4

I'm wondering if these attacks are something to worry about, or just my router being a router.

[DoS attack: ACK Scan] attack packets in last 20 sec from ip [60.221.xxx.xxx], Friday, May 06,2016 21:12:13
[DoS attack: ACK Scan] attack packets in last 20 sec from ip [60.221.xxx.xxx], Friday, May 06,2016 21:11:51
[DoS attack: ACK Scan] attack packets in last 20 sec from ip [60.221.xxx.xxx], Friday, May 06,2016 21:11:29
[DoS attack: ACK Scan] attack packets in last 20 sec from ip [60.221.xxx.xxx], Friday, May 06,2016 21:11:05
[DoS attack: ACK Scan] attack packets in last 20 sec from ip [60.221.xxx.xxx], Friday, May 06,2016 21:10:32
[DoS attack: ACK Scan] attack packets in last 20 sec from ip [60.221.xxx.xxx], Friday, May 06,2016 21:09:57
[DoS attack: ACK Scan] attack packets in last 20 sec from ip [60.221.xxx.xxx], Friday, May 06,2016 21:09:15
[DoS attack: ACK Scan] attack packets in last 20 sec from ip [60.221.xxx.xxx], Friday, May 06,2016 21:08:46
[DoS attack: ACK Scan] attack packets in last 20 sec from ip [60.221.xxx.xxx], Friday, May 06,2016 21:07:31
[DoS attack: ACK Scan] attack packets in last 20 sec from ip [60.221.xxx.xxx], Friday, May 06,2016 21:06:52
[DoS attack: ACK Scan] attack packets in last 20 sec from ip [60.221.xxx.xxx], Friday, May 06,2016 21:06:23
[DoS attack: ACK Scan] attack packets in last 20 sec from ip [60.221.xxx.xxx], Friday, May 06,2016 21:05:42
[DoS attack: ACK Scan] attack packets in last 20 sec from ip [60.221.xxx.xxx], Friday, May 06,2016 21:04:43
[DoS attack: ACK Scan] attack packets in last 20 sec from ip [60.221.xxx.xxx], Friday, May 06,2016 21:04:02
[DoS attack: ACK Scan] attack packets in last 20 sec from ip [60.221.xxx.xxx], Friday, May 06,2016 21:03:38
[DoS attack: ACK Scan] attack packets in last 20 sec from ip [60.221.xxx.xxx], Friday, May 06,2016 21:02:55
[DoS attack: ACK Scan] attack packets in last 20 sec from ip [60.221.xxx.xxx], Friday, May 06,2016 21:02:24
[DoS attack: ACK Scan] attack packets in last 20 sec from ip [60.221.xxx.xxx], Friday, May 06,2016 21:01:10
[DoS attack: ACK Scan] attack packets in last 20 sec from ip [60.221.xxx.xxx], Friday, May 06,2016 21:00:47
[DoS attack: ACK Scan] attack packets in last 20 sec from ip [60.221.xxx.xxx], Friday, May 06,2016 21:00:20
[Time synchronized with NTP server] Friday, May 06,2016 19:39:13
[Internet connected] IP address: xx.xx.xx.x, Friday, May 06,2016 19:39:28
[DoS attack: STORM] attack packets in last 20 sec from ip [24.150.xxx.xxx], Friday, May 06,2016 18:29:19
[DoS attack: STORM] attack packets in last 20 sec from ip [24.150.xxx.xxx], Friday, May 06,2016 18:28:59

Genereally I don't give it too much thought, but this is also been a bit shifty.

[Time synchronized with NTP server] Friday, May 06,2016 05:49:10
[Internet connected] IP address: xx.xx.xx.x, Friday, May 06,2016 05:49:10
[Time synchronized with NTP server] Friday, May 06,2016 05:34:01
[Internet connected] IP address: xx.xx.xx.x, Friday, May 06,2016 05:34:01
[Time synchronized with NTP server] Friday, May 06,2016 05:18:51
[Internet connected] IP address: xx.xx.xx.x, Friday, May 06,2016 05:18:51
[Time synchronized with NTP server] Friday, May 06,2016 05:03:43
[Internet connected] IP address: xx.xx.xx.x, Friday, May 06,2016 05:03:43
[Time synchronized with NTP server] Friday, May 06,2016 04:48:41
[Internet connected] IP address: xx.xx.xx.x, Friday, May 06,2016 04:48:41
[Time synchronized with NTP server] Friday, May 06,2016 04:33:37
[Internet connected] IP address: xx.xx.xx.x, Friday, May 06,2016 04:33:37
[Time synchronized with NTP server] Friday, May 06,2016 04:18:36
[Internet connected] IP address: xx.xx.xx.x, Friday, May 06,2016 04:18:36
[Time synchronized with NTP server] Friday, May 06,2016 04:03:35
[Internet connected] IP address: xx.xx.xx.x, Friday, May 06,2016 04:03:36
[Time synchronized with NTP server] Friday, May 06,2016 03:48:34
[Internet connected] IP address: xx.xx.xx.x, Friday, May 06,2016 03:48:34
[Time synchronized with NTP server] Friday, May 06,2016 03:33:34
[Internet connected] IP address: xx.xx.xx.x, Friday, May 06,2016 03:33:34
[Time synchronized with NTP server] Friday, May 06,2016 03:18:31
[Internet connected] IP address: xx.xx.xx.x, Friday, May 06,2016 03:18:31
[Time synchronized with NTP server] Friday, May 06,2016 03:03:28
[Internet connected] IP address: xx.xx.xx.x, Friday, May 06,2016 03:03:28
[Time synchronized with NTP server] Friday, May 06,2016 02:48:25
[Internet connected] IP address: xx.xx.xx.x, Friday, May 06,2016 02:48:26
[Time synchronized with NTP server] Friday, May 06,2016 02:33:24
[Internet connected] IP address: xx.xx.xx.x, Friday, May 06,2016 02:33:24
[Time synchronized with NTP server] Friday, May 06,2016 02:18:23
[Internet connected] IP address: xx.xx.xx.x, Friday, May 06,2016 02:18:24
[Time synchronized with NTP server] Friday, May 06,2016 02:03:23
[Internet connected] IP address: xx.xx.xx.x, Friday, May 06,2016 02:03:23
[Time synchronized with NTP server] Friday, May 06,2016 01:48:21
[Internet connected] IP address: xx.xx.xx.x, Friday, May 06,2016 01:48:22
[Time synchronized with NTP server] Friday, May 06,2016 01:33:20
[Internet connected] IP address: xx.xx.xx.x, Friday, May 06,2016 01:33:20
[Time synchronized with NTP server] Friday, May 06,2016 01:18:18
[Internet connected] IP address: xx.xx.xx.x, Friday, May 06,2016 01:18:19
[Time synchronized with NTP server] Friday, May 06,2016 01:03:17

Also, SMURF attacks and things like this:

[DoS attack: IP Spoof] attack packets in last 20 sec from ip [192.168.1.108], Tuesday, Jun 07,2016 15:49:49

I did turn off the auto clock from my laptop, I'm the only user on this network. The whole thing just seems a bit bizarre. I've contacted my ISP and router company, they were useless... This does happen frequently. Can someone please make some sense as to what's going on? Any solutions would be great (I've reset everything imaginable a few times). Any insight would be greatly appreciated.

closed as off-topic by Xander, Dmitry Grigoryev, Stephane, LvB, Rory Alsop Jun 9 '16 at 15:11

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – Xander, Dmitry Grigoryev, Stephane, LvB, Rory Alsop
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 2
    I would say this is your (crap) router being a crap router. From these logs there is no way to infer what exactly it considers an "attack packet". The only advice I can give you is to replace it with a custom Linux/BSD box or use OpenWRT or PFSense. – André Borie Jun 8 '16 at 19:04
  • Sorry, I googled and I still don't understand what you mean. These dos' aren't just coming from China, they're coming from everywhere (I'm in Canada), could you please explain to me why this is happening and how to make sure it stops? It's really disruptive. Also, could you clarify if those are hardware or something like opendns? I'm on a Mac (Linux?) if that makes a difference. Thanks so much – Policks Jun 9 '16 at 3:56
  • Well as I said your router is probably crap and considers legitimate packets as attacks, that's why I suggest replacing it with something decent. PFSense and OpenWRT are router operating systems. You can find compatible hardware but the easiest would be to just find an old PC, put two network cards in there and use that. If you have the experience you can build your own router OS from scratch using a basic Linux or BSD installation. – André Borie Jun 9 '16 at 15:40
  • Can this be re-opened ? – Tilak Maddy Jun 15 '16 at 9:22