[SOLVED] 8-port switch loses all connection with mining rig plugged in (hiveos) after about 10 minutes ?

Yaxajax

Honorable
Jul 12, 2015
19
2
10,515
This may be a fairly specific question. I have 2 normal PCs, a media server running windows, and a mining rig running hiveos plugged into a TP link TL-SG108 8-port unmanage switch. The switch is the only lan connection to my router/modem. It has all been running just fine for 1-2 months.
For the past few days, all computers on that switch will lose connection after running for anywhere between 10min to a few hours. They will not regain connection unless I unplug the mining PC. All 4 units are usually mining, and the other 3 run fine with the dedicated miner unconnected. I have switched out the ethernet cables and tried a different 8-port switch - a Netgear GS108. Same results. Any ideas? Thanks in advance!
 
Solution
Seems like your network is being attacked by ARP Spoofing/Poisoning, or one (if not all) are infected with an ARP Spoof malware/worm. Trying disabling DHCP on your router and set everything (client side) static including binding the IP of other devices/address into their respective MAC Address; or you can simply give every device on the network a static IP bound by their MAC Address from the router.

Some guides from TP-Link website: How to prevent ARP Cheat or Attack? | TP-Link
If your router had an ARP Spoofing Prevention, you should enable it, example: How to Prevent ARP Spoofing - DGS-1210-Series | D-Link UK (dlink.com)

Then probably scan every device on the network for intrusion or malware infection, cause usually...
Do the lights on the switch change. Are you actually losing the connection or does it still appear to be up but not function. The second implies you have some kind of IP address conflict or maybe but unlikely mac address issues.

This would be a software thing so it is hard to say what exactly.
 
Do the lights on the switch change. Are you actually losing the connection or does it still appear to be up but not function. The second implies you have some kind of IP address conflict or maybe but unlikely mac address issues.

This would be a software thing so it is hard to say what exactly.
The lights are still double green on the switch. I checked in the router home page and everything has a different IP address. I don't know anything about MAC conflicts, so I haven't looked into that.

It's so odd that it works for a random interval of time then kills everything. Also when I unplug the one in question the others regain connectivity immediately. Like instantly.
 
Seems like your network is being attacked by ARP Spoofing/Poisoning, or one (if not all) are infected with an ARP Spoof malware/worm. Trying disabling DHCP on your router and set everything (client side) static including binding the IP of other devices/address into their respective MAC Address; or you can simply give every device on the network a static IP bound by their MAC Address from the router.

Some guides from TP-Link website: How to prevent ARP Cheat or Attack? | TP-Link
If your router had an ARP Spoofing Prevention, you should enable it, example: How to Prevent ARP Spoofing - DGS-1210-Series | D-Link UK (dlink.com)

Then probably scan every device on the network for intrusion or malware infection, cause usually this is a typical of a man-in-the-middle attack.
ARP spoofing - Wikipedia
 
Solution
Seems like your network is being attacked by ARP Spoofing/Poisoning, or one (if not all) are infected with an ARP Spoof malware/worm. Trying disabling DHCP on your router and set everything (client side) static including binding the IP of other devices/address into their respective MAC Address; or you can simply give every device on the network a static IP bound by their MAC Address from the router.
I setup new static IP addresses for all my LAN connections and turned DHCP off. So now the wifi doesn't work of course, but I have the same issue. Would that rule out the spoofing?
 
I usually set the router's dhcp server to start at either 100 (so probably 192.168.1.100) or even 200 (192.168.1.200). If you have a seperate wifi dhcp pool then you can set one to 100-199 and the other to 200-254.

Assuming your router is on .1 (192.168.1.1), you can assign any static ip addresses you want in the range 2-99. I usually map things out a bit, 1-19 for network stuff, 20-29 for printers, 30-39 for cameras, ..etc. I like to put computers starting at .51. I'm a network admin though, and I've seen all kinds of home network setups.
 
To update, I factory reset the modem/router. That fixed everything for... it looks like 3 days. For three solid days it was good, and I suddenly had that same issue again. Lost all ethernet connection, but the instant I unplug that one computer, they're all back online.
 
Same issues. I ran a separate ethernet cable from the source and put it on a separate hub. Same deal, it will randomly cause everything on that hub to lose connection. However, everything on that other hub stays connected now.