0

My router has been DDoS'd multiple times (although not taken offline), would resetting the IP stop the attack?

2

No, it won't stop the DDoS. The DDoS will continue on the host it is targeted at currently. Back to the target in a moment.

Guessing you actually mean will "would resetting the IP stop the attack [on me]," then the answer is possibly. First, this will be highly dependent on your ISPs infrastructure.

By resetting your IP, you could mean that you are resetting the IP interface or it could be that it involves sending a DHCP release/renew as part of the process. Either way, if your device doesn't send a DHCP release, any DHCP server will simply hand back the same IP address as there is still a valid lease for your CPE device.

Even if it does send a DHCP release (i.e. releasing the lease), there is a good chance you will receive the same IP address. Many implementations of DHCP will use the same IP address the CPE device had a lease for previously if it hasn't been leased out to another client.

Either way, you have a good chance of getting the same IP address from your ISP and will remain "under attack." Getting back to the targeting I mentioned earlier, DDoS attacks may be launched against a hostname or a range of IP addresses rather than a single IP address.

So even if you have a new IP address, if you are using a dynamic DNS service and the attack is targeted at your hostname, then you are still the target of the attack. Or if the target is an IP range and your new IP is still within the range, then you will still be a target of the attack. It may take time for the attack to ramp back up, but you will likely experience the issue again soon.

So, what should you do?

  1. Contact your ISP. They may be able to take action to stop the attack without any further involvement by you and this could help others as well. It may even be possible that this is the only way you can stop the attack. Even if you are going to try other options, start this process as it may take the most time.
  2. Give the "IP reset" (whatever that means) a shot, maybe it will help. If it doesn't, you aren't any worse off.
  3. You could try powering off your CPE device for a period of time (10+ minutes but longer is better - maybe power off before going to sleep and back on in morning). This won't help with many forms of DDoS, but it may help with a few if your CPE device isn't online. You may also increase your chances of getting a new IP address from your ISP when you power it back on.
  4. Change the ISP side MAC address of the device requesting the IP address if possible. This will often result in a different IP.
  5. Change your ISP. If your ISP can't stop it and the target is the IP address or range of IP addresses, this may be your only option.
1

The attack will continue on the IP it started on. You, however, will not experience the traffic unless they "re-aim".

Depending on the ISP infrastructure, it is possible that even a new IP will be affected because the DDoS will have filled the bandwidth in your area, including the infrastructure for your new IP.

I would report the event to your ISP so some poor customer doesn't log in to find that they cannot use the Internet...

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.