ERROR: CSRF Detect
 

This is a new error I see in my network logs very often. The tech who has been here a couple of times has no idea what it means. Any ideas? :dunce:

Re: ERROR: CSRF Detect
 

Never heard of google?

http://www.veracode.com/security/csrf

Re: ERROR: CSRF Detect
 

Yes, I'd read that already, but how does it relate to VM's network?

Re: ERROR: CSRF Detect
 

It doesn't.

Re: ERROR: CSRF Detect
 

Precisely.

Re: ERROR: CSRF Detect
 

Nice replies ... I am sure the OP is much the wiser.

Re: ERROR: CSRF Detect
 

The answer is in the link and is quite clear what it is.

Re: ERROR: CSRF Detect
 

I think the OP was asking what this error means in the context of it being generated by VM cable modem. The link you mention has no reference to the error message per se hence his question ..

I suspect the cable modem firmware has code looking for attempts to exploit a CSRF vulnerability on the modem's web interface and maybe this was a false positive?

Re: ERROR: CSRF Detect
 

It only appeared when I was upgraded to SHUB 2ac. A network manager was asked what it meant and he had no clue either. The "LAN interface" bit made the tech do a doubletake.....

Re: ERROR: CSRF Detect
 

It is not being generated by VM cable modem.

Re: ERROR: CSRF Detect
 

Correct

Re: ERROR: CSRF Detect
 

What else writes to the cable modem log?

Re: ERROR: CSRF Detect
 

It is not in the cable modem log.

Re: ERROR: CSRF Detect
 

Taf, can you confirm?

Re: ERROR: CSRF Detect
 

Yes the error appears in the SHUB 2ac modem log. For example:

15/11/2015 11:59:20 GMT 90000200 CSRF Detect - Expired Content Submitted ; LAN Interface

28/11/2015 00:16:56 GMT 90000200 CSRF Detect - Expired Content Submitted ; LAN Interface

28/11/2015 17:36:34 GMT 90000200 CSRF Detect - Expired Content Submitted ; LAN Interface

28/11/2015 16:32:24 GMT 90000200 CSRF Detect - Expired Content Submitted ; LAN Interface

29/11/2015 00:17:42 GMT 90000200 CSRF Detect - Expired Content Submitted ; LAN Interface

Re: ERROR: CSRF Detect
 

Nope, that's quite clearly the router LAN interface log.

Re: ERROR: CSRF Detect
 

Taf, I guess you are running as a router + modem combination rather than in cable modem only mode so this message is probably coming from the router part of the firmware rather than the modem part.

Re: ERROR: CSRF Detect
 

There is no probably. It says it's coming from the LAN Interface. It's coming from the LAN Interface.

Re: ERROR: CSRF Detect
 

It's in Router mode and always has been (4 wired outlets to other parts of the house).

Re: ERROR: CSRF Detect
 

Really helpful reply ... nice ..

Re: ERROR: CSRF Detect
 

From Jon-G, VM tech on VM forums:

I've had no problems logging into the hub, and all I do there is copy/paste network logs or network status readings.

The SHUB 2ac is almost sparkly new.

Re: ERROR: CSRF Detect
 

Hi Taf, Could you post (or PM me) the link to your VM thread please?
I've a few theories on the cause as I encounter this quite often testing various firmware releases... ;)

eg here's one I prepared earlier:Network Log
First Time Last Time Priority Error Number Description
18/12/2015 06:07:40 GMT 18/12/2015 06:07:40 GMT Warning (5) 90000200 CSRF Detect - Expired Content Submitted ; LAN Interface
18/12/2015 06:05:05 GMT 18/12/2015 06:05:05 GMT Warning (5) 66050310 Auth Success - Web login successful.
18/12/2015 06:03:53 GMT 18/12/2015 06:03:53 GMT Warning (5) 66050310 Auth Success - Web login successful.

Re: ERROR: CSRF Detect
 

Re: ERROR: CSRF Detect
 

I've posted in your thread there Taf. While I'm no longer a Superuser my thoughts usually carry a little more weight than most.

All the times you've copy/pasted upstream stats I've not once seen one as it should be. There's a clear noise problem on the return / upstream path in your area that needs sorting.

It looks as though the ability of the equipment you connect to to make allowances for these conditions is masking them for most. For whatever reason, I'm not sure on this, when modems come online they still see issues for a while before settling down.

Either way just because the equipment can kinda mask the problems doesn't mean the problem isn't still there. Needs sorting.

Re: ERROR: CSRF Detect
 

Doesn't matter what asinine label they attach to your handle - your thoughts ALWAY's carry more weight or at the very least merit serious attention! ;)

With respect Taf's other thread then Partial Service with obvious Dynamic Bonding and Transmit Channel Set symptoms on U/S effectively mean that CSRF warnings (which are trivial to explain/reproduce) are the least of his problems and totally unrelated to this thread here!

@Taf - As Carl explained/implied it's UP(literally) to Networks to explore your cable segment cascade chain back UP towards even CMTS and establish at which point the "bonding" fails and causes partial service on users "downstream" of that failure point.
The "nearer" the CMTS the more users potentially affected.

Once your PS is resolved then I/Carl or others can return to any CSRF symptom and explain/demonstrate in laborious detail?
:rolleyes:

Re: ERROR: CSRF Detect
 

Much obliged. A forum bod is contacting other levels of the VM structure to try to get a combined effort underway.

Several other users in our area are now seeing the same "up-down-up-down" problem, or had accepted the situation as "normal" for a while. One mate is also seeing loads of CRSF error messages. VM informed, but no comeback as yet as to what it means.

Re: ERROR: CSRF Detect
 

Ahhh I thought you were referring to CSRF errors but personally never encountered CRSF errors myself? :(

We can help explaining the former in VM/Hub context but I certainly can't explain the latter. Probably why VM haven't given any comeback yet as they're as confused as we/I are? :dunce:

Re: ERROR: CSRF Detect
 

Typo :dunce:

Re: ERROR: CSRF Detect
 

I'd just like to point out that I am in Modem Only mode on my Superhub AC2 and am also receiving these errors:
21/12/2015 08:55:33 GMT Warning (5) 90000200 CSRF Detect - Expired Content Submitted ; LAN Interface

I had the original Superhub on 152mb until Virgin upgraded me to 200, they told me my Superhub didn't support 200mb and they would send me the new hub for free. They seemed pretty keen to get it out to me for free, I wonder if it's anything to do with their WiFi service they are planning on launching next year.

Anyway, I use my own Asus AC1900 and have always used Modem Only mode since the Superhub existed. Never any problems until getting the new ac2 hub. Now I have internet that only works sometimes. My AC1900 often tells me I am disconnected from the internet. When I plug the shub into my computer directly (or laptop), I get "No internet access" and am unable to access 192.168.100.1. Doesn't happen everytime, sometimes it just works but then the internet will act strangely, I will get 200mb speed tests yet I can barely load certain web pages.

None of this was an issue until I got the ac2 hub, and it's also the first time I've seen this error message. If I put the ac2 into router mode, I get the same issues even on it's WiFi with extremely slow web page loading times but blazing fast speed tests.

I have an engineer scheduled for today yet it's not acting up at all, typical. I wonder if this error has anything to do with it.

tldr: This error also occurs in modem only mode.

Re: ERROR: CSRF Detect
 

The error has been referred to the Dev team to find out what triggers the error code.

Re: ERROR: CSRF Detect
 

Sounds good :)

Engineer has been and swapped out my ac2 for another ac2. So far so good, 200mb speeds within a couple of minutes after powering it on and switching to modem only mode. This error message is not present in the log. When I had my original ac2, I noticed this error message on the first day. Could just be a coincidence, we will see how it goes.

Re: ERROR: CSRF Detect
 

22/12/2015 16:27:37 GMT 90000200 CSRF Detect - Expired Content Submitted ; LAN Interface
22/12/2015 10:36:36 GMT 68010302 DHCP WAN IP - 86.xxxxx
22/12/2015 10:35:48 GMT 68000407 TOD established
Time Not Established Time Not Established 84000510 Downstream Locked Successfully
21/12/2015 23:35:52 GMT 90000200 CSRF Detect - Expired Content Submitted ; LAN Interface
21/12/2015 15:54:41 GMT 90000200 CSRF Detect - Expired Content Submitted ; LAN Interface
21/12/2015 11:19:03 GMT 68010302 DHCP WAN IP - 86.xxxxx
21/12/2015 11:18:14 GMT 68000407 TOD established
Time Not Established Time Not Established 84000510 Downstream Locked Successfully
20/12/2015 23:27:04 GMT 90000200 CSRF Detect - Expired Content Submitted ; LAN Interface
20/12/2015 15:53:18 GMT 90000200 CSRF Detect - Expired Content Submitted ; LAN Interface
20/12/2015 11:03:36 GMT 68010302 DHCP WAN IP - 86.xxxxx
20/12/2015 11:02:47 GMT 68000407 TOD established
Time Not Established Time Not Established 84000510 Downstream Locked Successfully
19/12/2015 23:17:26 GMT 90000200 CSRF Detect - Expired Content Submitted ; LAN Interface
19/12/2015 15:44:29 GMT 90000200 CSRF Detect - Expired Content Submitted ; LAN Interface