ip of 0.0.0.0 ???

[VanEck]

hello everyone. lately i have been noticing a strange issue with my linksys router. my bandwisth will slow down to a crawl, and usually totally crash, making me have to reset the router by physically pulling and plugging back in the power cable.

i have tried to figure out what is causing this, but am not seeing anything that unusual in the logs except a rouge packet of some sort. i always see it pop uo right before the crashes start.

according the router, it is coming from ip address 0.0.0.0

my question is, how is this possible?

i have been hearing about a flaw in linksys routers that is majorly affecting broadband users, namely comcast (same isp that i am currently on) that script kiddies use to crash random routers on the network. supposedly they use this script to send out a certain flawed packet that the linksys routers can not understand, causing them to crash. perhaps this is what i am being hit with, or is this all just urban legend?

could be that my router is just on its last limbs i suppose =)

[PM8228]

No. I have been having an issue where my connection goes down a lot, it is also a LinkSys. The service guy from Adelphia said it was something about the router going into standby mode then ****ing up the IP tables, or whatever. I would read their [Linksys aka Cisco] white papers and information about your router.

-Cheers-

PS: I have yet to try this out.

[skiddieleet]

Sounds like a reasonable explaination. If so the address must be spoofed for it to be 0.0.0.0. I would go to the linksys website and look for a firmware upgrade on your router.

[PM8228]

I just thought about this, don't you have a firewall to filter that out?....

-Cheers-

PS: Nice sig ZC! ^_^

[VanEck]

yes, i am using the latest firmware for my model... but it is dated in mid 2003. not sure how much good that is worth. on a few broadband forums i have read, it seems people have been waiting for a new update to fix quite a few issues with that model.

yes, i am running NAT, which is the supposed "built in firewall" protection of the router, and everything seems to be locked as tight as i can make it.

i am really starting to bet on the issue just being my router kicking the bucket. i have been running it for 2 years non-stop now, and accordin to the forums, this model has not been known to be the most reliable. linksys put out a version "3" of this model, which of course has fresher firmware which fixes a lot of issues. mine is a version "2" though, and can not accept that firmware.

checking out newegg.com right now for a deal on a d-link =)

[chsh]

Normally 0.0.0.0 to the broadcast address is DHCP traffic. It's not impossible that it could be hitting your box as from 0.0.0.0, however there's some iffy filtering going on there. Have you checked to see if there is a firmware update you can get applied to your router?

[PM8228]

Normally 0.0.0.0 to the broadcast address is DHCP traffic. It's not impossible that it could be hitting your box as from 0.0.0.0, however there's some iffy filtering going on there. Have you checked to see if there is a firmware update you can get applied to your router?

ChsH, the man who +m, then +v everybody but me!!! I didn't even think they had firmware updates. Can't you just set up the Firewall that is part of the router to say no to 0.0.0.0, sorta like you say no to strangers without condoms?

-Cheers-

[chsh]

If you were to say no to all 0.0.0.0 traffic, DHCP would stop working altogether. That is FAR from a good idea.

[rufus47]

I thought that 0.0.0.0 indicated "any" ip address. I found the comcast statement interesting, so thanks for the knowledge and good luck in resolving the linksys issue.

[Cybr1d]

hmm, I dont know why...but I think 0.0.0.0 is Internet Explorer...or am I thinking of it when it shows on netstat