0

About 1 day ago my router was being DDoS by some people and one of the ip addreses was Facebook's. Can anyone explain this?

[DoS Attack: ACK Scan] from source: 31.13.65.50, port 443, Saturday, February 23, 2019 16:49:04
[DoS Attack: ACK Scan] from source: 31.13.65.50, port 5222, Saturday, February 23, 2019 16:48:41
[DoS Attack: ACK Scan] from source: 31.13.65.50, port 443, Saturday, February 23, 2019 16:47:01
[DoS Attack: ACK Scan] from source: 31.13.65.50, port 5222, Saturday, February 23, 2019 16:46:38
[DoS Attack: ACK Scan] from source: 31.13.65.50, port 443, Saturday, February 23, 2019 16:44:58
[DoS Attack: ACK Scan] from source: 31.13.65.50, port 5222, Saturday, February 23, 2019 16:44:35
[DoS Attack: ACK Scan] from source: 31.13.65.50, port 443, Saturday, February 23, 2019 16:42:56
[DoS Attack: ACK Scan] from source: 31.13.65.50, port 5222, Saturday, February 23, 2019 16:40:29
[DoS Attack: ACK Scan] from source: 31.13.65.50, port 5222, Saturday, February 23, 2019 16:36:24
[DoS Attack: ACK Scan] from source: 179.60.192.3, port 443, Saturday, February 23, 2019 16:27:07
[DoS Attack: ACK Scan] from source: 31.13.65.50, port 5222, Saturday, February 23, 2019 16:24:53
[admin login] from source 192.168.1.18, Saturday, February 23, 2019 16:24:12
[DHCP IP: 192.168.1.18] to MAC address , Saturday, February 23, 2019 16:23:46
[DoS Attack: ACK Scan] from source: 31.13.65.50, port 5222, Saturday, February 23, 2019 16:18:45
[DoS Attack: ACK Scan] from source: 31.13.65.50, port 5222, Saturday, February 23, 2019 16:16:42
[DHCP IP: 192.168.1.18] to MAC address , Saturday, February 23, 2019 16:12:06
[DHCP IP: 192.168.1.2] to MAC address , Saturday, February 23, 2019 16:00:28
[DoS Attack: RST Scan] from source: 188.122.82.214, port 80, Saturday, February 23, 2019 15:57:23
[DoS Attack: RST Scan] from source: 72.167.239.239, port 80, Saturday, February 23, 2019 15:54:11
[DHCP IP: 192.168.1.4] to MAC address :ec, Saturday, February 23, 2019 15:53:55
[DHCP IP: 192.168.1.8] to MAC address , Saturday, February 23, 2019 15:48:39
[DHCP IP: 192.168.1.35] to MAC address 20:df:b9:ad:1c:38, Saturday, February 23, 2019 15:40:16
[DoS Attack: TCP/UDP Chargen] from source: 210.129.88.228, port 17564, Saturday, February 23, 2019 15:33:45
Improve this question
4
  • 1
    Which IP do you believe is from Facebook? What about these logs makes you think there was a DDoS happening? It all looks like regular internet noise and false positives to me.
    – Polynomial
    Feb 24, 2019 at 2:19
  • My first thought was that a true DDoS today would have spoofed source IPs, but that seems irrelevant as indeed the log looks harmless. No service was denied during the capture of this log.
    – HackneyB
    Feb 24, 2019 at 2:25
  • 5
    My first thought was that a true DDoS attack would have far more activity than that per second. Those messages took over an hour to happen.
    – Ed Grimm
    Feb 24, 2019 at 2:36
  • Port 5222 I believe is Facebook's XMPP-based chat.
    – forest
    Feb 24, 2019 at 2:58

1 Answer 1

Reset to default
8

This appears to be a false positive. Many of those IP addresses are indeed owned by Facebook, and the ports used makes it appear to also include Facebook's chat app. Your router is likely being just a little overzealous in marking incoming traffic as a DoS attack. In particular, you can see that each of these connections occur minutes apart from each other, while a true DoS attack could involve thousands of connections every second. These occasional spurious connections pose no threat to your network.

Improve this answer
2
  • So the log is misleading and misread but technically correct .. "ACK Scan" entries indicate the router didn't have an open TCP session and didn't expect those packets. Almost looks like a kind of a Facebook app keepalive behaviour.
    – HackneyB
    Feb 24, 2019 at 3:10
  • @HackneyB It's correct only in that whatever signature the router uses to detect DoS attacks or ACK scan attempts was present in the traffic passing through it.
    – forest
    Feb 24, 2019 at 3:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .