I have been monitoring my router fairly closely since having problems (now resolved) with DSL disconnections some time ago. The System Log was clean until early in September when it began to register a lot of unwanted events. They have settled down into a pattern. Almost every day there is a WAN disconnection every 15 minutes (not quite to the second, but nearly). It reconnects within a few seconds. Also, there is a constant stream of intrusions, even on the couple of days when there were no WAN disconnections. It used to be six an hour, at ten minute intervals. It has increased to six in every 15 minute period between WAN disconnect, usually with four or five of them following at intervals of a few seconds. Occasionally an IP spoofing attack is detected from an IP address 192.168.1.xx – that is apparently from something on my home network, but the address is not that of anything logged on.
I have checked the source IP addresses given for the intrusions. Some of them are from sites identified as untrustworthy, some are not. I guess the addresses are being spoofed. The WAN disconnects are presumably the cause of the blips I experience in ordinary downloads and uploads – irritating but not a serious problem. I suspect they are at least part of the cause of the low quality Skype video calls I have experienced, and this is much more obtrusive. How much the intrusions are degrading the broadband service I cannot tell. The disconnections and intrusions have continued through at least two of the changes that happen occasionally of my router’s WAN IP address, which leads me to suspect that they are part of a larger scale attack on the TalkTalk system. If this is the case, action should have been taken long ago. Fortunately there is nothing to suggest that the intrusions are getting past the router.
I have reason to think that the problems began immediately after a firmware upgrade on or about 6 September. I have seen another complaint about regular WAN disconnections that was apparently resolved by rolling back the firmware to the earlier version. Is this a sensible thing to try? If not what can be done? The situation is highly unsatisfactory.