Member Avatar for manchurianCEO

Hi all,

I have att internet (not u-verse) just the internet servie with a 2wire modem-router combo. I'm sick and tired of seeing on my computer that the connection was lost just way too often, every 3 or 5 minutes. I went to check on the logs and I see there's a big amount of this:

fw,fwmon: src=173.166.234.189 dst=99.4.104.116 ipprot=6 sport=34557 dport=3389 Unknown inbound session stopped
fw,fwmon: src=173.166.234.189 dst=99.4.104.116 ipprot=6 sport=25842 dport=3389 Unknown inbound session stopped

it goes on and on...

I can't find enough informatin about it. I don't have any p2p programs in my computer so that is ruled out.

Is this something happening with my computer or am I being persistently attacked or anyone knows what is it?

Thank you for your help!

Edited by manchurianCEO
  • 2 Contributors
  • 2 Replies
  • 277 Views
  • 14 Hours Discussion Span
  • Latest Post Latest Post by manchurianCEO

Dani AI

Generated

The router log lines you posted show your gateway blocking unsolicited TCP attempts to port 3389 (Remote Desktop). That pattern is extremely common on any public IP — wide internet scanners/probes hitting RDP — and the router message "Unknown inbound session stopped" usually just records that the firewall dropped those attempts. Those probes by themselves usually do not cause regular 3–5 minute link drops.

Where the drops come from: intermittent disconnects that frequent are most often a physical/DSL sync or PPPoE issue, or router firmware/hardware instability. As suggested, neighborhood/trunk wiring or a flaky demarc can produce exactly this symptom. Treat the firewall log as useful context, but not proof of the root cause.

Practical, ordered checks

  • Verify whether any device on the LAN is actually exposing RDP. Check the router's Port Forwarding/NAT rules and disable any 3389 forwards. On Windows you can check listeners with:
    netstat -ano | findstr :3389
  • Check the gateway status page or logs for DSL sync, SNR margin and line attenuation or PPP reconnect entries. Note timestamps of every disconnect and save the router log.
  • Temporarily disable UPnP and remote-management, change the router admin password, and update firmware.
  • Isolate the problem: connect a single, known-good computer directly to the modem (or replace the modem/router temporarily) to see if drops persist. If they stop, the issue is internal equipment or wiring.
  • If inbound attempts persist from the same external IPs, do an IP lookup and block persistent abusive addresses, but prioritize fixing the underlying drop.

If DSL/PPP sync events line up with your disconnects, escalate to the ISP with exact timestamps and saved logs and ask for a line test to the demarc/central office. If there is no DSL sync evidence, swap the gateway or test another router to rule out failing hardware.

Security note: do not expose RDP to the Internet. Use a VPN, jump host, or at minimum change default ports and enforce strong authentication.

Recommended Answers

All 2 Replies

Member Avatar for rubberman

I have att internet (DSL) also. When this happens, it is usually due to a problem with the trunk wiring in the neighborhood. Call tech support and have them dispatch a service technician to fix it. ATT support office people have tools to check the health of the link to your location, so they can tell if there is a physical issue (or other) to deal with. You know that old saw - the sqeeky wheel gets the grease! :-)

Member Avatar for manchurianCEO

I see, thank you for that info. I just don't want them inside my house. See, I used to have both phone and internet with them but then I got vonage and the day they cut the phone line, they also cut the internet (oops they said). Once they got it back on, magically my internet started having issues. They were very uncooperative about it over the phone, always pushing for a paid visit inside to change wires.

They did in fact schedule the visits, five technicians came inside the house and found nothing wrong. Yet the people on the phone kept pushing for an issue inside in order to have me pay $100 dollars. Completely opposite to what each technician told me. After the fifth technician, I called att again and that's when I was "suggested" I should get my phone back with them in order to get that issue fixed, I remember the rep. saying "just saying, sounds logical... no?". That's when I filed a complain with the Better Business Bureau. It all sounded just way off, haven't finished my bachelor's in computer science but this didn't smell right.

Next day after filing the complain, ATT called me saying they were sending a technician again to see what was going on. The technician and an area supervisor dropped by.

This time, they magically realized the wall jack wasn't good... Same tools, same procedure, but I guess their other five technicians had faulty testers. They changed the jack and the internet came back to normal for a few months.

Of course the wall jack thing was pure BS, clearly a cover up. But just sharing my story with the world just in case it happens to anyone else.

Thanks!

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.