Losing WAN Internet Connection on Wrvs4400n

Answered Question

The WAN internet connection on my Wrvs4400n router about twice a day. I can't figure out what is causing it. I reboot the router and I get the internet back. I called Cisco support and the tech was helpful once bcause I am no longer in warrenty. He had me change the DNS addresses that I got from my ISP to the and public DNSs. That allowed internet again when it had quit  But after some time the connection cut again. It SEEMs that it quit around 1PM every day. But after today's 1PM loss and reboot the connection quit again around 2:30PM.

I turned on logs and I am getting alot of the following msg -"eth0: received packet with  own address as source address" and  - "delete<00:13:CC:88:FF:AA> from ARL table" - and "Reply packet was to small. Ignoring reply from (dns address) and  - unexpected server: (DNS address) -

Any help will be appreciated.

I did turn off IPS.

Tom Wallin

I have this problem too.
0 votes
Correct Answer by David Carr about 7 years 3 weeks ago

I would try the http one at least and anything above that would be at your discrection.  But at least that one.

Correct Answer by David Carr about 7 years 3 weeks ago

It shuts off to prevent any intrusion with that enabled.  If there is a way of you possibly capturing packets and seeing what kind of activity is be captured then we might have a better feel of what is going on.  But yeah if that is enabled if it senses any anomaly it will shut down the wan.

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (2 ratings)
bmereby Fri, 09/25/2009 - 03:28

What version of firmware do you have installed on the router?

Is the routers hardware version a 1.0, 1.1, or 2.0?

Also what type of connection do you have from your ISP or better known as Service Provider?

Can you please gather the following information for me so I can help diagnose the issue?


Blake Mereby

The Hardware 1.1 and the FW is 1.1.13. Also I updated the IPS signature, reset the router back to the defaults and ran the upgrade to v1.1.13 again. Before I did this I noticed in the logs what I have come to realize is some DoS looking listings. i.e. "ICMP_SMURF" and "Possible DoS HGOD SynKiller Flooding". The listings also made me look at one computer on the network and I disabled it's connection.

After the Above listed actions I've seen the following in the logs -

"eth2: received packet with  own address as source address"

"ipt_tcpmss_target: bad length (1500 bytes)"

"delete<00:13:CE:84:7F:2A> from ARL table" and alot of these -

" [Access Log]O UDP Packet - -->"

David Carr Mon, 09/28/2009 - 08:00

It is very possible that the Dos is shutting down the wan connection to prevent an attack.  If you want to, disable the dos prevention and see if the wan shuts down today.

Correct Answer
David Carr Tue, 09/29/2009 - 07:55

It shuts off to prevent any intrusion with that enabled.  If there is a way of you possibly capturing packets and seeing what kind of activity is be captured then we might have a better feel of what is going on.  But yeah if that is enabled if it senses any anomaly it will shut down the wan.

David Carr Tue, 09/29/2009 - 08:56

Not sure, with just log, i would have to see the pattern and maybe can decipher it.

David Carr Tue, 09/29/2009 - 09:56

Anything you can get will help with the case.  If you can do both that will be fine.  If only a snap shot that will be fine too.

David Carr Wed, 09/30/2009 - 10:17

Yeah, the text file with it stating that received packet with own address as source address, kinda makes me think that someone might be trying to spoof your network to access it.  Like intercepting the traffic posing as your ip address.  That is all i can get from it.  Did the dos protection keep the wan from shutting down?

No. The WAN port still continues to, get blocked, turn off,  whatever. I can't seem to get the right combination of sniffer/logs to match things up to see anything. The Firewall is enabled but all other selections are disabled. No ProtectLink, QoS, VPN, etc. IPS is enabled but all other selections are off.

Is there some setting to turn off all and just let it all through?

And how do I find out for sure if someone is spoofing?

David Carr Wed, 09/30/2009 - 13:06

Have you updated the ips signature on the router under the ips tab.  There is a 1.40 version of the ips signature at the cisco.com website.  Make sure that is updated and lets enable some of the anomoly detections under the ips tab and see if it stops the wan from being shut down.

Correct Answer
David Carr Wed, 09/30/2009 - 14:10

I would try the http one at least and anything above that would be at your discrection.  But at least that one.

Well the WAN shut off several times today. I had some more time to look at the logs and I have a few questions. I have attached another .txt with several email'ed logs from the router around the first time I rebooted the router after the WAN was blocking traffic.

1. Why is the time on the logs one hour behind the actual time?

2. What is an ARL table and is deleting a device OK?

3. Which ports on the router are eth0, eth1, eth2, etc?

4. What is the log listing - "unexpected server :" telling me? that ip is one of my DNS ip's. Also the very next log says - "reply packet was to small. ignoring reply from my other DNS ip.

5.What happens to the packets between logs sent via email. i.e. one log email stops at 9:39:23 and the next log starts at 9:40:00. That's 37 seconds.

6. During reboot the logs have a listing from a "VPN Log". If I'm not doing VPN then why the logs.

Is there an Admin manual for this router that would explain some of these things?

Just a reminder - I have the Firewall enabled with all other selections unchecked except Block WAN Request. All other Firewall settings are at default.

The IPS function is enabled with V1.40 signature file. Today I have had the Anomaly Detection "HTTP" both on and off.

Mr. Carr I appreciate all your time and help.

David Carr Thu, 10/01/2009 - 15:09

How long have you had this router?   Did you have a router prior to this and were you experiencing this kind of issues?  Looking at the logs, I am a little baffled unless you are receiving an attack that is shutting down the wan, I don't know.  I was hoping the ips would stop these issues and the wan would stay connected.

David Carr Thu, 10/01/2009 - 15:11

Did you do the firmware upgrade to this router, or did you purchase it with this on it.  If you did the firmware upgrade, did you do a factory reset of the router and reload the configuration.  If not lets save your configuration and try that to see if this stabilizes that wan connection.

I have had the router for about 18 months. I was using it as an AP up until about a month ago when circumstanses caused me to start using the router functionality. I upgraded the firmware last friday. I followed the following procedure.

1. I unpluged the network from the router.

2. Put the default cfg back in the router.

3. Upgraded the firmware to V1.1.13

4. Rebooted and plugged the network back into the router.

Is there some place I can go to get answers to the questions I posted earlier. I think I know that the answers are not pertinent to our problem. But I was hoping to learn about those things. :-)


One of the teacher's husband is more of a network guy than I am came by today. He has connections to our ISP and by pinging around thinks that we may have a problem with our ISP connection. I am still leaning toward the router just because this all started happening when I switched to this Linksys/Cisco router. I also think that maybe this router connected to this ISP maybe problematic.

I await your wisdom.

David Carr Fri, 10/02/2009 - 06:45

Since you have the configuration saved.  Reset the router either using the factory reset option in the Administration tab, or press and hold the reset button in for 30 seconds while the router is powered on and then reload the configuration.

David, I believe that I have done what you asked. And I will do it again the way that you have asked. But I am finding it hard to believe that this piece of equipment is that particular about the way it is reset. If it needs to be reset and then to restore a configuration file then I will try that. But as of this morning my boss is a little tired of  being without the internet and wants me to buy another router. If it comes to that then I will go with another manufacturer. I have stayed with Linksys because of the Cisco connection and I have never had any problem with their equipment before. I was talking to support via phone this week and was told that David Carr is the best person to solve my problem.

I had a person associated with the school by marriage to one of our teachers that is a little more versed in networks and topology than me and he is convinced that this router - WRVS4400n is the culprit of our problem. Something I had not tried is allowing the internet to come back after being blocked and that is turning the IPS on and then right back off. I had been rebooting the router.

I only have one more shot at this David. Is the reset option your last, best advice?

I have now done what you suggested and it blocked the internet very quickly. I tried the disable IPS and reenable and that did not allow the WAN. I turned off the Firewall and disabled DoS and reenabled the Firewall and then the WAN  was back up.

David Carr Fri, 10/02/2009 - 12:10

Hey Tom, the reason i was having you do a factory reset of the router, is that after a firmware upgrade that is always best practice for  that.  Lets do this call into the Small Business  Support Center and ask for David Carr.  I will get us a case started and see if the router is defective and proceed further.


This Discussion