2

So I'm a noob here and have been doing some research on why my internet (cable modem) locks up about once or twice a week ever since installing a Netgear N900 router a few months ago. After asking around a bit someone recommended I look at my router logs. When I did that I noticed quite a bunch of DoS attacks, which may or may not be real, malicious attacks. Below is a snippet of my logs over the last 2 days.

[DoS Attack: SYN/ACK Scan] from source: 149.202.86.200, port 80, Thursday, August 25, 2016 20:41:23
[DoS Attack: SYN/ACK Scan] from source: 37.130.228.68, port 8080, Thursday, August 25, 2016 19:48:16
[DoS Attack: TCP/UDP Chargen] from source: 95.211.214.74, port 55113, Thursday, August 25, 2016 19:35:28
[DoS Attack: RST Scan] from source: 45.58.74.129, port 443, Thursday, August 25, 2016 17:49:08
[DoS Attack: TCP/UDP Echo] from source: 31.214.240.122, port 43395, Thursday, August 25, 2016 17:47:20
[DoS Attack: SYN/ACK Scan] from source: 76.74.255.69, port 80, Thursday, August 25, 2016 17:40:53
[DoS Attack: SYN/ACK Scan] from source: 149.56.115.186, port 44405, Thursday, August 25, 2016 17:32:49
[DoS Attack: SYN/ACK Scan] from source: 149.56.89.107, port 42324, Thursday, August 25, 2016 17:30:40
[DoS Attack: RST Scan] from source: 45.58.74.161, port 443, Thursday, August 25, 2016 17:23:43
[DoS Attack: RST Scan] from source: 108.160.172.193, port 443, Thursday, August 25, 2016 16:33:31
[DoS Attack: RST Scan] from source: 108.160.172.204, port 443, Thursday, August 25, 2016 15:47:23
[DoS Attack: TCP/UDP Chargen] from source: 179.43.144.17, port 42698, Thursday, August 25, 2016 12:57:00
[DoS Attack: SYN/ACK Scan] from source: 149.56.89.107, port 42324, Thursday, August 25, 2016 12:44:49
[DoS Attack: SYN/ACK Scan] from source: 141.101.121.251, port 80, Thursday, August 25, 2016 09:49:49
[DoS Attack: SYN/ACK Scan] from source: 151.80.111.125, port 12500, Thursday, August 25, 2016 09:39:44
[DoS Attack: RST Scan] from source: 46.174.48.4, port 80, Thursday, August 25, 2016 08:30:12
[DoS Attack: TCP/UDP Chargen] from source: 95.211.214.74, port 36643, Thursday, August 25, 2016 08:29:42
[DoS Attack: SYN/ACK Scan] from source: 77.87.229.22, port 443, Thursday, August 25, 2016 07:35:56
[DoS Attack: SYN/ACK Scan] from source: 52.220.81.105, port 52200, Thursday, August 25, 2016 07:23:51
[DoS Attack: SYN/ACK Scan] from source: 192.99.39.120, port 1634, Thursday, August 25, 2016 07:08:01
[DoS Attack: ACK Scan] from source: 49.199.13.51, port 22, Thursday, August 25, 2016 05:28:29
[DoS Attack: TCP/UDP Chargen] from source: 104.255.70.247, port 39382, Thursday, August 25, 2016 05:16:25
[DoS Attack: SYN/ACK Scan] from source: 46.105.200.74, port 80, Thursday, August 25, 2016 05:00:20
[DoS Attack: SYN/ACK Scan] from source: 162.144.140.49, port 80, Thursday, August 25, 2016 04:40:10
[DoS Attack: ACK Scan] from source: 208.59.216.16, port 80, Thursday, August 25, 2016 04:16:50
[DoS Attack: ACK Scan] from source: 69.168.97.78, port 110, Thursday, August 25, 2016 04:13:40
[DoS Attack: TCP/UDP Chargen] from source: 184.105.139.101, port 48327, Thursday, August 25, 2016 01:17:53
[DoS Attack: RST Scan] from source: 101.227.155.95, port 31414, Thursday, August 25, 2016 01:09:39
[DoS Attack: ACK Scan] from source: 173.203.153.81, port 80, Thursday, August 25, 2016 00:26:53
[DoS Attack: ACK Scan] from source: 173.203.153.81, port 80, Thursday, August 25, 2016 00:15:41
[DoS Attack: SYN/ACK Scan] from source: 77.87.229.22, port 80, Wednesday, August 24, 2016 22:55:06
[DoS Attack: SYN/ACK Scan] from source: 162.144.140.49, port 80, Wednesday, August 24, 2016 22:25:30
[DoS Attack: ACK Scan] from source: 212.4.153.171, port 443, Wednesday, August 24, 2016 22:15:19
[DoS Attack: ACK Scan] from source: 54.224.162.27, port 9543, Wednesday, August 24, 2016 22:13:52
[DoS Attack: ACK Scan] from source: 54.224.162.27, port 9543, Wednesday, August 24, 2016 22:03:41
[DoS Attack: ACK Scan] from source: 54.224.162.27, port 11095, Wednesday, August 24, 2016 22:02:32
[DoS Attack: ACK Scan] from source: 54.224.162.27, port 9543, Wednesday, August 24, 2016 22:01:41
[DoS Attack: ACK Scan] from source: 54.224.162.27, port 11095, Wednesday, August 24, 2016 22:00:31
[DoS Attack: ACK Scan] from source: 207.172.196.17, port 443, Wednesday, August 24, 2016 22:00:06
[DoS Attack: ACK Scan] from source: 31.13.71.1, port 443, Wednesday, August 24, 2016 22:00:02
[DoS Attack: ACK Scan] from source: 31.13.71.36, port 443, Wednesday, August 24, 2016 22:00:01
[DoS Attack: ACK Scan] from source: 54.224.162.27, port 9543, Wednesday, August 24, 2016 21:59:41
[DoS Attack: ACK Scan] from source: 207.172.196.17, port 443, Wednesday, August 24, 2016 21:59:17
[DoS Attack: ACK Scan] from source: 207.172.196.18, port 443, Wednesday, August 24, 2016 21:59:12
[DoS Attack: ACK Scan] from source: 31.13.71.3, port 443, Wednesday, August 24, 2016 21:59:02
[DoS Attack: ACK Scan] from source: 54.224.162.27, port 11095, Wednesday, August 24, 2016 21:58:31
[DoS Attack: SYN/ACK Scan] from source: 162.144.140.49, port 80, Wednesday, August 24, 2016 21:02:53
[DoS Attack: TCP/UDP Chargen] from source: 185.94.111.1, port 60830, Wednesday, August 24, 2016 20:09:49
[DoS Attack: RST Scan] from source: 192.162.101.60, port 80, Wednesday, August 24, 2016 19:09:09
[DoS Attack: SYN/ACK Scan] from source: 162.144.140.49, port 80, Wednesday, August 24, 2016 18:36:44
[DoS Attack: SYN/ACK Scan] from source: 85.193.69.29, port 80, Wednesday, August 24, 2016 18:33:23
[DoS Attack: SYN/ACK Scan] from source: 91.220.101.45, port 1723, Wednesday, August 24, 2016 18:28:47

After doing a quick google search on some of the IP's it looks like there are some Facebook and Dropbox IPs in the list. Many of the others seem to be located in Germany, UK, Canada, etc. Not sure what they are or if they are harmful, but I'm beginning to believe that the frequency of these "attacks" is what is causing my modem to lock up. Does anyone know if these are harmful attacks? How can I resolve these types of things from locking up my modem? There is a setting in the router to allow DoS but I'm extremely hesitant to do that, especially if someone is indeed trying to get on my network. FWIW I have about 30 wired and wireless devices on my network (couple of laptops, smartphones, tablets, IP cameras, Sonos speakers, Amazon Echo's, Nest products, other smart home products, etc.). I'm really just trying to figure out why my modem keeps locking up ever since purchasing this new router. Thinking these DoS attacks might be the culprit. Any help would be greatly appreciated!

Improve this question
5
  • A lot of those entries looks like false positive Attack detection, A ACK from a well known port (80, 443), and the Ack from Amazon addresses (54...) sounds legit since you're saying you have Echo's within your network. My bet is that your Netgear is not statefull and doesn't link the ACK with the SYN originating from your internal network (or it has a too small table to store the whole list). Change the firmware or even better, use something sized for your network and not for home use (30 devices is no longer a home usage).
    – Tensibai
    Aug 26, 2016 at 7:03
  • @Tensibai "30 devices is no longer a home usage" If this were 1999 then sure, but these days even those stupid Amazon buttons are IP-addressable. IoT is the way of the future...might want to get a head start on rethinking your understanding of what constitutes 'home usage.'
    – Ivan
    Aug 26, 2016 at 15:07
  • @Ivan not me, but nergear sure should. What I mean is that this kind of routers is unlikely to work properly over 6 or 8 clients behind them
    – Tensibai
    Aug 26, 2016 at 15:09
  • @Tensibai I'm used to clients never wanting to spend money on anything and have seen every type of problem crap SOHO routers in production can yield, but being able to handle up to 255 nodes is generally one of the only they can all do. I'm more inclined to agree with your first assertion that the firmware is just crap if it's locking up this often.
    – Ivan
    Aug 26, 2016 at 15:17
  • 1
    @Tensibai Oh yes, OP is using a Netgear router isn't he? I take back everything I said. I would not trust them to handle any number of clients without fail. IME they all seem to lock up inexplicably over time.
    – Ivan
    Aug 26, 2016 at 15:24

3 Answers 3

Reset to default
2

SOHO Routers (I've seen this on dlink and netgear at least) are fond of displaying 24hours/mission CRITICAL drama-logs like those. Try installing ddwrt or something similar on that router instead. Then install tcpdump, connect to the router over ssh (putty -log somethingAwry.log 192.168.0.1 (or whatever ip your router uses) and cast the spell tcpdump -ni eth0 dst host yourPublicIP - any flooding will show up here. Otherwise try eth1, wan0, or find the appropriate interface using the spell ifconfig -a. If you are being flooded contact your isp and give them somethingAwry.log - the staff at the isps of any flooding ips will react quickly to any mails from your isp about abuse. Edit: the log entries are to some extent caused by portscanning, which is done by both bots and humans looking for specific services to attack. they scan everything. the 'syn' flood is usually just a few syn-packets for a half-open scan. google 'strobe' and 'nmap'.

Improve this answer
1

ACKs from ports like 443, 80, and other well known service endpoints are just responses from websites and services you are visiting. It's not malicious. The fact that your router is confused about this, and is locking up, is an indication that it is poorly engineered, and the firmware should be upgraded or replaced.

Since the question alludes to the presence of a lot of devices, there may be something that some specific device is doing that is particularly troubling for the router. Not all protocols are handled with equivalent grace by these devices. An approach may be to systematically shut down individual devices and see if router behavior stabilizes.

Improve this answer
2
  • So a few weeks ago I decided to flash new firmware onto my router, reset all of my devices and assign each of them a reserved DHCP address. For about 3 weeks everything was working smoothly. Now all of a sudden last week I've run into the same issue again where my internet locks up about once or twice a day and I need to reset my modem and router to restore everything. I'm not convinced at this point it has anything to do with the DoS attacks in my logs since I was getting them while things were working. Outside of buying a better router, any other thoughts that weren't already said?
    – King Kona
    Sep 21, 2016 at 18:01
  • Yes, those weren't DoS attacks anyway, the router is just confused. It sounds like there is probably a single device/protocol that is causing problems for the router. Look at what devices the router reports as being most active when there are problems and see if stopping that activity stops the problems.
    – Jonah Benton
    Sep 25, 2016 at 19:35
0

It is minutes and in some cases hours between all this entries, so will not qualify this as an attack and it should not have any impact on your router. It is normal to get some light scans looking for open ports, if you put up a web-server on port 80 you will probably get requests to wordpress phpmyadmin and other common used services after the scan of port 80 have shown it as open. In most cases it is kids having scripts running trying to find vulnerable servers to play with.

If it was a DOS attack you would see hundreds of requests a second and if it was DDOS thousands of requests a second.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .