1

I'm using two routers in my home network, as described in this question (router B in the diagram). Therefore, router B is not accessible from the internet.

Going over the logs of this router, I was surprised to find what is logged as "SYN flood". I have several entries such as:

Nov 18 21:27:50 [ATTACK]: SYN Flood from 173.194.222.188
Nov 18 12:58:16 [ATTACK]: SYN Flood from 209.85.233.188

There are 3-4 such entries per day. I haven't noticed any disruption in use. The IPs are supposed to originate from companies such as Google or Microsoft, but something tells me they are spoofed.

Questions

  • How can a router which is not accessible from the internet be a subject of such an attack? Note that I have full control of all devices connected to it, and they are all trustworthy/up-to-date.
  • Does a SYN flood attack against a home router have a meaning anyway? I was under the impression SYN flood attacks are related to servers.

I also took a look at this question, and I should note I don't have any port forwarding active.

1

If you connect from a decive in the LAN of router B to an external service, router B and A each do network address translation (NAT) so your device can receive an answer.

So basically there is a temporary port open to receive the answers and send them back to your device. The impact should be very limited, since normally the router accept only incoming traffic, if a device started the communication from the inside and the packages belong to that communication.

But in RFC 5382 is a possibility for port reuse: https://tools.ietf.org/html/rfc5382#section-4.3 If such a feature is enabled, an outside service could try to establish a connection through SYN packages. Does your routers support that feature?

1
  • Thanks for your input. I'm unable to find such a setting on the router page. FWIW, the router firewall is on, UPnP is off, and WAN Ping respond is off. – Digital Dracula Nov 20 '20 at 9:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.