Hi @lkakas 

Thanks for posting in our business forum.

lkakas wrote

Actually I downgraded from 1.2.2 as I thought the problem is with the firmware :-) So the same issue with 1.2.2.

That seems to be the problem in your environment or your ISP. If you have tried different firmware, it persists.

Hi @MR.S 

Thanks for posting in our business forum.

MR.S wrote

  @lkakas 

 

Well then I don't have a quick fix for you, let's hear what @Clive_A  says about this.

 

TCP reset or retransmission does not matter. You have this in regular connections as well. If you open Wireshark.

  @Clive_A 

Thanks for your feedback. As stated earlier I replaced the ER8411 with an old 1043ND and seems all issues went away.

There is nothing much in the environment as I disconnected everything. Except the laptop I'm using for testing , two cables (which I replaced two times already) , ER8411 and the modem.

  @Clive_A 

Is it normal behaviour that the ER8411 is sending broadcast messages continously like this?

Source MAC is 00:14:78:00:00:ff / 00:14:78:00:00:aa but there is no such device connected to the router (just one laptop). This MAC seems belongs to TP-LINK (vendor) but it is NOT the MAC of the router.

13:19:49.193496 00:14:78:00:00:ff (oui Unknown) > Broadcast, ethertype Unknown (0x88b5), length 258:
        0x0000:  0100 00f0 0100 00ec 0011 2850 0000 0000  ..........(P....
        0x0010:  0000 0000 0a35 0180 0a10 7b82 0000 0000  .....5....{.....
        0x0020:  0000 0000 0000 0000 0808 0404 0000 0000  ................
        0x0030:  0000 0000 0000 0000 d8dd 0000 0000 0035  ...............5
        0x0040:  0000 0000 e4fa c490 4ad9 78af 08bf 4e74  ........J.x...Nt
        0x0050:  1100 0000 0100 0000 0808 0404 0000 0000  ................
        0x0060:  0000 0000 0000 0000 54e0 31fc 0000 0000  ........T.1.....
        0x0070:  0000 0000 0000 0000 0035 0000 0000 d8dd  .........5......
        0x0080:  0000 0000 e4fa c490 4add 541f 8d09 21bd  ........J.T...!.
        0x0090:  1700 0000 0100 0000 0000 4052 0000 0000  ..........@R....
        0x00a0:  0000 0000 0000 0000 0000 0000 0000 0000  ................
        0x00b0:  0000 0000 0000 0000 0000 0000 0000 0000  ................
        0x00c0:  0000 0000 0000 0000 0000 0000 0000 0000  ................
        0x00d0:  0000 0000 0000 0000 0000 0000 0000 0000  ................
        0x00e0:  0010 0100 1100 0000 1700 0000 0000 0000  ................
        0x00f0:  0000 0000                                ....

The MAC address looks a TP-LINK one but not of my devices. I can see this even if everything is disconnected from the router.

It is a kind of continous message with different content/length, but from the same MAC to broadcast MAC

14:01:39.353345 00:14:78:00:00:aa > ff:ff:ff:ff:ff:ff, ethertype Unknown (0x88b5), length 60:
        0x0000:  0100 0008 0700 0004 9703 0000 0000 0000  ................
        0x0010:  0000 0000 0000 0000 0000 0000 0000 0000  ................
        0x0020:  0000 0000 0000 0000 0000 0000 0000       ..............

I can reproduce the issue with downloading a firefox installer from ftp dot mozilla dot org (via https). Or to download a linux ubunti iso :)

This is how the flow looks like on the router:

23:38:31.989957 IP 8.8.4.4.53 > <PUBLIC IP>.48314: 43354 4/0/1 A 151.101.3.19, A 151.101.195.19, A 151.101.131.19, A 151.101.67.19 (125)
23:38:31.990183 IP <ROUTER PRIVATE IP>.53 > <LAPTOP PRIVATE IP>.64475: 1050 5/0/0 CNAME mozilla-download.fastly-edge.com., A 151.101.195.19, A 151.101.131.19, A 151.101.67.19, A 151.101.3.19 (143)
23:38:31.993050 IP <ROUTER PRIVATE IP>.53 > <LAPTOP PRIVATE IP>.64475: 4084 4/0/0 A 151.101.67.19, A 151.101.3.19, A 151.101.195.19, A 151.101.131.19 (114)

23:38:31.993711 IP <LAPTOP PRIVATE IP>.55924 > 151.101.195.19.443: Flags [S], seq 4182737140, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
23:38:31.993806 IP <PUBLIC IP>.7108 > 151.101.195.19.443: Flags [S], seq 4182737140, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
23:38:32.029232 IP 151.101.195.19.443 > <PUBLIC IP>.7108: Flags [S.], seq 3369165255, ack 4182737141, win 65535, options [mss 1360,nop,nop,sackOK,nop,wscale 9], length 0
23:38:32.029335 IP 151.101.195.19.443 > <LAPTOP PRIVATE IP>.55924: Flags [S.], seq 3369165255, ack 4182737141, win 65535, options [mss 1360,nop,nop,sackOK,nop,wscale 9], length 0
23:38:32.031333 IP <LAPTOP PRIVATE IP>.55924 > 151.101.195.19.443: Flags [.], ack 1, win 515, length 0
23:38:32.031393 IP <PUBLIC IP>.7108 > 151.101.195.19.443: Flags [.], ack 1, win 515, length 0
23:38:43.172305 IP <LAPTOP PRIVATE IP>.55924 > 151.101.195.19.443: Flags [R.], seq 3223, ack 27876972, win 0, length 0
23:38:43.172428 IP <PUBLIC IP>.7108 > 151.101.195.19.443: Flags [R.], seq 3223, ack 27876972, win 0, length 0


23:38:43.578062 IP 151.101.195.19.443 > <PUBLIC IP>.7108: Flags [.], seq 27876972:27878332, ack 3223, win 302, length 1360
23:38:43.578166 IP 151.101.195.19.443 > <LAPTOP PRIVATE IP>.55924: Flags [.], seq 27876972:27878332, ack 3223, win 302, length 1360
23:38:44.134232 IP 151.101.195.19.443 > <PUBLIC IP>.7108: Flags [.], seq 27876972:27878332, ack 3223, win 302, length 1360
23:38:44.134330 IP 151.101.195.19.443 > <LAPTOP PRIVATE IP>.55924: Flags [.], seq 27876972:27878332, ack 3223, win 302, length 1360
23:38:45.157417 IP 151.101.195.19.443 > <PUBLIC IP>.7108: Flags [.], seq 27876972:27878332, ack 3223, win 302, length 1360
23:38:45.157520 IP 151.101.195.19.443 > <LAPTOP PRIVATE IP>.55924: Flags [.], seq 27876972:27878332, ack 3223, win 302, length 1360
23:38:47.209380 IP 151.101.195.19.443 > <PUBLIC IP>.7108: Flags [.], seq 27876972:27878332, ack 3223, win 302, length 1360
23:38:47.209484 IP 151.101.195.19.443 > <LAPTOP PRIVATE IP>.55924: Flags [.], seq 27876972:27878332, ack 3223, win 302, length 1360
23:38:51.891622 IP 151.101.195.19.443 > <PUBLIC IP>.7108: Flags [.], seq 27876972:27878332, ack 3223, win 302, length 1360
23:38:51.891728 IP 151.101.195.19.443 > <LAPTOP PRIVATE IP>.55924: Flags [.], seq 27876972:27878332, ack 3223, win 302, length 1360
23:39:00.050664 IP 151.101.195.19.443 > <PUBLIC IP>.7108: Flags [.], seq 27876972:27878332, ack 3223, win 302, length 1360
23:39:00.050773 IP 151.101.195.19.443 > <LAPTOP PRIVATE IP>.55924: Flags [.], seq 27876972:27878332, ack 3223, win 302, length 1360
23:39:16.321942 IP 151.101.195.19.443 > <PUBLIC IP>.7108: Flags [.], seq 27876972:27878332, ack 3223, win 302, length 1360
23:39:50.110141 IP 151.101.195.19.443 > <PUBLIC IP>.7108: Flags [.], seq 27876972:27878332, ack 3223, win 302, length 1360

to my understanding TCP reset is sent when any of the sides can't match the flow with its connections.