[RESOLVED] Router reboots when I connect this machine

[Galaxy_Stranger]

Help! VERY weird problem - when I plug in my CentOS 6.6 PC to my network, my cable modem/router reboots itself. This started happening right about the time I got a new IP address from my Internet provider. This machine normally has a static IP address, (I'm currently using whatever the DHCP server is giving me right now so I can figure out what's going on).

I don't THINK it's a damaged hardware problem - I've tested things out while using the machine with a boot cd and while disabling networking in KDE and I had no network problems. The only time I have network problems is when I boot to the OS on the drive.

I've never heard of this problem before. Has anyone ever seen this? I'm thinking it's some sort of configuration issue, but I don't know where to start. Anybody have any ideas where to begin?

[aks]

Perhaps start with logs on both the CentOS machine and the router? Tghat might give us a clue. I suppose you could also capture packets to see what's going on, but that is a last resort.

Please post logs, then maybe we might have a clue.

[Galaxy_Stranger]

Which log files do I need to post?

I presume /var/log is the only location of pertanent log files.

[TrevorH]

Are you sure you haven't assigned the same IP address to your CentOS machine that's already in use by the router?

[aks]

Router log: whatever log(s) the router has.
Centos log: dmesg (so dmesg >> dmesg.out) and /var/log/messages

An IP address clash should not reboot a machine (unless the NIC driver is extremely buggy) - the interface should just be down.

[Galaxy_Stranger]

My router's Firewall log has tons of entries of IPs hitting me:

Code: Select all

UDP Packet - Source:90.44.55.25,48664 Destination:98.201.77.14,51413, 21:24:31, 2015-01-08	[DOS] Logs
UDP Packet - Source:46.121.130.249,12274 Destination:98.201.77.14,51413, 21:24:31, 2015-01-08	[DOS] Logs

My router's System log has this:

Code: Select all

udhcpd: DHCP server started, 21:16:32, 2015-01-08	[System] Logs
udhcpd: DHCP server stopped, 21:16:28, 2015-01-08	[System] Logs
dhcp6: DHCPv6 server started, 21:16:15, 2015-01-08	[System] Logs
dhcp6: DHCPv6 server stopped, 21:16:14, 2015-01-08	[System] Logs
dhcp6: DHCPV6 client started, 21:16:12, 2015-01-08	[System] Logs
dhcp6: DHCPv6 server stopped, 21:16:07, 2015-01-08	[System] Logs

The rest are DHCP requests, both IPv4 and IPv6.

And there was NOTHING in the event log.

[aks]

Yeah nothing there shines any light. The router is at 192.168.1.1 and your machine always seems to get allocated the address 192.168.1.10.
I noticed several of these:
Jan 5 22:44:51 deimos kernel: nf_conntrack: table full, dropping packet.
and these:
Jan 6 21:06:02 deimos abrt[4480]: Saved core dump of pid 3833 (/usr/bin/ksmserver) to /var/spool/abrt/ccpp-2015-01-06-21:06:02-3833 (30425088 bytes)
Jan 6 21:06:02 deimos avahi-daemon[2083]: Got SIGTERM, quitting.
Jan 7 00:13:41 deimos abrt[16244]: Saved core dump of pid 3093 (/usr/bin/knotify4) to /var/spool/abrt/ccpp-2015-01-07-00:13:40-3093 (102985728 bytes)
Jan 7 00:13:41 deimos abrtd: Directory 'ccpp-2015-01-07-00:13:40-3093' creation detected
Jan 7 00:13:41 deimos abrtd: Size of '/var/spool/abrt' >= 1000 MB, deleting 'ccpp-2015-01-02-01:30:55-3140'
Jan 7 00:13:41 deimos abrtd: Got signal 15, exiting
Jan 7 00:31:40 deimos abrt[8307]: Saved core dump of pid 3135 (/usr/bin/knotify4) to /var/spool/abrt/ccpp-2015-01-07-00:31:40-3135 (102879232 bytes)
Jan 7 00:31:40 deimos abrtd: Directory 'ccpp-2015-01-07-00:31:40-3135' creation detected
Jan 7 00:31:41 deimos abrtd: Size of '/var/spool/abrt' >= 1000 MB, deleting 'ccpp-2015-01-07-00:13:40-3093'
Jan 7 00:31:41 deimos abrtd: Got signal 15, exiting

I particularly liked this one:
Jan 8 21:11:01 deimos pcscd: pcscdaemon.c:581:signal_trap() Preparing for suicide

So it suggests that some service starting on your machine is sending packet(s) to the router that floods the router? Some info from the router would really help. I'd suggest switching off as many services as you can (like avahi, ntp, nisplus etc.) and see if that cures the problem. Perhaps packet capture to get a feel of the size (amount) of data being sent.

[Galaxy_Stranger]

Thanks for the reply.

Ok, I've shut off some services and I'm still having router issues. What I posted of the router logs is all it will give me - and it's all the same, over and over again. I found out that my router DOES take a dump exactly like this with too many connections.

So it looks like I need to do some packet sniffing. How do I go about doing that?

[TrevorH]

Sounds more like you have a router problem and your next step should be to look for a firmware update for it and failing that, a new router!

[aks]

Packet capturing is not for the faint of heart. Is your machine the only machine on the network and is it directly connected to the router? If it is I guess you could capture on your machine. Use wireshark and/or tcpdump. Personally I like wireshark's GUI. Have a look at http://wiki.wireshark.org/CaptureSetup for more capture information. Once you've done that you'd then have to analyze the conversations also note the time that the router reboots so you might be able to find the packet(s) sent just before the router reboots. If you're not seeing a lot of traffic then either you're not seeing all the traffic and are on a switched network (see the above link) or your router is to lame to route the small amount of traffic you're sending - in which case the router is really quite broken.
Perhaps do as Trevor suggested first, update the firmware on the router.