Trying to determine if someone was "DoS'd"

Question

I'm part of a pretty small video game community and one of our members claims he was DoSed or DDoSed during a recent match. We are currently split as some people believe he was and others believe he wasn't.

Here are the router logs from the night:

Some of the arguments for: He was being sent packets from spoofed IPs. He was also being sent packets to port 4444 which is apparently used for malicious purposes.

Additionally one of the people who reviewed the information said that to be in this log it had to be an "Active" connection and that it wasn't just 4-5 fragmented packets but 4-5 connections.. is this accurate?

He also ran a Malwarebytes scan to see if he was infected with anything. The scan was clean.

People are also suspicious of the time and length of the attack. It happened when his team was Up 1 game, and lasted until the series was over and his team had lost (playing the final match down a member without him)

Arguments Against: Low number of Packets, and that random "bots" may have attacked him. Not really sure about the second one.

Just curious what a more professional opinion is so we can try to resolve the situation.. any help appreciated.

Answer 1

Based on the information you have provided, I would say that the player was not victim of a Distributed Denial of Service attack. The amount of packets captured in your log are way to small in quantity, however this does not mean that the player couldn't have been DDoSed without the packets being in your log. On the other hand, it seems that the packets that are logged state that they are fragmented. This is a common DDoS tactic, because the targeted machine will try to re-assembled the thousands of fragmented packets, therefore tying up system resources causing lagging or a system crash. Also, I can see in your logs that there was a port scan done, but probably not to the same machine. A port scan is beneficial to attackers because it will tell them what ports are open on your computer. Sending packets to a closed port won't get them very far. In addition, a Distributed Denial of Service attack is just what is states, the denial of a service, specifically internet connection. A DDoS attack can sometimes be used to get a system to reboot or cause a distraction, but does not directly infect a computer with a virus.

To reiterate, the information you have provided does not give me much information to give you a solid answer. However here are some tools and resources that may prove to be beneficial.

• Loss of Internet Connection: This is pretty much your tell tale sign that you might be victim of a DDoS if it was successful. If the attacker did not have enough power, your system may just lag.
• Your Internet Service Provider (ISP): ISPs hate DDoS attacks as much as you do because the surge of traffic is going through their networks too. At the very least, you could call your ISP to see if they noticed an abnormality in your usual internet traffic.
• Packet Captures: There are free tools available such as wireshark that will capture all traffic going in and out of your machine. If you notice an huge influx of traffic, that is a good indicator. However, this tool must be running when you suspect foul play of course. It is of no use after the fact.
• Netstat Utility: Another easy way to determine if a DDoS attack has occurred is through the built in Netstat utility in windows (assuming that is your OS) that is explained here. This site will show you how to run a netstat command to show connections made to your machine, and how to analyze them to see traces of a DDoS attack.

Given the resources listed, I would say your best bet now would be to contact your ISP. If you are able to update your question with any more data, I can revise my answer accordingly.