Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Router not working....some kind of networking problem?


  • Please log in to reply
35 replies to this topic

#1 computermaniac666

computermaniac666

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Local time:09:49 PM

Posted 22 November 2015 - 09:56 PM

Hey I have a dilemma concerning my router. I am posting here because I don't think it's a hardware issue, though I could be wrong...

 

 

I have a Belkin Wireless Belkin G Plus MIMO Router and an Arris TM802 cable modem. Everything has been working fine with this setup for years. I have the router hooked up to the modem obviously, and my PC plugged into the router. Everyone else in the house uses the wireless signal.

Today my connection starts dropping randomly. I get a message that says there is an IP conflict with devices on the network. I believe I have gotten this before, but the wonky connection issues went away and everything went back to normal so I ignored it.

A couple of hours later and my connection is messed up and not coming back. I'm looking at the modem and router, and it seems the router gets a connection and then suddenly resets, with the "looking for connection" light pattern going (each light on the router lights up individually). Eventually it gets a connection with the modem again but it only lasts 5 seconds before restarting.

Tried the usual resetting of everything. Restored factory settings. I had my MAC address changed so I cloned my machine and reset that. Reset the router's power. Etc etc. Problem still not solved. Switched out and tried 4 different CAT-5 cables. Still the same thing.

When I simply directly connect my PC to my router, everything is fine. I can get into the router's settings. If I try to get into the router's settings while it is connected to my modem, it doesn't work.

Now I am connected directly from my PC to my modem and everything is working fine. So it's not the modem per se....and I don't think it's the router. It sounds like some kind of network problem. But it's not just a wireless issue either since when my PC is connected physically, it still does not work.

Any ideas on what to do and if the IP conflict is a big hint? Thanks in advance...


Edited by hamluis, 24 November 2015 - 11:55 AM.
Moved from Win 7 to External Hardware - Hamluis.


BC AdBot (Login to Remove)

 


#2 technonymous

technonymous

  • Members
  • 2,480 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:07:49 PM

Posted 22 November 2015 - 10:24 PM

What is the model number of the router? I could look it up and check it's vulnerabilities. It could be someone near by attacking it. It could just be a bad router. Does it have logging? Some of these older routers will not log those types of attacks. Newer routers have a more robust logging, access control, online nic/wifi monitoring, mac filtering access and WPS lockout attempt features. An IP conflict and router resetting is a sign of unauthorized access.



#3 computermaniac666

computermaniac666
  • Topic Starter

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Local time:09:49 PM

Posted 22 November 2015 - 10:32 PM

The model number is F5D9230-4.

 

 Does it have logging? Some of these older routers will not log those types of attacks. Newer routers have a more robust logging, access control, online nic/wifi monitoring, mac filtering access and WPS lockout attempt features. An IP conflict and router resetting is a sign of unauthorized access.

 

I am not sure where to find the logging. I checked the firewall log and I didn't see anything. The network I was using was password secured if that matters.

 

Would the attack be coming from someone nearby using the wifi signal or from a remote location?



#4 technonymous

technonymous

  • Members
  • 2,480 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:07:49 PM

Posted 22 November 2015 - 10:38 PM

The logging would be under administration or something similar. Even though you have logging it may not log access or attacks. Is sounds like a older router. The attack can be coming from either. Someone attacking the routers wifi that is within range of the wifi. Or it could be someone attacking the modem not router remotely exploiting a flaw in the modem somehow. I'll search both and see what I can dig up.


Edited by technonymous, 22 November 2015 - 10:39 PM.


#5 computermaniac666

computermaniac666
  • Topic Starter

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Local time:09:49 PM

Posted 22 November 2015 - 10:44 PM

What would be the point of attacking the router remotely though? Also, if I don't have sharing enabled on my PC, how likely is it they had access to my files/system? I can't speak for anyone else in the house but I use Windows Defender and stay off suspicious sites. Would a drive wipe and re-install of Win 7 be necessary in this instance?

 

BTW thank you for the help so far.



#6 technonymous

technonymous

  • Members
  • 2,480 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:07:49 PM

Posted 22 November 2015 - 10:54 PM

You mean modem? A modem can have a flaw in it just as easily as a router.



#7 technonymous

technonymous

  • Members
  • 2,480 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:07:49 PM

Posted 22 November 2015 - 10:59 PM

What would be the point of attacking the router remotely though? Also, if I don't have sharing enabled on my PC, how likely is it they had access to my files/system? I can't speak for anyone else in the house but I use Windows Defender and stay off suspicious sites. Would a drive wipe and re-install of Win 7 be necessary in this instance?

 

BTW thank you for the help so far.

The whole point of attacking the router is to get on the local network and then exploit vulnerabilities further. LIke network shares, exploiting the OS to gain access to the system, using that system to attack others etc. It's a difficult process, but it can be done. A hacker may never get that far it depends on how patched and how secure the system are on the local lan. If you have a older XP computer on the network or something not so secure, they could attack that system take control of it and use it to attack yours. The first line of defense is the router and securing patching it.



#8 technonymous

technonymous

  • Members
  • 2,480 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:07:49 PM

Posted 22 November 2015 - 11:01 PM

What version of firmware is the router? You can login to it and check the version it should say on the status page in the corner.



#9 computermaniac666

computermaniac666
  • Topic Starter

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Local time:09:49 PM

Posted 22 November 2015 - 11:12 PM

Firmware ver is 5.01.16

 

I checked "Security Log"...only log I could find. Didn't see any other computers that had logged on recently but it looks like the log has also been reset since I've restarted the router a few times...There is a single XP computer on our network, but I have not enabled any sharing of computers on this network. Not sure if that would help.



#10 technonymous

technonymous

  • Members
  • 2,480 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:07:49 PM

Posted 22 November 2015 - 11:15 PM

Ok looking at the WPS vulnerability listing it doesn't show your model. Yours probably was never tested at the time of this list made. The list is outdated. So your router could still have a WSP that is flawed. The Belkin Models:

 

FD1301 v1

F7D2301 v1

F9k1001 v1

F9k1105 v1

 

I did find that your specific model may have a Authorization Bypass vulnerability in it. So you need to upgrade it's firmware to latest.



#11 technonymous

technonymous

  • Members
  • 2,480 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:07:49 PM

Posted 22 November 2015 - 11:18 PM

Firmware ver is 5.01.16

 

I checked "Security Log"...only log I could find. Didn't see any other computers that had logged on recently but it looks like the log has also been reset since I've restarted the router a few times...There is a single XP computer on our network, but I have not enabled any sharing of computers on this network. Not sure if that would help.

No it doesn't matter if the XP is sharing or not. The entire OS is a hackers dream come true. LOL. You need to take it off your network and sandbox it.


That looks like the latest firmware that you have.



#12 computermaniac666

computermaniac666
  • Topic Starter

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Local time:09:49 PM

Posted 22 November 2015 - 11:25 PM

OK so if I have the latest firmware what is my next move to remedy this and protect myself? How do i determine what the problem is?

 

If I solve the problem, is a full drive wipe and re-install on my end completely necessary as a precaution?



#13 technonymous

technonymous

  • Members
  • 2,480 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:07:49 PM

Posted 22 November 2015 - 11:26 PM

See what happens is you setup your router with gateway ip 192.168.1.1 and the network to 192.168.1.50 to 192.168.1.254 all the wifi and wired pc's will pull a IP from range .50 to .254 Your wired pc you may setup to be static and below the .50 for dhcp. So you set a static IP 192.168.1.2 and then some hacker comes along hacks your routers wifi and they set their IP static 192.168.1.2 and you get a message of the conflict. The router knows nothing and see's nothing and never logs it. A newer router would not have this problem. i suggest ditching this router and buying a Netgear. like the Wndr4300 and above. Be sure it is above 4300 models if you want Gbit on the 5 port lan/wan.


Edited by technonymous, 22 November 2015 - 11:40 PM.


#14 technonymous

technonymous

  • Members
  • 2,480 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:07:49 PM

Posted 22 November 2015 - 11:28 PM

I wouldn't worry to much about the Win 7 and above systems. However, the XP could have. I strongly suggest looking it over and run a barrage of virus scans etc on everything.



#15 computermaniac666

computermaniac666
  • Topic Starter

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Local time:09:49 PM

Posted 22 November 2015 - 11:29 PM

See what happens is you setup your router with gateway ip 192.168.1.1 and the network to 192.168.1.50 to 192.168.1.254 all the wifi pc's will pull a IP from range .50 to .254 You wired pc you may setup to be static and below the .50 for dhcp. So you set a static IP 192.168.1.2 and then some hacker comes along hacks your routers wifi and they set their IP static 192.168.1.2 and you get a message of the conflict. The router knows nothing and see's nothing and never logs it. A newer router would not have this problem. i suggest ditching this router and buying a Netgear. like the Wndr4300 and above. Be sure it is above 4300 models if you want Gbit on the 5 port lan/wan.

 

Is it likely this is what happened? Some of this stuff is over my head a bit. Would changing my MAC address do anything at this point? Any precautions/remedies I can try in the meantime while finding another router?






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users