Can someone help me decipher what these netgear log entries mean? Am I getting hacked?

Question

Can someone help me decipher what these log entries mean? Am I getting hacked?

So this is my residential router is a netgear gateway C3700-100NAS with Spectrum Internet. Usually I have no problems. But every so often, intermittently and not very predictable, I would notice my Internet slow down to a crawl, and even pinging 8.8.8.8 or www.yahoo.com will time out or have insane times.

I checked my netgear gateway C3700-100NAS logs and saw this.... Apparently in the span of less than a minute or so there were hundreds of entries for Source of "140.3.230.0" and Target/Destination of "149.104.249.105". Neither of these IPs have anything to do with my residential IP address nor would/should any device on my network be sending nor receiving anything to or from any of these IP addresses.

Based on a simple lookup it appears that 149.104.249.105 is Location is Washington D.C. (Northwest Washington), District of Columbia US - ISP is Cogent Communications and that 140.3.230.0 is Location is Columbus, Ohio US - ISP is DoD Network Information Center.

Can anyone have any idea what is going on?

https://i.stack.imgur.com/5QuHJ.jpg

=== update =====

But one of the problem is I'm with TWC /Spectrum and they statically assign public IP addresses so I'm stuck with the one I have gotten. The only time that I ever gotten a new IP was when my previous router died and when I got a replacement router I had to call them in with the MAC/ CM MAC info and that is after they registered the new Router on their end (also the same C3700 netgear model) I noticed when going to whatismyipaddress that I gotten a new public IP address. It doesn't happen all the time but when it does happen it slows me down to a crawl and usually a reboot stops it, but not because it changed to a different IP address (its static)

The other thing I thought was strange is that assuming the IP address are legit and not spoofed or anything, apparently based on whatever public records available it appears to be coming from a government network going to another government network

All of them are Source of "140.3.230.0" and Target/Destination of "149.104.249.105"

Answer 1

At first glance, your home network seems to be used for a Denial of Service (DoS) attack. If this is the case, you already have been hacked.

What should I do?

• If you want, you may let your ISP know about it --> here. Your ISP might be interested helping you block an attack on a Department of Defense server.

• Use Wireshark to monitor the traffic on the devices connected to your router when crawling become slow. The device producing the most traffic is likely the culprit.

• Update your question with some .pcap samples when you find the culprit(s).

What should I find with Wireshark, how do I find the culprit(s)?

• You want to find ICMP/ping packets bigger than 65,536 bytes. (You need to understand how PoD works.)

• If you find those ICMP sessions on a device, save the .pcap, take a screenshot and repeat the process on the remaining devices. You want to know how many devices have been compromised.

• If you find some malicious ICMP Session we want to see the details of the layer 2, 3 and 4.

I found those malicious sessions you speak about on my device!(s)

There is/are some malware(s) on your machine(s), find it, and nuke it.

How do I nuke the malware?

There is a lot of antivirus software available. But, from my point of view, the best way would be to totally wipe the compromised device(s).

I found nothing on Wireshark.

• Try again. Wireshark might not be easy to use, try to be familiar with the filters. In this case, filter for ICMP or PING traffic.

I really found nothing on Wireshark, tried on all my devices, 5 times.

Then, there is slight chance that your router is compromised. Attackers often attempt to hide their presence, and will attempt to suppress logging.

So what if my router is compromised?

• Be sure that your router firmware is up to date

• Reset your router to factory default.

• Don't use admin as login, set a brand new strong password.

Could these attacks be coming through my WiFi AP?

Yes, this could be performed by an uninvited device that is accessing your Wifi. Check your AP's WiFi DHCP/Static leases to be sure.

Important !

Try to not input passwords, credit card info, or other sensitive data on your devices before being 100% sure that your devices are clean. If malware is on your network doing the DOS, there is a good chance that a keylogger may be present, too.