LCP echo thresholds and log level

Installing and Using OpenWrt
1

A few days ago my FTTP connection was re-established. The logs showed:

Mon Jan 19 10:25:18 2026 daemon.info pppd[2983]: No response to 5 echo-requests
Mon Jan 19 10:25:18 2026 daemon.notice pppd[2983]: Serial link appears to be disconnected.
Mon Jan 19 10:25:18 2026 daemon.info pppd[2983]: Connect time 19975.3 minutes.
Mon Jan 19 10:25:18 2026 daemon.info pppd[2983]: Sent 2310199357 bytes, received 4259141249 bytes.
Mon Jan 19 10:25:18 2026 daemon.err odhcp6c[3131]: Failed to send RELEASE message to XXX (Network unreachable)
Mon Jan 19 10:25:18 2026 daemon.notice netifd: Interface 'wan_6' is disabled
Mon Jan 19 10:25:18 2026 daemon.notice netifd: Network device 'pppoe-wan' link is down
Mon Jan 19 10:25:18 2026 daemon.notice netifd: Network alias 'pppoe-wan' link is down
Mon Jan 19 10:25:18 2026 daemon.notice netifd: Interface 'wan_6' has link connectivity loss
.....
Mon Jan 19 10:25:24 2026 daemon.notice pppd[2983]: Connection terminated.
Mon Jan 19 10:25:25 2026 daemon.info pppd[2983]: Sent PADT
Mon Jan 19 10:25:25 2026 daemon.notice pppd[2983]: Modem hangup
Mon Jan 19 10:25:25 2026 daemon.info pppd[2983]: Exit.
Mon Jan 19 10:25:25 2026 daemon.notice netifd: Interface 'wan' is now down
Mon Jan 19 10:25:25 2026 daemon.notice netifd: Interface 'wan' is setting up now

Googling suggests the echo requests could have been missed because the router was busy doing other stuff and created a false impression that the connection was dead. My ISP has said their records show I dropped the connection.

I'm not a heavy user. I can increase the LCP values if necessary. I'm thinking perhaps I was in a DoS attack or similar. My current console log level is debug. Other router firmware has reported DoS attacks. What log level would I need to use to see similar in OpnWrt?

Also, on the Status->Overview page in the IPV6 box there is:

DNS: a.b.c.d
Expires: 29d 9h 58m 19s
Connected: 4d 2h 1m 41s

The Expires was originally based on 30 days but now seems to have increased to 35 days. Is my ISP supplying this expiry? What's the significance?

2

It's not clear why you totaled these two numbers to arrive at the sum of 35. Could you provide more details?

I assumed from your log that's approximately when your dropped connection occurred.

How were you being attacked?

(You can enable firewall logging.)

3

You can add

option pppd_options 'debug'

to pppoe section of /etc/config/network

LCP exchanges are logged ~2 screenfuls only on connection. Say you can disable options other end did not approve to confuse it less.

4

Expires: 29d 9h 58m 19s
Connected: 4d 2h 1m 41s

Yes, you are correct - my mistake! The secs, min and hours = 12 hours and 29d + 4d = 33 hours - so 33h 12d. Apologies.

Yes, my line/dropped reconnected approx 4d 2h ago.

Firewall logging? Please tell me more! I cannot see anything about logging under "Firewall" in LuCI.

5

You create a rule with logging enabled (i.e., a drop rule for WAN). :wink:

:spiral_notepad: Make it the last rule.