6e:bf:e4:af:e4:08:00:45:00:01:18 SRC=104.25.254.31 DST=192.168.50.53 LEN=280 TOS=0x00 PREC=0x00 TTL=52 ID=28677 DF PROTO=TCP SPT=443 DPT=58705 SEQ=2055662914 ACK=1124357327 WINDOW=511 RES=0x00 ACK PSH URGP=0
Jul  9 20:07:45 kernel: DROP IN=vlan2 OUT= MAC=4c:ed:fb:d7:9a:84:b0:6e:bf:e4:af:e4:08:00:45:00:00:56 SRC=52.72.41.54 DST=192.168.50.53 LEN=86 TOS=0x00 PREC=0x00 TTL=234 ID=41714 DF PROTO=TCP SPT=443 DPT=64750 SEQ=1558129737 ACK=3960486338 WINDOW=769 RES=0x00 ACK PSH URGP=0
Jul  9 20:07:45 kernel: DROP IN=vlan2 OUT= MAC=4c:ed:fb:d7:9a:84:b0:6e:bf:e4:af:e4:08:00:45:00:00:47 SRC=52.72.41.54 DST=192.168.50.53 LEN=71 TOS=0x00 PREC=0x00 TTL=234 ID=41715 DF PROTO=TCP SPT=443 DPT=64750 SEQ=1558129783 ACK=3960486338 WINDOW=769 RES=0x00 ACK PSH URGP=0
Jul  9 20:07:45 kernel: DROP IN=vlan2 OUT= MAC=4c:ed:fb:d7:9a:84:b0:6e:bf:e4:af:e4:08:00:45:00:03:61 SRC=173.194.67.125 DST=192.168.50.53 LEN=865 TOS=0x00 PREC=0x00 TTL=103 ID=31005 PROTO=TCP SPT=5222 DPT=55032 SEQ=3207109774 ACK=3380163460 WINDOW=1339 RES=0x00 ACK PSH URGP=0

This goes on for a bit...

Jul  9 20:10:36 kernel: DROP IN=vlan2 OUT= MAC=ff:ff:ff:ff:ff:ff:d8:50:e6:3f:b5:7b:08:00:45:00:00:4e SRC=192.168.50.167 DST=192.168.50.255 LEN=78 TOS=0x00 PREC=0x00 TTL=128 ID=6231 PROTO=UDP SPT=137 DPT=137 LEN=58
Jul  9 20:10:36 kernel: DROP IN=vlan2 OUT= MAC=ff:ff:ff:ff:ff:ff:d8:50:e6:3f:b5:7b:08:00:45:00:00:4e SRC=192.168.50.167 DST=192.168.50.255 LEN=78 TOS=0x00 PREC=0x00 TTL=128 ID=6232 PROTO=UDP SPT=137 DPT=137 LEN=58
Jul  9 20:11:37 kernel: DROP IN=vlan2 OUT= MAC=ff:ff:ff:ff:ff:ff:d8:50:e6:3f:b5:7b:08:00:45:00:00:4e SRC=192.168.50.167 DST=192.168.50.255 LEN=78 TOS=0x00 PREC=0x00 TTL=128 ID=6233 PROTO=UDP SPT=137 DPT=137 LEN=58
Jul  9 20:11:38 kernel: DROP IN=vlan2 OUT= MAC=ff:ff:ff:ff:ff:ff:d8:50:e6:3f:b5:7b:08:00:45:00:00:4e SRC=192.168.50.167 DST=192.168.50.255 LEN=78 TOS=0x00 PREC=0x00 TTL=128 ID=6234 PROTO=UDP SPT=137 DPT=137 LEN=58
Jul  9 20:11:39 kernel: DROP IN=vlan2 OUT= MAC=ff:ff:ff:ff:ff:ff:d8:50:e6:3f:b5:7b:08:00:45:00:00:4e SRC=192.168.50.167 DST=192.168.50.255 LEN=78 TOS=0x00 PREC=0x00 TTL=128 ID=6235 PROTO=UDP SPT=137 DPT=137 LEN=58
Jul  9 20:11:45 kernel: DROP IN=vlan2 OUT= MAC=ff:ff:ff:ff:ff:ff:38:60:77:39:44:e2:08:00:45:00:00:4e SRC=192.168.50.110 DST=192.168.50.255 LEN=78 TOS=0x00 PREC=0x00 TTL=128 ID=11394 PROTO=UDP SPT=137 DPT=137 LEN=58
Jul  9 20:11:45 kernel: DROP IN=vlan2 OUT= MAC=ff:ff:ff:ff:ff:ff:38:60:77:39:44:e2:08:00:45:00:00:4e SRC=192.168.50.110 DST=192.168.50.255 LEN=78 TOS=0x00 PREC=0x00 TTL=128 ID=11395 PROTO=UDP SPT=137 DPT=137 LEN=58
Jul  9 20:11:46 kernel: DROP IN=vlan2 OUT= MAC=ff:ff:ff:ff:ff:ff:38:60:77:39:44:e2:08:00:45:00:00:4e SRC=192.168.50.110 DST=192.168.50.255 LEN=78 TOS=0x00 PREC=0x00 TTL=128 ID=11396 PROTO=UDP SPT=137 DPT=137 LEN=58
Jul  9 20:11:49 miniupnpd[346]: upnp_event_recv: recv(): Connection reset by peer

Another interesting bit

Jul  9 01:28:56 kernel: DROP IN=vlan2 OUT= MAC=ff:ff:ff:ff:ff:ff:d8:50:e6:3f:b5:7b:08:00:45:00:00:4e SRC=192.168.50.167 DST=192.168.50.255 LEN=78 TOS=0x00 PREC=0x00 TTL=128 ID=12044 PROTO=UDP SPT=137 DPT=137 LEN=58 
Jul  9 01:28:56 kernel: DROP IN=vlan2 OUT= MAC=ff:ff:ff:ff:ff:ff:d8:50:e6:3f:b5:7b:08:00:45:00:00:4e SRC=192.168.50.167 DST=192.168.50.255 LEN=78 TOS=0x00 PREC=0x00 TTL=128 ID=12045 PROTO=UDP SPT=137 DPT=137 LEN=58 
Jul  9 01:29:58 kernel: DROP IN=vlan2 OUT= MAC=ff:ff:ff:ff:ff:ff:d8:50:e6:3f:b5:7b:08:00:45:00:00:4e SRC=192.168.50.167 DST=192.168.50.255 LEN=78 TOS=0x00 PREC=0x00 TTL=128 ID=12046 PROTO=UDP SPT=137 DPT=137 LEN=58 
Jul  9 01:29:59 kernel: DROP IN=vlan2 OUT= MAC=ff:ff:ff:ff:ff:ff:d8:50:e6:3f:b5:7b:08:00:45:00:00:4e SRC=192.168.50.167 DST=192.168.50.255 LEN=78 TOS=0x00 PREC=0x00 TTL=128 ID=12047 PROTO=UDP SPT=137 DPT=137 LEN=58 
Jul  9 01:29:59 kernel: DROP IN=vlan2 OUT= MAC=ff:ff:ff:ff:ff:ff:d8:50:e6:3f:b5:7b:08:00:45:00:00:4e SRC=192.168.50.167 DST=192.168.50.255 LEN=78 TOS=0x00 PREC=0x00 TTL=128 ID=12048 PROTO=UDP SPT=137 DPT=137 LEN=58 
Aug  1 00:00:16 syslogd started: BusyBox v1.17.4
Aug  1 00:00:16 kernel: klogd started: BusyBox v1.17.4 (2017-03-20 11:48:28 CST)
Aug  1 00:00:16 kernel: Linux version 2.6.36 (root@asus) (gcc version 4.6.3 (Buildroot 2012.11.1) ) #1 Mon Mar 20 11:52:54 CST 2017
Aug  1 00:00:16 kernel:  The CPU feqenuce set to 580 MHz
Aug  1 00:00:16 kernel: Zone PFN ranges:
Aug  1 00:00:16 kernel:   Normal   0x00000000 -> 0x00004000
Aug  1 00:00:16 kernel: Movable zone start PFN for each node
Aug  1 00:00:17 kernel: partion 3: ffffffff eb0000
Aug  1 00:00:17 kernel: partion 4: 17c640 d839c0
Aug  1 00:00:17 kernel: #add mtd partition#
Aug  1 00:00:17 kernel: Creating 7 MTD partitions on "raspi":
Aug  1 00:00:17 kernel: 0x000000000000-0x000000030000 : "Bootloader"
Aug  1 00:00:17 kernel: 0x000000030000-0x000000040000 : "nvram"
Aug  1 00:00:17 kernel: 0x000000040000-0x000000050000 : "Factory"
Aug  1 00:00:17 kernel: 0x000000050000-0x000000f00000 : "linux"
Aug  1 00:00:17 kernel: 0x00000017c640-0x000000f00000 : "rootfs"
Aug  1 00:00:17 kernel: 0x000000f00000-0x000001000000 : "jffs2"
Aug  1 00:00:17 kernel: 0x000000000000-0x000001000000 : "ALL"
...
Aug  1 00:00:39 kernel: DROP IN=vlan2 OUT= MAC=4c:ed:fb:d7:9a:84:b0:6e:bf:e4:af:e4:08:00:45:00:01:18 SRC=104.25.254.31 DST=192.168.50.53 LEN=280 TOS=0x00 PREC=0x00 TTL=52 ID=28675 DF PROTO=TCP SPT=443 DPT=58705 SEQ=2055662914 ACK=1124357327 WINDOW=511 RES=0x00 ACK PSH URGP=0
Aug  1 00:00:39 miniupnpd[335]: version 1.9 started
Aug  1 00:00:39 miniupnpd[335]: HTTP listening on port 34272
Aug  1 00:00:39 miniupnpd[335]: Listening for NAT-PMP/PCP traffic on port 5351
Aug  1 00:00:39 kernel: DROP IN=vlan2 OUT= MAC=4c:ed:fb:d7:9a:84:b0:6e:bf:e4:af:e4:08:00:45:00:01:18 SRC=104.25.254.31 DST=192.168.50.53 LEN=280 TOS=0x00 PREC=0x00 TTL=52 ID=28676 DF PROTO=TCP SPT=443 DPT=58705 SEQ=2055662914 ACK=1124357327 WINDOW=511 RES=0x00 ACK PSH URGP=0
Aug  1 00:00:39 dhcp client: bound 192.168.50.53 via 192.168.50.1 during 86400 seconds.
Aug  1 00:00:39 kernel: DROP IN=vlan2 OUT= MAC=ff:ff:ff:ff:ff:ff:00:26:f2:b6:b7:77:08:00:45:00:01:48 SRC=0.0.0.0 DST=255.255.255.255 LEN=328 TOS=0x00 PREC=0x00 TTL=128 ID=27940 PROTO=UDP SPT=68 DPT=67 LEN=308
Aug  1 00:00:39 kernel: DROP IN=vlan2 OUT= MAC=4c:ed:fb:d7:9a:84:b0:6e:bf:e4:af:e4:08:00:45:00:00:47 SRC=54.187.190.63 DST=192.168.50.53 LEN=71 TOS=0x00 PREC=0x00 TTL=229 ID=59896 DF PROTO=TCP SPT=443 DPT=61774 SEQ=322819389 ACK=2202403686 WINDOW=118 RES=0x00 ACK PSH URGP=0
Aug  1 00:00:39 WAN Connection: WAN was restored.
Aug  1 00:00:39 ntp: start NTP update
Jul  9 20:07:43 rc_service: ntp 336:notify_rc restart_upnp
Jul  9 20:07:43 miniupnpd[335]: shutting down MiniUPnPd
Jul  9 20:07:43 miniupnpd[346]: version 1.9 started
Jul  9 20:07:43 miniupnpd[346]: HTTP listening on port 54695
Jul  9 20:07:43 miniupnpd[346]: Listening for NAT-PMP/PCP traffic on port 5351

 

[ColinTaylor]

A restart seemed to fix the issue but I am unaware at the moment if they did a hard reset or if the router reset it's self.

Probably just easiest to ask them what they did.

But my guess is that they just turned it off and on because it still appears to be logging all dropped packets which AFAIK is not a default setting. Personally I wouldn't recommend that (logging all dropped packets) because it serves no purpose other than filling up the log file and obscuring genuine errors.

 

[Sean X Torres]

They hard reset it. My issue is the amount of Dropped Packets (4 every second) and figuring out why the router stopped working while on.

Apparently, it is not the first time this has happened either...You know if end users would just report issues instead of just dealing with it.

Anyway, my initial concern was someone trying to break into the router and with some more research indicates that probably isn't the case.

So I'm going to update the firmware, turn off UPnP and keep an eye on it unless someone has any recommendations.

Thank you for your reply.