D-Link Forums

The Graveyard - Products No Longer Supported => Routers => DIR-865L => Topic started by: calculi on February 17, 2013, 01:41:54 AM

Title: DIR-865L Weird Internet sessions
Post by: calculi on February 17, 2013, 01:41:54 AM
Hi.

I am new to the forum and got a newly bought Dir-865L.

It has been acting a bit weirdly lately. I get the weird gut feeling that somebody else is "in there" poking. When I check my internet sessions from time to time, it looks like there's somebody else logged in.

Usually there's a like a chopped message saying "Eplied]".

(http://i1352.photobucket.com/albums/q651/discocalculi/ScreenShot2013-02-16at62451PM_zps0ce0c2ca.jpg)

Quite recently I noticed that Symantec, whom I use as a DNS server actually was shown in the internet sessions. Any help would be much appreciated. I am going to talk to my ISP and also write Symantec a letter depending on what I'm seeing here.

(http://i1352.photobucket.com/albums/q651/discocalculi/ScreenShot2013-02-16at62922PM_zps0fa86bee.jpg)
Title: Re: DIR-865L Weird Internet sessions
Post by: FurryNutz on February 17, 2013, 08:57:11 AM
Link>Welcome! (http://forums.dlink.com/index.php?topic=41537.0)
What Hardware version is your router? Look at sticker under router.
Link>What Firmware (http://forums.dlink.com/index.php?topic=47512.0) version is currently loaded? Found on routers web page under status.
What region are you located?

What ISP Service do you have? Cable or DSL?
What ISP Modem make and model do you have?
Check ISP MTU requirements, Cable is usually 1500, DSL is around 1492 down to 1472. Call the ISP and ask.

Some things to try: - Log into the routers web page at 192.168.0.1. Use IE, Opera or FF to manage the router.
Setup DHCP reserved IP addresses for all devices ON the router. Setup/Networking. This ensures each devices gets its own IP address when turned on and connected, eliminates IP address conflicts and helps in troubleshooting.
Ensure devices are set to auto obtain an IP address.
If IPv6 is an option on the router, select Local Connection Only or Disable IPv6 options under Setup/IPv6.
Set Firewall settings to Endpoint Independent for TCP and UDP under Advanced/Firewall.
Enable uPnP and Multi-cast Streaming under Advanced/Networking. Disable uPnP for testing Port Forwarding rules.
WAN Port Speed set to Auto or specific speed? Some newer ISP modems support 1000Mb so manually setting to Gb speeds can be supported by the router. Advanced/Advanced Networking/WAN Port Speed
Set current Time Zone, Date and Time. Use an NTP server feature. Tools/Time.

I would check the Setup/Networking/Dynamic Client list for any unknown device IP addresses. Also check Status/Device Info/Connected LAN Computers for any unknown device IP addresses or unfamiliar addresses.

Use Wireshark and domaintools.com to help you narrow down who and where these are coming from.
You might set up Network Access rules and see if this does anything.
Ensure your routers loging, WiFi are all secured using Passwords. Preferred security is WPA-Personal. WPA2/AES Only.

Ensure all PC and Laptops are scanned for any malware or viruses.

The one IP address belongs to the following:
IP Location:     United States Rancho Cordova Foundation Health Corporation
 ASN:     AS33517
 IP Address:     198.153.182.40     


NetRange:       198.153.182.0 - 198.153.182.255
CIDR:           198.153.182.0/24
OriginAS:       
NetName:        FHC-CLINIC-32
NetHandle:      NET-198-153-182-0-1
Parent:         NET-198-153-171-0-1
NetType:        Reassigned
RegDate:        1993-01-29
Updated:        2005-05-09
Ref:            http://whois.arin.net/rest/net/NET-198-153-182-0-1

CustName:       Foundation Health Corporation
Address:        3400 Data Drive
City:           Rancho Cordova
StateProv:      CA
PostalCode:     95670
Country:        US
RegDate:        1993-01-29
Updated:        2011-03-19
Title: Re: DIR-865L Weird Internet sessions
Post by: calculi on February 17, 2013, 11:42:40 AM
Hardware version: A1
Firmware version: FW 1.03
Region: Sweden
ISP: CABLE LAN, Bahnhof.se via MKBnet
ISP Modem: none
ISP MTU: 1500

Router: Static assigned IP in the Network settings. I am within a class A network range. I Keep DHCP off for the network to avoid any conflict and keep track of my different computers.

I keep Upnp: OFF
Firewall: Active but I run Port and Address restricted. Also I have some inbound rules and some access rules, but nothing too fancy. No advanced port forwarding and link-only ipv6. No QoS Engine. No WPS.  
WPA2 only, AES…

The DNS server I found in my internet session was 198.153.192.40, not 198.153.182.40 as posted in the reply to my original message.

I used 198.153.192.40 as a DNS server (Norton DNS Service).

I run Mac OS X Moutain Lion, With no Symantec productions on the computer. I run Viscosity from time to time and have tested out three different VPN services, all which work ok.

General IP Information

IP:         198.153.192.40
Decimal:      3331964968
Hostname:      198.153.192.40
ISP:         Symantec Corporation
Organization:   Symantec Corporation
Services:      None detected
Type:         Corporate
Assignment:   Static IP
Blacklist:   
Geolocation    Information

Country:      United States
State/Region:   California
City:         Cupertino
Latitude:       37.3042  (37° 18′ 15.12″ N)
Longitude:       -122.0946  (122° 5′ 40.56″ W)
Area Code:      408
Postal Code:   95014


The provider is Bahnhof.se but I am connected to Bahnhof.se via a "city net" called MKBnet.
This net seems open since I can find shared units if I connect the computer directly to the socket in the wall. At least one of these units belongs to a person living more than 500 metres away from me in a different building. There's also some NAS drive that is shared that pop up from time to time...

I dont see these if I connect via the router.
Title: Re: DIR-865L Weird Internet sessions
Post by: FurryNutz on February 17, 2013, 02:09:38 PM
Typo on my part. Sorry.

If DHCP servcies are OFF on the 856L then I would presume that those entries are coming from something on your network, i.e. PC or device.

You can select on the links in the Internet Sessions and it should reveal more information.
Title: Re: DIR-865L Weird Internet sessions
Post by: calculi on February 18, 2013, 11:44:24 AM
Thanks for the reply.

I only have a maximum of 5 computers on my subnet.

What I am just wondering if is the internet session might be bugged since it shows weird names "eplied]" or if it is acting accordingly to what it is designed for when it shows foreign ip numbers amongst my local network?

When I usually call my DNS Servers, I can see for instance 208.67.222.222:53 direction out, when I click on my computer ip in the list.

I didn't have time to check what symantec ip was doing as I got a little too careful and quickly turned the router off.

Title: Re: DIR-865L Weird Internet sessions
Post by: FurryNutz on February 18, 2013, 12:26:03 PM
I would try this:
1. Turn off ALL devices.
2. Using one PC only, do a factory reset.
3. After the reset and the router is ready, check your Internet sessions for this odd entry. If you don't see it, turn on the next device and check again. Graduate turning on devices until you notice this.

Might help narrow it down. I did see some information about "eplied" on domain tools. You might do some searching. I've never seen this on my 865L.
Title: Re: DIR-865L Weird Internet sessions
Post by: TimeShifter on February 18, 2013, 09:08:44 PM
OK, I had this same issue on v1.02.  Can't recall if it existed on v1.03.  However, after upgrading to v1.04 and being operational for a day, that particular connection hasn't shown up.  May have to monitor for a few more days yet.
Title: Re: DIR-865L Weird Internet sessions
Post by: FurryNutz on February 20, 2013, 07:01:22 AM
Any status on this?
Title: Re: DIR-865L Weird Internet sessions
Post by: TimeShifter on February 20, 2013, 05:55:48 PM
As of yet, it has not shown up :)
Title: Re: DIR-865L Weird Internet sessions
Post by: FurryNutz on February 20, 2013, 05:56:31 PM
Good to hear. Keep us posted if anything does.

Enjoy.
Title: Re: DIR-865L Weird Internet sessions
Post by: calculi on February 24, 2013, 03:45:57 AM
OK, I had this same issue on v1.02.  Can't recall if it existed on v1.03.  However, after upgrading to v1.04 and being operational for a day, that particular connection hasn't shown up.  May have to monitor for a few more days yet.

I found the 1.04 firmware on the forum and will test it...

I still get my problem from time to time with my 1.03 fw and havnt't found a solution for it. Tried resetting. Working with just one computer, then adding one more, two, three, even put a double router to test things. It still occurs from time to time. Also tried blocking ipv4 and ipv6 for all other machines and setup up a pretty insane firewall rules and it still works excellent in all various configurations (ie, double router firewalls, etc. different vpn on the machines, etc.), but it does not seem to make any difference to the "eplied]" bug and other weird internet sessions bugs.

I will check to see if 1.04 fw will do the trick.


Title: Re: DIR-865L Weird Internet sessions
Post by: FurryNutz on February 24, 2013, 09:51:34 AM
Any chance you can take this router to a different location, say a friend, family or a different location where there is a different ISP or modem and just connect the 865 to there system to see if this entry appears? I'm wondering if this is something on your ISP system maybe.

Let us know if you upgrade, do a factory reset before, and after sending the file then set up from scratch and only change the SSID and PW, try to leave the rest set as default.

Keep us posted.
Title: Re: DIR-865L Weird Internet sessions
Post by: TimeShifter on February 24, 2013, 12:15:46 PM
I found the 1.04 firmware on the forum and will test it...

I still get my problem from time to time with my 1.03 fw and havnt't found a solution for it. Tried resetting. Working with just one computer, then adding one more, two, three, even put a double router to test things. It still occurs from time to time. Also tried blocking ipv4 and ipv6 for all other machines and setup up a pretty insane firewall rules and it still works excellent in all various configurations (ie, double router firewalls, etc. different vpn on the machines, etc.), but it does not seem to make any difference to the "eplied]" bug and other weird internet sessions bugs.

I will check to see if 1.04 fw will do the trick.



If this doesn't work for you, maybe try going to some basic settings (i.e. IP4 & IP6 Multicast - Disabled (off), and STORAGE: Shareport disabled (off)) < this is what I'm currently using.   This will also reduce network traffic and possibly one of these settings is causing the ieplied.  But only do this if you see the ieplied on 1.04.
Title: Re: DIR-865L Weird Internet sessions
Post by: calculi on February 25, 2013, 02:29:01 AM
Any chance you can take this router to a different location, say a friend, family or a different location where there is a different ISP or modem and just connect the 865 to there system to see if this entry appears? I'm wondering if this is something on your ISP system maybe.

Let us know if you upgrade, do a factory reset before, and after sending the file then set up from scratch and only change the SSID and PW, try to leave the rest set as default.

Keep us posted.

I'll get the router to a friend eventually to check and see what it is all about.
But for now it seems fw 1.04 seems to do the trick. No bugs so far! :)

Title: Re: DIR-865L Weird Internet sessions
Post by: calculi on February 25, 2013, 02:32:09 AM
If this doesn't work for you, maybe try going to some basic settings (i.e. IP4 & IP6 Multicast - Disabled (off), and STORAGE: Shareport disabled (off)) < this is what I'm currently using.   This will also reduce network traffic and possibly one of these settings is causing the ieplied.  But only do this if you see the ieplied on 1.04.

Thanks. I would never keep shareport opened unless it was a mistake. Everything called shared and multicast is turned off. I also tried the simple settings but it seems firmware 1.03 had some bug. The 1.04 fw seems better so far and the bug should have come by now.. Let's just cross the fingers.
Title: Re: DIR-865L Weird Internet sessions
Post by: FurryNutz on February 25, 2013, 01:37:21 PM
Keep us posted on how it works out for you.  ;)
Title: Re: DIR-865L Weird Internet sessions
Post by: calculi on February 26, 2013, 10:59:56 PM
After running firmware 1.04 for just a few days, I can confirm that the "Eplied]" error turned up in the internet sessions again. Not sure what it is. Just one computer. Setup is like before.

TCP   443   46.51.177.110:443   EST   OUT   431954


Whois has started…

% This is the RIPE Database query service.
% The objects are in RPSL format.
%
% The RIPE Database is subject to Terms and Conditions.
% See http://www.ripe.net/db/support/db-terms-conditions.pdf

% Note: this output has been filtered.
%       To receive output for a database update, use the "-B" flag.

% Information related to '46.51.128.0 - 46.51.191.255'

inetnum:        46.51.128.0 - 46.51.191.255
netname:        AMAZON-EU-AWS
descr:          Amazon Web Services, Elastic Compute Cloud, EC2, EU
remarks:        The activity you have detected originates from a
remarks:        dynamic hosting environment.
remarks:        For fastest response, please submit abuse reports at
remarks:        http://aws-portal.amazon.com/gp/aws/html-forms-controller/contactus/AWSAbuse
remarks:        For more information regarding EC2 see:
remarks:        http://ec2.amazonaws.com/
remarks:        All reports MUST include:
remarks:        * src IP
remarks:        * dest IP (your IP)
remarks:        * dest port
remarks:        * Accurate date/timestamp and timezone of activity
remarks:        * Intensity/frequency (short log extracts)
remarks:        * Your contact details (phone and email)
remarks:        Without these we will be unable to identify
remarks:        the correct owner of the IP address at that
remarks:        point in time.
country:        IE
admin-c:        ADSI2-RIPE
admin-c:        MA11338-RIPE
tech-c:         AJ176-RIPE
tech-c:         AEA61-RIPE
tech-c:         AENO1-RIPE
status:         ASSIGNED PA
mnt-by:         MNT-ADSI
mnt-domains:    MNT-ADSI
source:         RIPE # Filtered

role:           Amazon Data Services Ireland Technical Role Account
address:        Amazon Data Services Ireland
address:        Digital Depot
address:        Thomas Street
address:        Dublin 8
address:        Ireland
mnt-by:         MNT-ADSI
admin-c:        MA11338-RIPE
tech-c:         AJ176-RIPE
nic-hdl:        ADSI2-RIPE
source:         RIPE # Filtered

role:           Amazon EC2 Abuse
address:        1200 12th Avenue South
                Seattle
                WA
                US
mnt-by:         MNT-ADSI
admin-c:        TW510-RIPE
tech-c:         ADSI2-RIPE
nic-hdl:        AEA61-RIPE
source:         RIPE # Filtered

role:           Amazon EC2 Network Operations
address:        1200 12th Avenue South
                Seattle
                WA
                US
mnt-by:         MNT-ADSI
admin-c:        TW510-RIPE
tech-c:         ADSI2-RIPE
nic-hdl:        AENO1-RIPE
source:         RIPE # Filtered

person:         Alan Judge
address:        Amazon Data Services Ireland
address:        Digital Depot
address:        Thomas Street
address:        Dublin 8
address:        Ireland
phone:          +353 1 645 8937
fax-no:         +353 1 645 8933
nic-hdl:        AJ176-RIPE
source:         RIPE # Filtered

person:         Marla Azinger
address:        One Kilmainham Square
address:        Inchicore Road         Kilmainham
address:        8 Dublin 8
address:        IRELAND
phone:          +35316458950
nic-hdl:        MA11338-RIPE
mnt-by:         MA99006-MNT
source:         RIPE # Filtered

% This query was served by the RIPE Database Query Service version 1.53 (WHOIS4)

Title: Re: DIR-865L Weird Internet sessions
Post by: FurryNutz on February 27, 2013, 07:17:41 AM
Are all devices connected to the router online when this happens?

I would turn off ALL devices accept for one and see where and if this is originating at some places on the LAN side.

Does anyone or you or any device specifically use any Amazon services?
Title: Re: DIR-865L Weird Internet sessions
Post by: Hard Harry on February 27, 2013, 09:00:52 AM
Ok, what is the actually problem? Is it just that your seening a log in your internet session you don't understand why it's there? Here is a break down of the different IP's.

198.153.192.40 Symantec. So makes sense that would be in log, since router needs to pass DNS traffic.

208.67.222.222 OpenDNS Again, same thing, if your using OpenDNS, router will talk to that IP

46.51.177.110   :443(HTTPS)
Amazon Elastic Compute Cloud
Amazon Elastic Compute Cloud (Amazon EC2) is a web service that provides resizable compute capacity in the cloud. It is designed to make web-scale computing easier for developers.

Common use is app Instagram. So sounds like one of your devices is using Instagram. Likely a Iphone? As for the 'Eplied" thing, best guess is thats either the computer/host name for one of your devices, or there is a glitch when your router looks up the IP for a domain, probably something to do with your 3rd party DNS.

Were there any connections issues?
Title: Re: DIR-865L Weird Internet sessions
Post by: calculi on February 28, 2013, 11:35:59 PM
Ok, what is the actually problem? Is it just that your seening a log in your internet session you don't understand why it's there? Here is a break down of the different IP's.

198.153.192.40 Symantec. So makes sense that would be in log, since router needs to pass DNS traffic.

208.67.222.222 OpenDNS Again, same thing, if your using OpenDNS, router will talk to that IP

46.51.177.110   :443(HTTPS)
Amazon Elastic Compute Cloud
Amazon Elastic Compute Cloud (Amazon EC2) is a web service that provides resizable compute capacity in the cloud. It is designed to make web-scale computing easier for developers.

Common use is app Instagram. So sounds like one of your devices is using Instagram. Likely a Iphone? As for the 'Eplied" thing, best guess is thats either the computer/host name for one of your devices, or there is a glitch when your router looks up the IP for a domain, probably something to do with your 3rd party DNS.

Were there any connections issues?


Thanks so much. I think the reason why I asked initially is because the DNS servers are found in the internet sessions as own clickable ips in the internet session table , either that or they are shown as "Eplied]" and not as typical local ip traffic reports: 192.168.0.100 click -> 208.67.222.222:53 , -> 198.153.192.40:53, etc.

I posted example images in the beginning of this thread.

Whenever it happens and I notice it, I get the impression the net is acting up weirdly.

But I feel we are slowly getting closer to the what's causing it. It might be possible that the net is not stable enough. If that is the only reason that the router is acting the way it is then that's fine. I have some radio transmission disturbances over the WiFi which occur on a daily basis and on occasion also some cable-based disturbances. Funny enough I had the WiFi disturbances already when using ADSL modem technology around three years ago when I first moved in here, then I switched to Dir-655 and LAN and got the same disturbances only after a short while. Later on I switched to ASUS RT-N56U using LAN but got similar disturbances over the 5ghz band as of the 2ghz band and also when wired, and now finally the Dir-865L which delivers best. Different technique, different ISP but the problem with similar nature is still there.

I have never seen the internet sessions problem before though.

I have two macbooks and one windows 7 computer. Two ancient Windows Xp computers. Usually only run two mac's and one win7. At the time for these posts I have been plugged in with just my macbook to backtrack things.

When plugging the computer directly to the wall I usually see shared units from time to time if I keep share possiblity open on the computer. Be it shared folders or even shared NAS drives. I even googled one of the units/names of the person and it belonged to a dude living more than 500 metres away in a different house. So that might be indication that the service is open. Possibly this can also explain weird amazon, akamai and other services bouncing on and off from time to time. I've also seen port scans and other weird stuff happening on the net in my logs.

There are rumors in the neighbourhood from some people that there's a WiFi/internet thief running around.



Are all devices connected to the router online when this happens?

I would turn off ALL devices accept for one and see where and if this is originating at some places on the LAN side.

Does anyone or you or any device specifically use any Amazon services?


I do not use instagram and have no iPhone. But there might be a possibility more apps on the mac that are using the Amazon service. I get some hits from their ip's quite often. I'll have to google it and see whatever comes up.

The Windows 7 recently got formatted and cleaned due infection. I even had a friend over who got infected  just after a few hours visit. This happened some month back after years of success at Comodo-using and stable setup firewall rules but apparently not from where I am living now. After cleaning up I pretty much only used the mac computers, but unfortunately it has not changed the status of the weird internet sessions on the router.

Title: Re: DIR-865L Weird Internet sessions
Post by: FurryNutz on March 01, 2013, 06:51:35 AM
Do you still have the older router? Might be worth checking either with the older router or possibly get a different DIR series router if you have a store that has a refund policy, check either one of these different router for the same condition and see if they exhibit this. It would be a good test to try this router at a different location as well. Friend or families place.

This seems central to your location as other in other areas have not reported anything like this. I'll put my 865L back online this weekend and check for this as sometimes I do use amazon to download music on my Mac.
Title: Re: DIR-865L Weird Internet sessions
Post by: calculi on March 01, 2013, 10:48:13 AM
Do you still have the older router? Might be worth checking either with the older router or possibly get a different DIR series router if you have a store that has a refund policy, check either one of these different router for the same condition and see if they exhibit this. It would be a good test to try this router at a different location as well. Friend or families place.

This seems central to your location as other in other areas have not reported anything like this. I'll put my 865L back online this weekend and check for this as sometimes I do use amazon to download music on my Mac.

Thanks for all the help. Using the old Dir-655 I get other troubles on my net. Usually I have to apply a new administrator password and also change bssid and password on a regular basis orelse it chokes on me.

The Best option would be to try the router at some other place to see if it handles massive data/random data transfer for a while and if the bug occurs.
Title: Re: DIR-865L Weird Internet sessions
Post by: calculi on March 01, 2013, 10:49:44 AM
Thanks for all the help. Using the old Dir-655 I get other troubles on my net. Usually I have to apply a new administrator password and also change bssid and password on a regular basis orelse it chokes on me. The Asus router is dead. Not sure what ever happened to it.

The Best option would be to try the router at some other place to see if it handles massive data/random data transfer for a while and if the bug occurs. I'll check that as soon as possible.
Title: Re: DIR-865L Weird Internet sessions
Post by: FurryNutz on March 01, 2013, 10:53:08 AM
If you want, maybe someone can review your DIR-655 router settings with you and see if maybe we can help you get the 655 running as a back up router for you using teamviewer (http://www.teamviewer.com) if your interested. Its safe and secure.

Keep us posted.
Title: Re: DIR-865L Weird Internet sessions
Post by: calculi on March 01, 2013, 11:27:15 AM
If you want, maybe someone can review your DIR-655 router settings with you and see if maybe we can help you get the 655 running as a back up router for you using teamviewer (http://www.teamviewer.com) if your interested. Its safe and secure.

Keep us posted.

Thanks for the offer. I think I'll begin to check what ever might be up with the 865L router and take the rest  from there. I got people coming over here to check the net also.
Title: Re: DIR-865L Weird Internet sessions
Post by: FurryNutz on March 01, 2013, 11:37:29 AM
 ;) Hope it works out for you. Let us know how it goes.
Title: Re: DIR-865L Weird Internet sessions
Post by: calculi on April 21, 2013, 12:14:36 AM
Ok. so far I wish I could give some good news, but the problem maintained.

* I reset the router multiple times
* Tried dhcp/static ip's
* Tried NAT on/off
* Tried different access control rules and other stuff. Just to see what was passed or not.
* Tried the router at other locations.

No luck.

According to wifi explorer/analyzer programs I used, I noticed that the router switched from ad-hoc/on/off throughout the days. Never seen such a thing before. As if it switched between bridged mode on/off. No idea as it only seemed to affect my net by getting slower rather than by throwing me in and out of the router connection from time to time. That happened too of course.

Also noticed other users with same mac address and got some weird ip-conflicts from time to time. Also noticed that the weird "eplied" just kept going and going (the original reason for posting here)

Not sure if all this is related I took it up with the ISP.

My ISP told me that apparently there had been some kind of intrusion attempts but that they couldn't help me further unless I got the router checked...

Because of that I have decided to put it back in the box and am now running a different brand.
Title: Re: DIR-865L Weird Internet sessions
Post by: FurryNutz on April 21, 2013, 09:05:13 AM
I recommend that you send you unit back to DLink and get into RMA. I have not seen this issue here nor has anyone else. Seems like there could be an issue with the router.

Keep us posted on the results and good luck.
Title: Re: DIR-865L Weird Internet sessions
Post by: fcadena on June 13, 2013, 07:10:59 AM
Calculli, I have a DIR-645 and I started seeing this strange entry in my list once I enabled an IP in the DMZ zone. If you expand the details for that strange name (which does not match any of my network hostnames) it points to my DMZ IP.

I moved my DMZ IP to a different IP and sure enough, now it is using the new DMZ IP.

Not really sure if this are really related or not but that has been my personal experience with that Internet session name.
Title: Re: DIR-865L Weird Internet sessions
Post by: FurryNutz on June 13, 2013, 07:14:39 AM
Link>Welcome! (http://forums.dlink.com/index.php?topic=41537.0)

Thank you for sharing your experiences, interesting this appears on the 645 when using DMZ. I'll give this a try and see if I see the same thing.

Calculli, I have a DIR-645 and I started seeing this strange entry in my list once I enabled an IP in the DMZ zone. If you expand the details for that strange name (which does not match any of my network hostnames) it points to my DMZ IP.

I moved my DMZ IP to a different IP and sure enough, now it is using the new DMZ IP.

Not really sure if this are really related or not but that has been my personal experience with that Internet session name.
Title: Re: DIR-865L Weird Internet sessions
Post by: FurryNutz on June 14, 2013, 01:53:25 PM
I have not seen this issue on my 645 with a client in the DMZ. Even though I do see an odd IP address that's not reserved by any of my devices: 192.160.0.10 ???

Wondering if there is any relation.


Calculli, I have a DIR-645 and I started seeing this strange entry in my list once I enabled an IP in the DMZ zone. If you expand the details for that strange name (which does not match any of my network hostnames) it points to my DMZ IP.

I moved my DMZ IP to a different IP and sure enough, now it is using the new DMZ IP.

Not really sure if this are really related or not but that has been my personal experience with that Internet session name.
Title: Re: DIR-865L Weird Internet sessions
Post by: gkp on July 14, 2013, 08:07:28 AM
I've experienced the same thing myself.  Not sure how long this has been going on for but last night I noticed for the first time an inbound session on my DIR-865L (firmware 1.04) just like calculi mentioned.  The IP was listed as "EPLIED]" and it was accessing my main computer on port 57100.  I tried to monitor activity using TCPView but there was nothing happening.  I didn't reboot/reset anything and left it on all night. This morning it was gone.  The only devices running last night were by main workstation and the two QNAP NASes that are always on.  The only other parameters in the question are the Hyper-V based CentOS VM, the Huawei cable modem in front of the DIR-865L and of course all the shhhhhhtuf I got running on the main workstation.

This is weird!  I suspect this thing is rampant but most people just don't bother monitoring sessions on their router hence the lack of reported incidents.  This is beginning to smell.

gkp
Title: Re: DIR-865L Weird Internet sessions
Post by: FurryNutz on July 15, 2013, 07:07:10 AM
Link>Welcome! (http://forums.dlink.com/index.php?topic=41537.0)

Internet Service Provider and Modem Configurations

I've experienced the same thing myself.  Not sure how long this has been going on for but last night I noticed for the first time an inbound session on my DIR-865L (firmware 1.04) just like calculi mentioned.  The IP was listed as "EPLIED]" and it was accessing my main computer on port 57100.  I tried to monitor activity using TCPView but there was nothing happening.  I didn't reboot/reset anything and left it on all night. This morning it was gone.  The only devices running last night were by main workstation and the two QNAP NASes that are always on.  The only other parameters in the question are the Hyper-V based CentOS VM, the Huawei cable modem in front of the DIR-865L and of course all the shhhhhhtuf I got running on the main workstation.

This is weird!  I suspect this thing is rampant but most people just don't bother monitoring sessions on their router hence the lack of reported incidents.  This is beginning to smell.

gkp

[/list]
Title: Re: DIR-865L Weird Internet sessions
Post by: gkp on July 15, 2013, 05:33:16 PM

Link>Welcome! (http://forums.dlink.com/index.php?topic=41537.0)
Toronto, ON


Wired


No factory reset

several months ago

Internet Service Provider and Modem Configurations
Distributel

Huawei MT130U
Title: Re: DIR-865L Weird Internet sessions
Post by: FurryNutz on July 16, 2013, 07:16:25 AM
I recommend doing a factory reset of the router and set it up from scratch. Turn OFF ALL other devices during this process. Disconnect everything, accept for one wired PC. After the factory reset, go in and look at the sessions and see if you notice this entry. If you don't see it, graduate to turning and connecting the next device. Keep doing this until you see something.

I recommend trying your unit out at a different location if possible, like at a friends for families place with a different ISP service and Modem.

I looked up your model modem and saw some information regarding this brand as being made in China and having some supposed back door abilities that modems shouldn't have. People recommend not using this brand of modem. How ever I presume that your choices could be limited by your ISP as well. I would recommend trying this out at a different location if possible.


Link>Welcome! (http://forums.dlink.com/index.php?topic=41537.0)
Toronto, ON


Wired


No factory reset

several months ago

Internet Service Provider and Modem Configurations
Distributel

Huawei MT130U

[/quote]
Title: Re: DIR-865L Weird Internet sessions
Post by: pgtest70 on September 18, 2013, 03:56:36 AM
Hi all,

I recently accuired a DIR-865L A1... with 1.05 fw.

"Eplied" seems to show up when the DIR-865L looses the DCHP from ISP... and over a number of minutes or hours no one else claims the IP-adress you are still connected... but connections established after loss of "valid" IP-adress to ISP will show up as "Eplied".

Once someone else claims the IP-adress you loose internet connection...or if the ISP regard it as spurious traffic (no agreed user/client).

Now the not so funny part:
 
DIR-865L does not restart the DHCP quering once it lost its WAN IP... must be done manually by Disconnect /renew/restart....

In my case my ISP have a 20 minute lease of IP-adresses... and the DIR-865L is lousy to renew in time, causing it to loose it IP-adress... (Yepp, click UNI-casting...etc... all tricks in the "boards" and some more) (I have a DSL-302B bridged ... so DIR-865L is the DHCP WAN client).

Why the DIR-865L is the cause... well, if I run the DSL-320B as half-bridged using it as the DCHP WAN client and let the DIR-865L use static or long lease of the 192.168.1.X adress from the DSL-320B... it is rock solid... i.e. NOT ISP-related.

If I run the DSL-320B bridged the DIR-865L is responsible for aquiring and maintaining the IP-adress renewal... which fails to often... and does not recover/restart. In the log is shows up as failures to renew a couple of times then nothing... no renew or request to WAN side, WAN DHCP client stalls/dies.

So:

DSL-302B
MODEM bridged mode ... DIR-865L failure... loss of internet IP... and comms after 5 to variable time...
Modem half-bridged ... rock solid internet connection.


Have also tested with an Inteno AR328...
MODEM bridged mode ... same DIR-865L failure... loss of internet IP... and comms after 5 to variable time...
Modem half-bridged ... rock solid internet connection.

So... I currently run half-bridged DSL-320B... and have 2 NATs after each other...

Hope this shed some light on "Eplied"... and that FW 1.05 still needs a tune up of the WAN DHCP client...especially that it "restarts" by itself if it looses WAN IP adress

(LAN DCHP server works ok for me...) (Yes, I have reset and re-setup the DIR-865L several times... so please donīt start there...)

/Peter G
Title: Re: DIR-865L Weird Internet sessions
Post by: FurryNutz on September 18, 2013, 06:49:23 AM
Link>Welcome! (http://forums.dlink.com/index.php?topic=41537.0)

Does this happen on when connected to a different ISP modem as a test? Try at a different location, ie. friend or family with different modem if possible. This is an isolated issue that only seems to crop up for a few people. I use cable ISP services and have not seen these issues.

Hi all,

I recently accuired a DIR-865L A1... with 1.05 fw.

"Eplied" seems to show up when the DIR-865L looses the DCHP from ISP... and over a number of minutes or hours no one else claims the IP-adress you are still connected... but connections established after loss of "valid" IP-adress to ISP will show up as "Eplied".

Once someone else claims the IP-adress you loose internet connection...or if the ISP regard it as spurious traffic (no agreed user/client).

Now the not so funny part:
 
DIR-865L does not restart the DHCP quering once it lost its WAN IP... must be done manually by Disconnect /renew/restart....

In my case my ISP have a 20 minute lease of IP-adresses... and the DIR-865L is lousy to renew in time, causing it to loose it IP-adress... (Yepp, click UNI-casting...etc... all tricks in the "boards" and some more) (I have a DSL-302B bridged ... so DIR-865L is the DHCP WAN client).

Why the DIR-865L is the cause... well, if I run the DSL-320B as half-bridged using it as the DCHP WAN client and let the DIR-865L use static or long lease of the 192.168.1.X adress from the DSL-320B... it is rock solid... i.e. NOT ISP-related.

If I run the DSL-320B bridged the DIR-865L is responsible for aquiring and maintaining the IP-adress renewal... which fails to often... and does not recover/restart. In the log is shows up as failures to renew a couple of times then nothing... no renew or request to WAN side, WAN DHCP client stalls/dies.

So:

DSL-302B
MODEM bridged mode ... DIR-865L failure... loss of internet IP... and comms after 5 to variable time...
Modem half-bridged ... rock solid internet connection.


Have also tested with an Inteno AR328...
MODEM bridged mode ... same DIR-865L failure... loss of internet IP... and comms after 5 to variable time...
Modem half-bridged ... rock solid internet connection.

So... I currently run half-bridged DSL-320B... and have 2 NATs after each other...

Hope this shed some light on "Eplied"... and that FW 1.05 still needs a tune up of the WAN DHCP client...especially that it "restarts" by itself if it looses WAN IP adress

(LAN DCHP server works ok for me...) (Yes, I have reset and re-setup the DIR-865L several times... so please donīt start there...)

/Peter G
Title: Re: DIR-865L Weird Internet sessions
Post by: pgtest70 on September 20, 2013, 05:01:28 AM
HI,

Location Sweden,

Straight out of the box... (said "FW 1.5" only.... but with date 14 april 2013) (Unit bought August)

Reset performed several times...

... UPDATE: Downloaded the FW 1.5b07 ... which once installed in the DIR-865L is noted as ( FW 1.05 with date 19 june 2013...) NOT saying 1.05b07 in web page... 1.05 but a different date...

So what was the original FW 1.05 ? Subversion b1, b2, b3, b4, b5 or b6 ?
Can not find any released version with thatversion and date on any of DLinks FTP-sites worldwide for this model.

Bottom line for me: Installed it... rebooted... reset ... and now it works ok...

Caveat: DLink need to have better version control and naming of the firmware versions in their web interface, and little bit better quality control, perhaps...
Title: Re: DIR-865L Weird Internet sessions (RESOLVED)
Post by: FurryNutz on September 20, 2013, 07:04:27 AM
Yes there can be some sub versions of the parent version and Yes I personally hate it with they don't progress the parent version.

Glad it's working for you and thanks for sharing. Enjoy.

 ;)

HI,

Location Sweden,

Straight out of the box... (said "FW 1.5" only.... but with date 14 april 2013) (Unit bought August)

Reset performed several times...

... UPDATE: Downloaded the FW 1.5b07 ... which once installed in the DIR-865L is noted as ( FW 1.05 with date 19 june 2013...) NOT saying 1.05b07 in web page... 1.05 but a different date...

So what was the original FW 1.05 ? Subversion b1, b2, b3, b4, b5 or b6 ?
Can not find any released version with thatversion and date on any of DLinks FTP-sites worldwide for this model.

Bottom line for me: Installed it... rebooted... reset ... and now it works ok...

Caveat: DLink need to have better version control and naming of the firmware versions in their web interface, and little bit better quality control, perhaps...