Cable Modem remains permanently busy even when PC is turned off

[TJay]

Now I thought this was a one-off problem, but this has now happened to me twice in one week.

I have been connected to the internet fine, when all of a sudden my cable modem goes into a permanently busy state, taking up all the bandwidth. As such I have trouble getting a internet connection, and unable to get online access. I've tried resetting the modem (power off & on again), and as soon as it aquires a network connection again, it just goes back into its permanently busy state, and the PC says I have limited or no connection to the internet.

When I turned off my PC, leaving my cable modem plugged into my router, the modem still remained in its busy state, even though nothing was connected. It wasn't until after I disconnected it from the router, that the modem settled down.

Now thinking it might be the router itself, I plugged the PC directly into the modem through its network card, but I still had the same problem, i.e. a permanent busy state on the modem. It wasn't until after I connected the PC & modem via USB, then resetting the modem again, that things appeared to return to normal, and I could get back online.

In short, if I connect the PC via its network card, the modem will go permanently busy, connect the PC via USB and things appear OK. On a side note, when I connect my XBox 360 to the modem (& resetting it), I can get on to XBox live with few problems.

I don't think there is anything wrong with the network ports, as I still have a home network, and my laptop & XBox can still access my main PC through the router without any problems. The problem appears to lie with the network address being acquired when connected through the network card, which causes the modem to go busy.

For the record, I have Motorola SB4100 Surfboard modem, and I am running Windows XP.

[Toto]

I assume you have cloned the routers MAC address to be the same one as your PC network card?

It sounds very much that the IP address that had been assigned to your router MAC address was being DoS'd (denial of service) in some way, because as soon as you swapped to USB, and therefore obtained a new IP address the problem dissapeared.

[TJay]

Originally Posted by Toto

I assume you have cloned the routers MAC address to be the same one as your PC network card?

It sounds very much that the IP address that had been assigned to your router MAC address was being DoS'd (denial of service) in some way, because as soon as you swapped to USB, and therefore obtained a new IP address the problem dissapeared.

Well, as I tried to describe, the problem still occurs when I bypass the router altogether, and plug the modem straight into the network card.

What could be causing the DOS? The last time it happened, it appeared to go on for a couple of days.

[Toto]

What could be cause the DoS could be anything, and that's why I asked if you cloned your router MAC address to match the address of your Ethernet card.

The IP address is actually assigned to you based on the CPE, or the client premise equipment, in other words the network interface directly connected to the modem. If you change that equipment, such as swapping from Ethernet to USB, then you will automatically get a different IP.

If though your router MAC and Ethernet MAC are the same, then you may well retain the IP when you swap devices, hence the continued activity.

[TJay]

I figured out it was something to do with the IP address being assigned when I use different connections... I just need to find out what is causing the DoS on that particular connection now, to see if there is something I can do to stop it.

To my knowledge, I haven't made any specific changes on my router concerning the MAC address of my modem... Which would explain, why there appears to be no differences as to when the modem is connected to my router, or directly to the PC.

[Toto]

You may have inherited an IP address that was assigned to a computer and was running some sort of service, and maybe the connecting IP's are trying to call home as it where.

Have you annoyed anyone in a public forum and they could see your IP address?

Maybe you were acting as a server for some peer to peer system?

Loads of possible causes really. May be worth checking your router logs to see if there is a pattern to the port the various IP's are trying to connect to.

Of course it may not be a DoS attack, but without bit of digging around in there, there is no way of telling.

[TJay]

I don't think it is anyone I've annoyed, and I don't post much in forums anyway.

On the subject of peer to peer, I was using BitTorrent the last time this happened, but I don't think I was doing anything special the first time I encountered this problem.

I have begun the procedure of seeing if my cable company can help, and are presently waiting for a respsone.

[Horace]

Why on earth would anyone attempt a DDoS attack on a residential connection with a dynamic I.P. address? If someone had the resources to carry out an attack do you really think they'd waste them on such a worthless and movable target? There's a lot of reasons why someone may be attempting to connect and a DDoS attack is the most unlikely. To even suggest it is simply scare mongering or due to lack of knowledge and will almost certainly not help in finding a solution to the connection problems.

[downquark1]

If your computer savvy you could get a packet sniffer like wireshark, connect the modem directly to the pc and read the traffic.

Won't fix the problem but would identify who is it and maybe why.

[TJay]

Originally Posted by downquark1

If your computer savvy you could get a packet sniffer like wireshark, connect the modem directly to the pc and read the traffic.

Won't fix the problem but would identify who is it and maybe why.

I do know my way around a PC, but I'm not sure if this would work, as the PC usually can't establish a connection, in order to read what the modem is doing.

I don't think it is any kind of attack, as the problem does appear to go away after a couple of days... But the modem behaves as though it is a kind of DoS.

[Toto]

Originally Posted by Horace

Why on earth would anyone attempt a DDoS attack on a residential connection with a dynamic I.P. address? If someone had the resources to carry out an attack do you really think they'd waste them on such a worthless and movable target? There's a lot of reasons why someone may be attempting to connect and a DDoS attack is the most unlikely. To even suggest it is simply scare mongering or due to lack of knowledge and will almost certainly not help in finding a solution to the connection problems.

I didn't say DDoS I said DoS, there is a significant difference.

In my experience in this field it does happen, more often than you think and would be naive on your part to think it doesn't happen to dynamic IP's. I have also given other explanations too.

Being DoS'd is no big deal, I am not scare mongering, and as you say because the OP is on a dynamic IP and has already seen a drop in activity when swapping to a new IP via a USB connection, there is no problem, is there.

[Horace]

Originally Posted by Toto

I didn't say DDoS I said DoS, there is a significant difference.

The amount of sources is irrelevant if the effect is the same and if he can't log the connection attempts then it's impossible to say if they all come from the same location.
The reason I posted was to stop the OP being sidetracked into an investigation into a (D)DoS attack when it was fairly obvious it wasn't. Most peoples problems on here including this one are usually far more mundane than someone maliciously attempting to disable their connection and denial of service shouldn't even have come up.

[Toto]

Originally Posted by Horace

The amount of sources is irrelevant if the effect is the same and if he can't log the connection attempts then it's impossible to say if they all come from the same location.
The reason I posted was to stop the OP being sidetracked into an investigation into a (D)DoS attack when it was fairly obvious it wasn't. Most peoples problems on here including this one are usually far more mundane than someone maliciously attempting to disable their connection and denial of service shouldn't even have come up.

OK

[NTLVictim]

Silly question, is the OP being port scanned?

[Toto]

Originally Posted by NTLVictim

Silly question, is the OP being port scanned?

Possibly, but a port scan would not result in the connection being unusable.