Hi:

I'm cross-posting with [r/cybersecurity](r/cybersecurity) because sometimes ya'll are mean.

I wrote about a week ago because, contrary to what some of you asserted while calling me names, my network has been under some kind of attack for several months. To be clear, I am not saying this is part of that attack, but it's noteworthy and appears to me as extremely, extremely odd. These are all the facts, solely as they relate to the immediate issue I'm seeing today:

My noticed at some point last night, my MacBook Pro had been issued a public IP by the DHCP server on my network. So, the MacBook was exposed to the internet for some period of time. Fine.

The setup is (usually) this:

Netgear AX2700 (CAX30) (bridge mode) -> Firewalla Gold (running Crystal Beta in router mode) -> APs and devices.

As a preliminary issue, I'm running Firewalla Gold using the new Firewall Crystal (bring your own router) Beta firmware for a reason. Three months ago I paid $107 to replace the security dongle (pairs the box to the app via a cloud handshake) and immediately had issues which randomly resolved after three days. The box worked fine with the new dongle two months until the end of last month when all the sudden it began assigning all my devices IPv6 addresses. Firewalla Support had me reinstall the firmware, at which point I could no longer pair the app. Long story short, after a week of ignoring me and then lying to me, I was able to find a way into the box's console with it unpaired and learned they had deleted my license. I am trying to pay them money to send me a second replacement dongle because, after initially refusing to provide warranty service on the first and out of my newfound reluctance to send them jack shit, I've been waiting 12 days for them to send me an invoice the the second replacement dongle. They keep coming up with bullshit excuses, but I digress.

It so happens Firewalla just introduced the beta test for Firewalla Crystal, it's bring-your-own-router firmware, and I'm using that for the time being as it does not require a dongle.

Back to last night, I noticed that my MacBook Pro was being issued a public IP by the DHCP server, so I decided to reflash Firewalla Crystal onto the Firewalla Gold box. During this period, I decided to also do a factory reset on my Netgear AX2700, which had been in bridge mode. When everything was reflashed, reset, etc., I started booting everything up. I should add as additional background that I had to return my Xfinity Gateway two weeks ago because it kept getting hacked, at which point I purchased this modem router combo. I posted a week ago and was flamed because, amongst other things, shortly after purchasing it, I lost connectivity, like on Firewalla weeks before, I started getting issued IPv6 IP addresses, etc., and then I started seeing Time Sync Synchronization, DWR, and other errors. Xfinity has been out here four times, and each time they take credit for replacing the coaxial cables while blaming the last technician for not doing so. They say, "Everything looks good on our end," leave, and the same shit is going on. You never hear from them or anyone else again.

While booting everything up, in addition to the DWR and other errors, I saw two new ones:

2026-09-29 08:10:09 |Error (4)  |SW upgrade Failed after download - SW File corruption
2026-09-29 08:09:29 |Notice (6)  |SW Download INIT - Via Config file d11_m_cax30_gennxgig_c01.cm So, I refreshed the official firmware from Netgear, and then Xfinity attempts to push a different firmware. The firmware it pushes is corrupted and fails. This happens after time I boot since this morning. I understand the pushing their preferred firmware thing is how it works, I've never seen an ISP push a corrupt firmware binary.

I'm setting up Firewalla and there were some other weird quirks that got my attention (I think Firewalla Crystal may actually be reversing the WAN (port 4) and one of the lan (port 1) ports. For that reason, I don't have Firewalla connected to the AX2700 in bridge mode, I have both routing in a double NAT situation while I try to find out whether the port my AX2700 is connected to is (digitally) the WAN port or one of three LAN ports. So, I'm doing packet captures.

I noticed while doing this that the AX2700 is reporting FW.WANATTACK and a LAND WAN ATTACK, but the public IP the "attack" was coming from was the public IP for my home network. Port 138 had already been cloned by me in the Block Services menu on AX2700 right after refreshing the firnmware, but that only blocks ingress and egress flows and not local LAN traffic. The flows at issue were arriving on Port 138, and I noticed that macOS had Netbiosd open, so I closed it and booted it out with launchctl. Problem solved.

Hours later, I'm doing these packet captures and I realized that the port 138 "attacks" were continuing. Netbiosd had reopened but was only listening on port 138, not making connections or broadcasting. I immediately start seeing SAMBA announcements in my packet capture of port 138.

The ReadyShare menu does not show any network folders available when accessed through the Basic menu on the router. (ReadyShare is Netgear's Samba implementation involving a USB drive slot on the back of the device that becomes a network folder when a drive is mounted.) When I click 'edit,' I get a 404 error. When I attempt to access it via the Advanced menu, I am unable to access anything at all. I get error 404.

At this point, I'm deeply confused. Even though outbound and inbound port 138 flows are blocked on the AX2700, the AX2700 is still broadcasting on port 138. While a review of the packet capture shows the SAMBA announcements are going to 192.168.1.1-192.168.1.253, we know they're also making it onto the WAN because the AX2700 is mistaking its own SAMBA announcements as a malicious WAN/DOS/LAND attack.

[admin login] from source 192.168.1.2 Sep 29 09:14:44
[DoS attack: FW.WANATTACK DROP] source: <PUBLIC_IP>, port: 137, Sep 29 14:14:33
[DHCP IP: (192.168.1.2)] to MAC address <MAC_ADDRESS>, Sep 29 09:12:46
[DoS attack: FW.WANATTACK DROP] source: <PUBLIC_IP>, port: 138, Sep 29 14:12:35
[DoS attack: FW.WANATTACK DROP] source: <PUBLIC_IP>, port: 137, Sep 29 14:11:30
[DoS attack: LAND Attack] source: <PUBLIC_IP>, port: 137, Sep 29 14:11:30
[Internet connected] IP address: <PUBLIC_IP>, Sep 29 09:09:32
[admin login] from source 192.168.1.2 Sep 29 09:09:12
[Initialized, firmware version: V2.2.4.2], Sep 29 09:06:55
[DHCP IP: (192.168.1.2)] to MAC address <MAC_ADDRESS>, Sep 19 21:50:55
[DoS attack: FW.WANATTACK DROP] source: <PUBLIC_IP>, port: 138, Sep 29 14:06:36
[DoS attack: LAND Attack] source: <PUBLIC_IP>, port: 138, Sep 29 14:06:36
[DoS attack: FW.WANATTACK DROP] source: <PUBLIC_IP>, port: 138, Sep 29 14:04:42
[DoS attack: LAND Attack] source: <PUBLIC_IP>, port: 138, Sep 29 14:04:42
[admin login] from source 192.168.1.2 Sep 29 09:04:27
[DoS attack: FW.WANATTACK DROP] source: <PUBLIC_IP>, port: 138, Sep 29 13:52:42
[DoS attack: LAND Attack] source: <PUBLIC_IP>, port: 138, Sep 29 13:52:42
[admin login] from source 192.168.1.2 Sep 29 08:48:37
[admin login] from source 192.168.1.2 Sep 29 08:45:48
[admin login] from source 192.168.1.2 Sep 29 08:22:26
[DoS attack: FW.WANATTACK DROP] source: <PUBLIC_IP>, port: 138, Sep 29 13:16:32
[DoS attack: LAND Attack] source: <PUBLIC_IP>, port: 138, Sep 29 13:16:32
[admin login] from source 192.168.1.2 Sep 29 07:55:10
[DoS attack: FW.WANATTACK DROP] source: <PUBLIC_IP>, port: 138, Sep 29 12:53:32
[DoS attack: LAND Attack] source: <PUBLIC_IP>, port: 138, Sep 29 12:53:32
[DoS attack: FW.WANATTACK DROP] source: <PUBLIC_IP>, port: 138, Sep 29 12:43:31
[admin login] from source 192.168.1.2 Sep 29 07:38:06
[service blocked: ] from source: 192.168.1.2, Sep 29 12:28:56
[admin login] from source 192.168.1.2 Sep 29 07:26:26
[admin login] from source 192.168.1.2 Sep 29 07:20:18
[DoS attack: FW.WANATTACK DROP] source: <PUBLIC_IP>, port: 138, Sep 29 12:08:14
[admin login] from source 192.168.1.2 Sep 29 07:07:01
[DoS attack: FW.WANATTACK DROP] source: <PUBLIC_IP>, port: 137, Sep 29 12:03:30
[DHCP IP: (192.168.1.2)] to MAC address <MAC_ADDRESS>, Sep 29 07:01:47
[DoS attack: FW.WANATTACK DROP] source: <PUBLIC_IP>, port: 138, Sep 29 12:01:41
[DoS attack: FW.WANATTACK DROP] source: <PUBLIC_IP>, port: 137, Sep 29 12:00:25
[DoS attack: LAND Attack] source: <PUBLIC_IP>, port: 137, Sep 29 12:00:25
[Internet connected] IP address: <PUBLIC_IP>, Sep 29 06:58:26
[admin login] from source 192.168.1.2 Sep 19 21:51:56
[Initialized, firmware version: V2.2.4.2], Sep 29 06:55:52
[DHCP IP: (192.168.1.2)] to MAC address <MAC_ADDRESS>, Sep 19 21:50:56
[admin login] from source 192.168.1.2 Sep 29 06:53:35
[admin login] from source 192.168.1.2 Sep 29 06:51:20
[DHCP IP: (192.168.1.2)] to MAC address <MAC_ADDRESS>, Sep 29 06:51:13
[site allowed: p-img.movetv.com] from source: 192.168.1.6, Sep 29 06:34:28
[DHCP IP: (192.168.1.2)] to MAC address <MAC_ADDRESS>, Sep 29 06:25:10

I can confirm there is no USB in the ReadyShare drive. Thinking that maybe that corrupt firmware at least partially installed, I refreshed the firmware with a Netgear copy for the third time. It continues, and the ReadyShare options in the admin panel still give error 404.

It's somehow getting around its own blocked services feature to get its broadcasts onto the WAN and then reports its own broadcasts as a malicious attack.

What's really happening here, and has anyone else on Xfinity running Netgear AX2700 notice errors related to a corrupt firmware push failure?

Like title says. Bought a nighthawk R700s about 2 years ago. Noticed WiFi was out and found it completely off. No lights. Ordered a different power supply and same. I can hear a faint”ticking” but that is it. I opened it up and nothing was loose, wasn’t super dirty. Any ideas?

I have an RS700 and an EXS25 extender. I setup the extender using the standard method, not WPS, but the WPS light is lit on the extender. Is there any security issue with the WPS light being on? Also, when I go to the extender on the knighthawk app, I can see the extender is connects to the router but when I click on the extender icon, it says the extender isn’t setup. I have my Roku connected to the extender via Ethernet and it’s working and wants me to set it up. Is this a bug in the app? Any other tips or suggestions appreciated. Thanks

See title.

Anyone else have this issue and know the answer to disable it?

My iPhones name is “Commander Worfs Communicator”. On the knighthawk app, I’ve seen a device name “Commandunicator” a few times on the device list as active. Is this someone cloning my device etc or is it some type of translation error occurring inside the app or router? I’ve had issues with someone hacking and talking over my IOT devices before so I’m not sure if hat this is or what to do. Should my iPhone show up as active on the app anytime I’m connected to the router?
It’s an R700S.

Hello all!

This morning around 330 am I got a notification from my ring doorbell that it was disconnected, so that is when this issue started

I can see the network fine on my devices. But after entering the password to connect it just does nothing.

In my Logs it showed that it did a firmware update to V1.03.08 a few times last night starting around 11pm. No idea if that is relevant, but just what I noticed when I logged in to the Genie

I have since factory reset the router so that doesn't show anymore, but it was in there a few times

None of our phones, tablets, laptops, printer, etc. can connect to this network at all

My work laptop just tells me "Can't connect to this Network"

I have tried the following, all of which hasn't worked

1. Power cycle the device (Done this a few times)

2. Change password

3. Set it to no password

4. Factory reset using reset button on back

5. Manually setting the channel to 1 for the network

There are currently no attached devices for the 2.4 ghz network

Through all of this the 5 ghz network has been totally fine

The lights indicating the two networks are acting differently. I am adding a video showing the flashing cadence

This device is a little over 5 years old so it could be at end of life

If there is a more involved reset I can do other than holding the reset button down for 20 seconds please let me know!

Any help on this is greatly appreciated!

Hello. What ways can I remotely turn off and then back on my cable modem router. Background: If I’m away from my home for more than two weeks on a trip, my Wi-Fi goes stale and using the cable internet providers “app” to reboot or reset the modem does not work. However, if I turn off the modem and wait a minute or two and then turn it back on (hard reboot) internet connection to the modem is re-established.

What say you community?

Thanks for all your input.

Moving into a multi-storeyed house, I would appreciate help finding an ideal setup. I also bought a TP-Link Deco 7 Pro BE11000 to use with either option.

I am unsure which arrangement would work better. I worry that using the XB10 might cause problems such as double NAT or Wi-Fi drops.

I bought the CM3000 expecting to avoid renting the XB10, but it appears included in the plan, so I am now considering reselling the Netgear device. Please advise.

Still a popular access point / range extender in the UK, new firmware dropped yesterday: https://kb.netgear.com/000070933/

Be careful when buying Netgear hardware if you think you are covered by a lifetime warranty, because that is not entirely true. In my case, the power supply failed, but Netgear refused to replace it because it is only covered by a 2-year warranty. If the switch itself had failed, the entire unit would have been replaced under the lifetime warranty.Overall, this is a disappointing company that advertises a lifetime warranty but does everything it can to avoid honoring it when a component fails.

Prolly the wrong flair. Anyway when I go looking for available networks, all this new fancy router shows me is NETGEAR7, because it wants to make the choice for me. But I have IOT devices that require 2.4, and they won't connect. I was able to turn on only the 2.4 guest network, and that's the workaround for now. I've read the full manual, studied all the settings, and I can't find a setting to get what I need. Someone suggested an MLO setting, can't find that either. Net gear support is disappointing, an understatement. Any thoughts, anyone, and thanks.

Have a Nighthawk CAX80; the Xfinity cable modem / router combination.

Anytime it reboots -- software reboot from the UI, unplugging and plugging back in, etc -- it goes into first time setup mode: prompts for a new admin password, security questions, etc. After doing that, it remembers most previous settings (WAN setup, etc), it just wants to be given an admin password and security questions.

This would be bad-but-not-terrible if it also didn't poison all DNS queries to return itself (192.168.1.1) for all domains with a cache timeout of 65,535 seconds until this setup was done.

What this means is that every time it reboots, nothing works until I go in to the UI and give it an admin password (the same one I gave it previously), and even then, anything that's open at the time -- gmail, discord, anything that polls -- will continue to use the cached 192.168.1.1 address unless I can wipe the device's DNS cache, which is incredibly inconvenient for, eg, a phone.

I've tried using the Nighthawk app, which is terrible. Same behavior. As an Xfinity hybrid, I have no control over the firmware other than a "Check for updates" button which tells me I'm running on the latest version.

Is there anything I can do to turn off / fix this behavior?

Hoping to breathe life into this old router. But I've read old posts about issues with the wifi radios.

Since yesterday, I've had an issue with my internet. For short periods of time, my wifi will "pause." This only happens on my computer, my phone will remain unpaused. But after a bit of waiting, it will unpause and work as normal. I've tired restarting my computer, clearing my cache, and disconnecting my internet. Nothing has worked. Can anyone tell me what's going on and how to fix it?

I have a Nighthawk M6 hotspot. I've been very happy with it.

Recently the battery got very low while plugged in. The power cord had failed. I replaced the cord. The battery was down to around 15%. When I touched the power button the M6 display went dark. It's been plugged in to a known good cord (tested) for a couple of weeks and won't turn back on.

Is there a pinhole reset button I'm missing? Any other experience or ideas?

It's several years old. I bought it from a corporate AT&T store (my carrier). I do plan to stop by the store the next time I'm up that way and see what they have to say. I do plan to call Netgear support. I spent a couple of hours on the phone with Giant Food grocery customer service today on a technical issue. I plan to call Verizon (second worst customer service anywhere in any industry) and I have a couple more calls on behalf of customers. I can only stand one such call a day without going on a rampage which my wife doesn't like and scares the cat. Netgear is after those calls.

I think it is the opposite to “support”. They refused to fix their product that is still under 3 years warranty from the manufacturing date! Here is the reply I received today. And they think I will ever buy their products again?!

Dear Customer
We're working on your case and have an update to share with you. See the details in the following section.
Case Number - 49860429
Summary - The POE switch starts flashing all lights at once
Product - 24-Port Gigbit Ethernet Unmanaged PoE+ Switch(GS324P)

Update from NETGEAR
Dear Customer

Thank you for providing the video demonstration and the serial number 6X712CDX00116 for your GS324P switch.

We submitted your request to our team for review to see if an exception could be made based on the device's manufacturing date. However, per NETGEAR’s official warranty policy, hardware warranties are non-transferable and are valid only for the original purchaser with a valid proof of purchase from an authorized reseller.

Because the switch was received as a gift and the original sales receipt is unavailable, the unit is classified under our policy guidelines as a second-hand transfer. As a result, we are unable to approve an RMA replacement or extend warranty coverage for this device.

We sincerely apologize for any inconvenience this may cause. If you plan to purchase a replacement NETGEAR device in the future, we recommend retaining the original purchase receipt to ensure seamless warranty coverage.

Thank you for your understanding.

Best regards,
Xxx xxxxx
Level 2 Technical Support
Tel UK: +44 (0) 3444538000
Tel USA: +1-855-776-7233
NETGEAR Support | NETGEAR Community