For the mom who gives us everything - Mother's Day gifts that connects us.
What is happening with 3G?
robhedrick's profile

Teacher

 • 

16 Messages

Thursday, December 11th, 2014 5:30 PM

The Problem behind recent Microcell DISconnectivity

I am a Network Engineer and I have figured out what's behind the problem that many are facing!... but not the solution yet. I have a microcell and have been using it for years and it stopped working recently. I went thru all the steps described in previous posts with no avail. I started up a conversation with a friend at the network operations centers for my local ISP and got the answer.

You may have noticed recently an increase in DDOS attacks on ISP's. If you haven't, it’s happening a lot. One such LESS known port is UDP port 0 which is technically an illegal port(which is why it's not listed as a port requirement for the Microcell but it’s essential). Its primary purpose is to transverse fragmented packets (IE fingerprint matches for IPSEC)...If you recall in the setup instructions, it explicitly states that you have to "Allow Fragmented Packets."  Well when the ISP blocks this port, which mine did, to STOP an in progress attack, the ATT Microcell stops working. The reason this happens is because of the fragmented packets in the IPSEC connection from the microcell travel over...you guessed it, UDP port 0.

I bet you if you check with someone knowledgeable at your ISP, you will find out that UDP port 0, AKA fragmented packets, are being blocked as a response to a DDOS attack.

I have confirmed the information with the network operations center for my ISP and all “Microcell” customers are currently affected. They are working on cooking up a solution with Cisco TAC on a method to filter or inspect UDP 0 traffic but as of yet, they haven't come up with one.

The problem we face is more than likely going to have to come from the Engineers of the Microcells themselves.

The real problem is the DDOS attacks that are the cause of the block ports! So how do you mitigate more than 75% of all malicious attacks on the internet? Simple!... Block all subnets emanating from Russia.

ACE - Expert

 • 

24.2K Messages

9 years ago

Interesting information but ranting about blocking all subnets from Russia is inappropriate for the purpose of our discussions  here. Who's your ISP so we can confirm that "all" of the MicroCell users are affected because I haven't seen any current posts here with the numbers that we have from Charter.

Teacher

 • 

16 Messages

9 years ago

In reality, blocking Russia would solve a lot of issues... look at the attack statics collected by various cyber crimes units... plus I'm sour with them because of recent DDOS attack that came from Russia that took down one of my websites... but I digress. My provider is Pixius Communications, which is a smaller provider I know. I also know that several major providers have recently experienced the same attacks, for which the solution IS to block UDP port 0. There is an elephant in the room and noone wants to look at it.

 

"Dear AOScloud customer,

 We experienced a degradation in Internet service from approximately 2:19 PM until 2:47 PM.  Our engineering team noticed the issue around 2:30 PM and traced the issue to one of our uplink Internet providers.  We opened a ticket with this provider and was told by the provider that they are experienced a DDOS (distributed denial of service) attack.  We were able to route around the issue at approximately 2:47 PM.  We will continue to route around the service provider until we are certain their issue is resolved..."

 

ACE - Expert

 • 

24.2K Messages

9 years ago

Pixius appears to be wireless internet provider. The MicroCell is designed to work with wired internet connections, not satellite or wireless. It can work with those types of connections but it is not reliable nor is it officially supported.

Teacher

 • 

16 Messages

9 years ago

You are missing the entire point. THIS is why many users all over the U.S. Who have had working microcells without issue are now having problems!!! This vulnerability is being exploited at an exponential rate. Side note: My connection is not "wireless" in the sense suggested... It is a pppoe connection more reliable than DSL with better throughput. It is supported and NOT the source of these issues.

ACE - Expert

 • 

24.2K Messages

9 years ago

PPoE has had some issue in the past with the MicroCell. However, if your ISP relies on a wireless connection to get to the internet, there may be issues. I have DSL with a static ip address and my connection has been rock solid for as long as I've had the MicroCell.

 

I do agree with you about the hacker aspect but there is nothing that we can do about it. I'm sure the ISP's are aware of it but this is not the forum for that. We are here to help folks who are having issues, and most of the time we can help.

Teacher

 • 

16 Messages

9 years ago

I have a 10 meg connection with a 16 block of public ips and have never lost connectivity... Again, missing the point. I have VERIFIED the issues stated... im not looking for someone to tear apart other possible reasons for this issue, the reasons for the issue has been identified. The goal of this feed is to inform and hopefully gain some ATT visibility on the problem as its only going to get worse... I would hope that people like you would help look into my findings and help resolved the issue stated. Saying "there is nothing we can do about it" is like saying voting doesn't matter. Sooner or later the issue is going to have to be addressed... most likely when ATT starts seeing their bottom dollar affected.

ACE - Expert

 • 

24.2K Messages

9 years ago

Fine. I have a 20Mbps connection with a sustained 17Mbps download. So what. All I'm saying is that if your ISP requires a WiFi connection somewhere along the line to make an internet connection, you may, and probably will, have problems.

 

That being said, AT&T is aware ot the "russian" connection, and like all of the ISP's, they are working to figure out what to do. But that is beyond what this forum is about. We are here to help where we can and resolve problems that we can resolve. If your problem is DoD attacks from Russia, there is nothing that we can do here to correct it. All of the major ISP's are aware of the problem and are working on it but the specific information on what they are doing is highly proprietary and again, beyond the purpose of this forum.

 

I appreciate your concern and information, and have passed that along to the Admins, but we will never see here what is being done other than the MicroCell working as designed, which it does for a lot of people.

Professor

 • 

2.2K Messages

9 years ago

After reading through the posts, I'm not sure what the OP is trying to accomplish in this particular forum.  This forum is for helping people who are having Mcell problems, not to pontificate on blocking subnets from Russia because of port 0 DDOS attacks. 

 

Port 0 is a "reserved" port, not a "technically illegal port".  As a reserved port, it is not suppose to be used for TCP or UDP network communications and I seriously doubt the Mcell uses port 0 for fragmented packets for that reason.  Until we can get corroborating information from AT&T or Cisco that the Mcell is using port 0, I think it is certainly premature to say that it does.

 

While Pixius Communications may have taken the approach to block port 0, I think it is a stretch to state that other ISPs have done the same thing.  It is certainly a stretch to state that alleged port 0 blocking is the cause of Mcell problems all over the US.  That is your personal opinion and is not based on any facts that I've seen.

 

You have a wireless broadband ISP with a marginal bandwidth that is degraded by a variety of factors that afflict that technology.  It may work with a Mcell or it may not, much like satellite internet.  Neither is recommended or supported by the Mcell.

 

If your intent is to "inform" the masses of this odious threat by Russian hackers, I'm not sure why you picked this forum as your soapbox.  Surely there is a better arena for you to sound your alarm.  People here just want to get help with Mcells that they are having problems with and their problems are not being caused by port 0 skulduggery but by a variety of other issues that we've seen.

 

Otto and I are simply Mcell users who donate our time on this forum to help other users deal with their problems.  We stay within the scope of our intent and do not address issues that are not directly related to Mcell operation.  We are not looking to tear anyone down but at the same time, we are not going to debate extraneous networking issues here.  That is not our purpose.

 

If your Mcell no longer works after working for years and you've decided that port 0 blocking is the source of your problem, there's nothing we can do as that's between you and Pixius.  From your posts, it doesn't sound like you want any help but that you just want to vent.  You've done that and now it's time to give it a rest.  If you want to consider that your Mcell problem may be due to some other cause, we'll try to help if you want it.   

ACE - Expert

 • 

24.2K Messages

9 years ago

Excellent! Well put.

Scholar

 • 

250 Messages

9 years ago

Turn off LTE and you can connect to the Microcell.  I just posted a message about this.  I believe Cisco pushed out bad firmware.

Not finding what you're looking for?
New to AT&T Community?
New to the AT&T Community? Start by visiting the Community How-To.
New to the AT&T Community?
Visit the Community How-To.