Господа, помогите решить уже невыносимую ситуацию:
есть модем D-Link dsl-2500U/BRU/D, в режиме роутера. провайдер укртелеком. Буквально с середины августа начались проблемы, которые не поддаются никакому обьяснению. Примерно каждый час инет начал обрыватся, но обрыв весьма странный: не работает ничегго, нельзя зайти на любой интерент ресурс но пинг IP этих ресурсов эсть без никаких потерь. Проблема решалась ребутом непосредственно модема.
После изменения настроек подключения виндовс (а именно вписал альтернативный DNS-сервер в настройки) проблема не решилась, но уже для возобновления интернета ребутить модем не нужно. Через 2-3 минуты он сам востанавливался.
Все, что я могу предоставить - лог модема, в котором даная ситуация повторяется три раза на протяжении часа:
читать дальше »
System Log
Date/Time Facility Severity Message
Jan 1 19:10:19 user alert kernel: Intrusion -> IN=ppp_0_1_32_1 OUT= MAC= SRC=91.124.174.33 DST=92.112.164.56 LEN=48 TOS=0x00 PREC=0x00 TTL=126 ID=27190 DF PROTO=TCP SPT=3538 DPT=35939 WINDOW=65535 RES=0x00 SYN URGP=0
Jan 1 19:19:21 user alert kernel: Intrusion -> IN=ppp_0_1_32_1 OUT= MAC= SRC=91.124.174.33 DST=92.112.164.56 LEN=48 TOS=0x00 PREC=0x00 TTL=126 ID=24046 DF PROTO=TCP SPT=4495 DPT=35939 WINDOW=65535 RES=0x00 SYN URGP=0
Jan 1 19:26:30 user debug syslog: echo 0 > /var/isdft_cfg
Jan 1 19:26:32 user debug syslog: echo 0 > /var/isdft_cfg
Jan 1 19:27:03 user alert kernel: Intrusion -> IN=ppp_0_1_32_1 OUT= MAC= SRC=88.81.236.66 DST=92.112.164.56 LEN=48 TOS=0x00 PREC=0x00 TTL=120 ID=34761 DF PROTO=TCP SPT=50696 DPT=35939 WINDOW=65535 RES=0x00 SYN URGP=0
Jan 1 19:27:06 user alert kernel: Intrusion -> IN=ppp_0_1_32_1 OUT= MAC= SRC=88.81.236.66 DST=92.112.164.56 LEN=48 TOS=0x00 PREC=0x00 TTL=120 ID=34795 DF PROTO=TCP SPT=50696 DPT=35939 WINDOW=65535 RES=0x00 SYN URGP=0
Jan 1 19:27:21 user debug syslog: echo 0 > /var/isdft_cfg
Jan 1 19:27:37 user alert kernel: Intrusion -> IN=ppp_0_1_32_1 OUT= MAC= SRC=92.112.142.21 DST=92.112.164.56 LEN=48 TOS=0x00 PREC=0x00 TTL=126 ID=52275 DF PROTO=TCP SPT=4006 DPT=445 WINDOW=64800 RES=0x00 SYN URGP=0
Jan 1 19:27:40 user alert kernel: Intrusion -> IN=ppp_0_1_32_1 OUT= MAC= SRC=92.112.142.21 DST=92.112.164.56 LEN=48 TOS=0x00 PREC=0x00 TTL=126 ID=52811 DF PROTO=TCP SPT=4006 DPT=445 WINDOW=64800 RES=0x00 SYN URGP=0
Jan 1 19:28:09 user alert kernel: Intrusion -> IN=ppp_0_1_32_1 OUT= MAC= SRC=91.124.174.33 DST=92.112.164.56 LEN=48 TOS=0x00 PREC=0x00 TTL=126 ID=15205 DF PROTO=TCP SPT=1489 DPT=35939 WINDOW=65535 RES=0x00 SYN URGP=0
Jan 1 19:28:12 user alert kernel: Intrusion -> IN=ppp_0_1_32_1 OUT= MAC= SRC=91.124.174.33 DST=92.112.164.56 LEN=48 TOS=0x00 PREC=0x00 TTL=126 ID=15549 DF PROTO=TCP SPT=1489 DPT=35939 WINDOW=65535 RES=0x00 SYN URGP=0
Jan 1 19:28:13 user alert kernel: Intrusion -> IN=ppp_0_1_32_1 OUT= MAC= SRC=221.39.106.14 DST=92.112.164.56 LEN=64 TOS=0x00 PREC=0x00 TTL=34 ID=14525 DF PROTO=TCP SPT=58862 DPT=25216 WINDOW=65535 RES=0x00 SYN URGP=0
Jan 1 19:37:38 user alert kernel: Intrusion -> IN=ppp_0_1_32_1 OUT= MAC= SRC=89.178.9.47 DST=92.112.164.56 LEN=52 TOS=0x00 PREC=0x00 TTL=115 ID=17452 DF PROTO=TCP SPT=1917 DPT=35939 WINDOW=65535 RES=0x00 SYN URGP=0
Jan 1 19:44:19 user debug syslog: ethctl vport query 2>/var/vcfgerr
Jan 1 19:44:20 user debug syslog: rm /var/vcfgerr
Jan 1 19:44:23 user crit kernel: OAM loopback response not received on PORT/VPI/VCI 0/1/32.
Jan 1 19:44:24 user crit kernel: OAM loopback response not received on PORT/VPI/VCI 0/1/32.
Jan 1 19:44:25 user debug syslog: ping 195.5.5.184
Jan 1 19:44:25 user debug syslog: ping 195.5.46.12
Jan 1 19:44:44 user debug syslog: ethctl vport query 2>/var/vcfgerr
Jan 1 19:44:45 user debug syslog: rm /var/vcfgerr
Jan 1 19:44:47 user crit kernel: OAM loopback response not received on PORT/VPI/VCI 0/1/32.
Jan 1 19:44:48 user crit kernel: OAM loopback response not received on PORT/VPI/VCI 0/1/32.
Jan 1 19:44:49 user debug syslog: ping 195.5.5.184
Jan 1 19:44:49 user debug syslog: ping 195.5.46.12
Jan 1 19:48:01 user alert kernel: Intrusion -> IN=ppp_0_1_32_1 OUT= MAC= SRC=80.93.122.1 DST=92.112.164.56 LEN=48 TOS=0x00 PREC=0x00 TTL=123 ID=45358 DF PROTO=TCP SPT=2112 DPT=35939 WINDOW=65535 RES=0x00 SYN URGP=0
Jan 1 19:57:40 user alert kernel: Intrusion -> IN=ppp_0_1_32_1 OUT= MAC= SRC=92.112.15.120 DST=92.112.164.56 LEN=48 TOS=0x00 PREC=0x00 TTL=127 ID=13437 DF PROTO=TCP SPT=3582 DPT=135 WINDOW=64800 RES=0x00 SYN URGP=0
Jan 1 20:00:22 syslog info -- MARK --
Jan 1 20:02:39 daemon info pppd[248]: No response to 3 echo-requests
Jan 1 20:02:39 daemon notice pppd[248]: Serial link appears to be disconnected.
Jan 1 20:02:40 daemon info pppd[248]: Connect time 53.6 minutes.
Jan 1 20:02:40 daemon info pppd[248]: Sent 4087487 bytes, received 48362834 bytes.
Jan 1 20:02:43 daemon warn pppd[248]: Couldn't increase MRU to 1500
Jan 1 20:02:49 user debug syslog: kill -9 4823
Jan 1 20:02:49 user debug syslog: echo > /var/hosts
Jan 1 20:02:50 daemon notice pppd[248]: Connection terminated....
Jan 1 20:02:55 daemon info pppd[248]: Sent PADT
Jan 1 20:02:55 daemon info pppd[248]: PPP session is 6299
Jan 1 20:02:55 daemon info pppd[248]: Using interface ppp0_1_32_1
Jan 1 20:02:56 daemon notice pppd[248]: Connect: ppp_0_1_32_1 <--> nas_0_1_32
Jan 1 20:02:56 daemon warn pppd[248]: Couldn't increase MRU to 1500
Jan 1 20:02:57 daemon notice pppd[248]: PAP authentication succeeded
Jan 1 20:02:57 daemon notice pppd[248]: peer from calling number 00:90:1A:42:AC:CD authorized
Jan 1 20:02:57 daemon notice pppd[248]: local IP address 92.113.101.137
Jan 1 20:02:57 daemon notice pppd[248]: remote IP address 195.5.5.203
Jan 1 20:02:57 daemon notice pppd[248]: primary DNS address 195.5.46.12
Jan 1 20:02:57 daemon notice pppd[248]: secondary DNS address 195.5.46.10
Jan 1 20:03:04 user debug syslog: route add default gw 195.5.5.203 2>/dev/null
Jan 1 20:03:05 user debug syslog: iptables -A FORWARD -o ppp_0_1_32_1 -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
Jan 1 20:03:05 user debug syslog: iptables -A FORWARD -i ppp_0_1_32_1 -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
Jan 1 20:03:05 user debug syslog: iptables -t nat -D POSTROUTING -o ppp_0_1_32_1 -s 192.168.68.0/255.255.255.0 -j MASQUERADE 2>/dev/null
Jan 1 20:03:05 user debug syslog: iptables -t nat -A POSTROUTING -o ppp_0_1_32_1 -s 192.168.68.0/255.255.255.0 -j MASQUERADE
Jan 1 20:03:07 user alert kernel: Intrusion -> IN=ppp_0_1_32_1 OUT= MAC= SRC=92.113.239.59 DST=92.113.101.137 LEN=48 TOS=0x00 PREC=0x00 TTL=126 ID=19149 DF PROTO=TCP SPT=4571 DPT=445 WINDOW=64800 RES=0x00 SYN URGP=0
Jan 1 20:03:09 user debug syslog: iptables -I INPUT 1 -p icmp --icmp-type echo-request -i ppp_0_1_32_1 -j ACCEPT
Jan 1 20:03:11 user alert kernel: Intrusion -> IN=ppp_0_1_32_1 OUT= MAC= SRC=92.113.239.59 DST=92.113.101.137 LEN=48 TOS=0x00 PREC=0x00 TTL=126 ID=20192 DF PROTO=TCP SPT=4571 DPT=445 WINDOW=64800 RES=0x00 SYN URGP=0
Jan 1 20:03:30 user alert kernel: Intrusion -> IN=ppp_0_1_32_1 OUT= MAC= SRC=92.113.239.59 DST=92.113.101.137 LEN=48 TOS=0x00 PREC=0x00 TTL=126 ID=27234 DF PROTO=TCP SPT=3853 DPT=445 WINDOW=64800 RES=0x00 SYN URGP=0
Jan 1 20:03:31 user alert kernel: Intrusion -> IN=ppp_0_1_32_1 OUT= MAC= SRC=92.113.15.234 DST=92.113.101.137 LEN=48 TOS=0x00 PREC=0x00 TTL=126 ID=934 DF PROTO=TCP SPT=29567 DPT=135 WINDOW=64800 RES=0x00 SYN URGP=0
Jan 1 20:03:32 user alert kernel: Intrusion -> IN=ppp_0_1_32_1 OUT= MAC= SRC=92.113.239.59 DST=92.113.101.137 LEN=48 TOS=0x00 PREC=0x00 TTL=126 ID=28338 DF PROTO=TCP SPT=3853 DPT=445 WINDOW=64800 RES=0x00 SYN URGP=0
Jan 1 20:03:37 user alert kernel: Intrusion -> IN=ppp_0_1_32_1 OUT= MAC= SRC=92.113.95.187 DST=92.113.101.137 LEN=52 TOS=0x00 PREC=0x00 TTL=63 ID=23028 DF PROTO=TCP SPT=13323 DPT=445 WINDOW=60352 RES=0x00 SYN URGP=0
Jan 1 20:13:24 user alert kernel: Intrusion -> IN=ppp_0_1_32_1 OUT= MAC= SRC=92.113.62.192 DST=92.113.101.137 LEN=48 TOS=0x00 PREC=0x00 TTL=126 ID=7482 DF PROTO=TCP SPT=1783 DPT=445 WINDOW=64800 RES=0x00 SYN URGP=0
Jan 1 20:23:26 user alert kernel: Intrusion -> IN=ppp_0_1_32_1 OUT= MAC= SRC=92.113.189.42 DST=92.113.101.137 LEN=60 TOS=0x00 PREC=0x00 TTL=62 ID=59515 DF PROTO=TCP SPT=2301 DPT=23 WINDOW=5808 RES=0x00 SYN URGP=0
Jan 1 20:33:58 user alert kernel: Intrusion -> IN=ppp_0_1_32_1 OUT= MAC= SRC=92.113.105.148 DST=92.113.101.137 LEN=48 TOS=0x00 PREC=0x00 TTL=127 ID=10380 DF PROTO=TCP SPT=3607 DPT=135 WINDOW=64800 RES=0x00 SYN URGP=0
Jan 1 20:35:24 user crit kernel: ADSL link down
Jan 1 20:35:25 user crit kernel: ADSL G.994 training
Jan 1 20:35:25 user debug syslog: echo > /var/hosts
Jan 1 20:35:26 daemon notice pppd[248]: Terminating connection due to link down.
Jan 1 20:35:26 daemon info pppd[248]: Connect time 32.5 minutes.
Jan 1 20:35:26 daemon info pppd[248]: Sent 2091853 bytes, received 90636423 bytes.
Jan 1 20:35:27 daemon warn pppd[248]: Couldn't increase MRU to 1500
Jan 1 20:35:33 daemon notice pppd[248]: Connection terminated....
Jan 1 20:35:53 user crit kernel: ADSL G.992 started
Jan 1 20:35:56 user crit kernel: ADSL G.992 channel analysis
Jan 1 20:36:00 user crit kernel: ADSL G.992 message exchange
Jan 1 20:36:01 user crit kernel: ADSL link up, interleaved, us=608, ds=2464
Jan 1 20:36:03 user debug syslog: iptables -t nat -A PREROUTING -i br0 -d 192.168.68.1 -p udp --dport 53 -j DNAT --to 128.9.0.107
Jan 1 20:36:05 daemon info pppd[248]: Sent PADT
Jan 1 20:36:10 daemon info pppd[248]: Sent PADT
Jan 1 20:36:20 daemon info pppd[248]: Sent PADT
Jan 1 20:36:40 daemon warn pppd[248]: Timeout waiting for PADO packets
Jan 1 20:36:40 daemon err pppd[248]: Unable to complete PPPoE Discovery
Jan 1 20:36:43 daemon info pppd[248]: Sent PADT
Jan 1 20:36:43 daemon info pppd[248]: PPP session is 11628
Jan 1 20:36:43 daemon info pppd[248]: Using interface ppp0_1_32_1
Jan 1 20:36:43 daemon notice pppd[248]: Connect: ppp_0_1_32_1 <--> nas_0_1_32
Jan 1 20:36:43 daemon warn pppd[248]: Couldn't increase MRU to 1500
Jan 1 20:36:44 daemon notice pppd[248]: PAP authentication succeeded
Jan 1 20:36:44 daemon notice pppd[248]: peer from calling number 00:90:1A:42:AC:CD authorized
Jan 1 20:36:44 daemon notice pppd[248]: local IP address 92.113.71.53
Jan 1 20:36:44 daemon notice pppd[248]: remote IP address 195.5.5.203
Jan 1 20:36:44 daemon notice pppd[248]: primary DNS address 195.5.46.12
Jan 1 20:36:44 daemon notice pppd[248]: secondary DNS address 195.5.46.10
Jan 1 20:36:46 user debug syslog: route add default gw 195.5.5.203 2>/dev/null
Jan 1 20:36:46 user debug syslog: iptables -A FORWARD -o ppp_0_1_32_1 -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
Jan 1 20:36:47 user debug syslog: iptables -A FORWARD -i ppp_0_1_32_1 -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
Jan 1 20:36:47 user debug syslog: echo > /proc/net/ip_conntrack
Jan 1 20:36:47 user debug syslog: echo "1000" > /proc/sys/net/ipv4/ip_conntrack_max
Jan 1 20:36:47 user debug syslog: iptables -t nat -D PREROUTING -i br0 -d 192.168.68.1 -p udp --dport 53 -j DNAT --to 128.9.0.107 2>/dev/null
Jan 1 20:36:47 user debug syslog: iptables -t nat -D POSTROUTING -o ppp_0_1_32_1 -s 192.168.68.0/255.255.255.0 -j MASQUERADE 2>/dev/null
Jan 1 20:36:47 user debug syslog: iptables -t nat -A POSTROUTING -o ppp_0_1_32_1 -s 192.168.68.0/255.255.255.0 -j MASQUERADE
Jan 1 20:36:47 user debug syslog: echo > /var/hosts
Jan 1 20:36:50 user debug syslog: iptables -I INPUT 1 -p icmp --icmp-type echo-request -i ppp_0_1_32_1 -j ACCEPT
Jan 1 20:36:52 user alert kernel: Intrusion -> IN=ppp_0_1_32_1 OUT= MAC= SRC=92.113.198.196 DST=92.113.71.53 LEN=48 TOS=0x00 PREC=0x00 TTL=126 ID=55171 DF PROTO=TCP SPT=4195 DPT=445 WINDOW=64800 RES=0x00 SYN URGP=0
Jan 1 20:36:58 user alert kernel: Intrusion -> IN=ppp_0_1_32_1 OUT= MAC= SRC=195.58.233.186 DST=92.113.71.53 LEN=48 TOS=0x00 PREC=0x00 TTL=121 ID=17438 DF PROTO=TCP SPT=5554 DPT=27013 WINDOW=65535 RES=0x00 SYN URGP=0
Jan 1 20:37:01 user alert kernel: Intrusion -> IN=ppp_0_1_32_1 OUT= MAC= SRC=195.58.233.186 DST=92.113.71.53 LEN=48 TOS=0x00 PREC=0x00 TTL=121 ID=17466 DF PROTO=TCP SPT=5554 DPT=27013 WINDOW=65535 RES=0x00 SYN URGP=0
Jan 1 20:37:07 user alert kernel: Intrusion -> IN=ppp_0_1_32_1 OUT= MAC= SRC=58.215.93.30 DST=92.113.71.53 LEN=40 TOS=0x00 PREC=0x00 TTL=107 ID=256 PROTO=TCP SPT=6000 DPT=2967 WINDOW=16384 RES=0x00 SYN URGP=0
Jan 1 20:37:36 user alert kernel: Intrusion -> IN=ppp_0_1_32_1 OUT= MAC= SRC=92.113.186.54 DST=92.113.71.53 LEN=48 TOS=0x00 PREC=0x00 TTL=125 ID=18933 DF PROTO=TCP SPT=63033 DPT=135 WINDOW=16384 RES=0x00 SYN URGP=0
Jan 1 20:47:17 user alert kernel: Intrusion -> IN=ppp_0_1_32_1 OUT= MAC= SRC=195.58.233.186 DST=92.113.71.53 LEN=48 TOS=0x00 PREC=0x00 TTL=121 ID=34403 DF PROTO=TCP SPT=2689 DPT=27013 WINDOW=65535 RES=0x00 SYN URGP=0
Jan 1 20:57:09 user alert kernel: Intrusion -> IN=ppp_0_1_32_1 OUT= MAC= SRC=92.113.111.15 DST=92.113.71.53 LEN=48 TOS=0x00 PREC=0x00 TTL=126 ID=40825 DF PROTO=TCP SPT=50544 DPT=135 WINDOW=16384 RES=0x00 SYN URGP=0
Jan 1 21:00:22 syslog info -- MARK --
Jan 1 21:06:54 user alert kernel: Intrusion -> IN=ppp_0_1_32_1 OUT= MAC= SRC=78.16.181.101 DST=92.113.71.53 LEN=48 TOS=0x00 PREC=0x00 TTL=110 ID=64971 DF PROTO=TCP SPT=2405 DPT=37133 WINDOW=64512 RES=0x00 SYN URGP=0
Jan 1 21:17:44 daemon info pppd[248]: No response to 3 echo-requests
Jan 1 21:17:44 daemon notice pppd[248]: Serial link appears to be disconnected.
Jan 1 21:17:45 daemon info pppd[248]: Connect time 41.1 minutes.
Jan 1 21:17:45 daemon info pppd[248]: Sent 545665 bytes, received 3715052 bytes.
Jan 1 21:17:47 daemon warn pppd[248]: Couldn't increase MRU to 1500
Jan 1 21:17:54 daemon notice pppd[248]: Connection terminated....
Jan 1 21:17:55 user debug syslog: kill -9 5789
Jan 1 21:17:56 user debug syslog: echo > /var/hosts
Jan 1 21:17:59 daemon info pppd[248]: Sent PADT
Jan 1 21:18:04 daemon info pppd[248]: Sent PADT
Jan 1 21:18:04 daemon info pppd[248]: PPP session is 1962
Jan 1 21:18:05 daemon info pppd[248]: Using interface ppp0_1_32_1
Jan 1 21:18:05 daemon notice pppd[248]: Connect: ppp_0_1_32_1 <--> nas_0_1_32
Jan 1 21:18:05 daemon warn pppd[248]: Couldn't increase MRU to 1500
Jan 1 21:18:06 daemon notice pppd[248]: PAP authentication succeeded
Jan 1 21:18:06 daemon notice pppd[248]: peer from calling number 00:90:1A:42:B0:14 authorized
Jan 1 21:18:06 daemon notice pppd[248]: local IP address 92.112.33.107
Jan 1 21:18:06 daemon notice pppd[248]: remote IP address 195.5.5.184
Jan 1 21:18:06 daemon notice pppd[248]: primary DNS address 195.5.46.12
Jan 1 21:18:06 daemon notice pppd[248]: secondary DNS address 195.5.46.10
Jan 1 21:18:09 user debug syslog: route add default gw 195.5.5.184 2>/dev/null
Jan 1 21:18:09 user debug syslog: iptables -A FORWARD -o ppp_0_1_32_1 -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
Jan 1 21:18:10 user debug syslog: iptables -A FORWARD -i ppp_0_1_32_1 -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
Jan 1 21:18:10 user debug syslog: iptables -t nat -D POSTROUTING -o ppp_0_1_32_1 -s 192.168.68.0/255.255.255.0 -j MASQUERADE 2>/dev/null
Jan 1 21:18:11 user debug syslog: iptables -t nat -A POSTROUTING -o ppp_0_1_32_1 -s 192.168.68.0/255.255.255.0 -j MASQUERADE
Jan 1 21:18:12 user debug syslog: iptables -I INPUT 1 -p icmp --icmp-type echo-request -i ppp_0_1_32_1 -j ACCEPT
или вот файл лога:
http://www.mediafire.com/download.php?4lrnyozpdji
обрыв интернета описан строками:
Jan 1 20:02:39 daemon info pppd[248]: No response to 3 echo-requests
Jan 1 20:02:39 daemon notice pppd[248]: Serial link appears to be disconnected.
Jan 1 20:02:40 daemon info pppd[248]: Connect time 53.6 minutes.
Помогите хотя бы установить причина в модеме, или провайдер виноват?
P.S. - приходил специалист от провайдера, в настройках модема отключил FireWall. Чем это может грозить?