The PPP LCP termination request is TR069 which plagues BT Internet.

Have you disabled CWMP and ptm1.301 on your HG612?

Hi Batboy, no I haven't is that something that needs to be done in CLI?

Checking the logs on the HH5 it looks like either the HG612 or HH5 has asked to drop the VDSL link?


(27890.540000) CWMP: Initializing transaction for event code 4 VALUE CHANGE
20:41:36, 01 May.
(27887.730000) Ethernet is up
20:41:35, 01 May.
(27886.810000) Ethernet is down after 367 minutes uptime
20:41:35, 01 May.
(27886.800000) PPPoE is down after 366 minutes uptime [Waiting for Underlying Connection (WAN Ethernet -​ Up)]
20:41:33, 01 May.
(27883.990000) PPP LCP Send Termination Request [User request]

Unless someone has found a backdoor to the HG612.

CWMP is remote access. So something is trying to access the system.

CWMP was disabled.

In WAN PTM 1.301 TR069 and TR069_INTERNET both had the WAN box ticked.

Disabled both now.

Wasn't there a worm that is / was attacking TR069 modem / routers?

Not sure hopefully someone will be along to confirm, but I would imagine it is a likely attack vector.

https://www.theregister.co.uk/2016/11/28/router_flaw...

Interesting read so maybe an HG612 exploit is in the wild and just hasn't been reported on or discovered?

If so a quick fix is to change the default admin password. Is the firewall on the HG612 preventing access from the WAN?

The firewall on the HG612 is in it's default state so you'd like to think so.

Something is asking it to reboot / drop it's PPP though according to the log on the HG612.

When all this started the default admin password on the HG612 was changed, not the telnet one though.