Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I've got a weird problem. Every so often my rooter (a Thomson TG585 v8 running version 8.2.7.8 of it's firmware) reboots itself.

It seems to be associated with this message in the event log:

FIREWALL replay check (1 of 2): Protocol: ICMP Src ip: 183.178.144.177 Dst ip: xxx.xxx.xxx.xxx Type: Destination Unreachable Code: Host Unreacheable

xxx.xxx.xxx.xxx is my external IP address

183.178.144.177 resolves to 183178144177.ctinets.com

We've got a student from Hong Kong staying with us at the moment and the reboots seem coincidental with him starting up his laptop. I say this because a check on ctinets.com shows it to be based in Hong Kong, though our guest's laptop doesn't appear to have any software related to this company installed. I say "apparently" as he is running the Chinese version of Windows and his English doesn't cover technical subjects like this.

I know this is an incoming message but I was assuming that it was in response to something on the student's laptop which is why the first thought was malware, but we've got anti virus on all the other machines and have run malwarebytes on his with a negative result so I don't think the problem is due to a virus or (known) trojan.

What else can I do to stop this and identify the cause?

share|improve this question

2 Answers 2

up vote 1 down vote accepted

I have just found this support page on my ISP's web site.

Basically it seems that the wireless N interface between certain makes of laptop and the router is incompatible.

The solution is to disable wireless N either on the router or the laptop.

share|improve this answer
    
It didn't help that I was searching for "Thompson" rather than "Thomson" and so these pages didn't show up when I first looked into this. –  ChrisF Oct 9 '12 at 7:45

As you told on chat (well, did you verify his words?) it's not because of his boots, let's see further...


Hong Kong Baptist University has this IP in their logs, you can see the name of the university in the title of the page. Dissecting the URL we see that in the cmtstats directory there is mentioned that:

User Services Section,
Office of Information Technology,  
Hong Kong Baptist Univesity 

This is most likely your student visiting the site of the university; or if the laptop / software was provided through the university, it might be some sort of authentication / talk-back-home. Worst case he is being tracked, but with software like Wireshark and Process Monitor you can check if more is going on than just saying "hey". But that's all assuming he isn't visiting the website...


What's also interesting is this:

FIREWALL replay check (1 of 2):
    Protocol: ICMP
    Src ip: 183.178.144.177
    Dst ip: xxx.xxx.xxx.xxx
    Type: Destination
    Unreachable Code: Host Unreacheable

That's not his laptop talking to the university, but that's the university talking to his laptop. ICMP is most likely to be a ping, but I wonder if this ping would actually be the cause. I haven't heard about a service so simple as pinging allowing to take down the router.

But, the real question is, is this a request or a reply and is there some kind of flooding occuring?

Wireshark can tell you that; router packet monitoring, if the router is capable of that, can do that too.


Assuming the reboots didn't happen from the moment the student came, there could be a variety of reasons the router is rebooting. Bad power, unstable hardware, unstable software, ...

So, it might be interesting to see if you can somehow correlate if it's since the student came around; if a few reboots of his laptop force it, if a few connection disabling and enabling triggers it, if it requires another computer or laptop in the network to be also connected.

Also, write down events (machine boots / shutdowns, router reboot) for a few days; that'll allow you to maybe figure out a pattern. It might tell you the difference between "it might be coincidentally" and "it happens twice a day". Our router has an annoying problem that it reboots once a day, and we haven't come around to have found a fix for it yet; it's annoying, but as it reboots in under a half minute (well, it runs DD-WRT) it's acceptable.

Whatever you do; analyze and document it, it'll speed up discovery of the cause.

share|improve this answer
    
Yeah I know it's an incoming packet, but I was assuming that it was initiated by his laptop coming online (or him opening a program). The problem is definitely related to the student's arrival. We had speed issues (largely related to two children wanting to play League of Legends and the third streaming video) but not these reboots. –  ChrisF Sep 17 '12 at 7:50

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.