At a customer location there was a Cisco 851 router (which uses IOS). The PCs on location were all of a sudden unable to connect. We came on site and found that FastEthernet 4 (the WAN port) was "administratively down". We ran these commands to resolve it

config t
interface fa4
no shutdown
exit
exit
write

Now the mystery is how the shutdown flag got there in the first place? The router was on battery backup... but during the outage it was power cycled by the customer.

• It is possible that there was a short outage by the ISP and that the power cycle caused the shutdown flag to come up.
• There may have been a hack or an attack pattern that caused the shutdown flag to come up.
• There may have been a hack or an attack pattern that the router to become unavailable and then caused the shutdown flag to be added on startup.

Question: Does anybody have any clues? or at least remember that they had a shutdown flag come up on their WAN port also?