After enabling system log on my Asus DSL-N10E router, I've got this message:
DoS: Tcp SYN With Data Attack source=217.74.166.73
What does it mean? Is it a real danger on my network security? And how can I protect my network from these attacks?
Add a comment
|
2 Answers
This is very likely not a Denial of Service attack. As a matter of fact, this looks very much like a SYN Port Scan. Someone (very likely automated, by an infected machine) is attempting to scan your machine. They send a SYN packet to you on a certain port, then your machine responds with an ACK packet.
There's no real danger here. This is the Internet; someone will always try to scan your machine and try to infect you. Outside of books and in real life, nobody really is going to DoS your home router. Your router is already doing a good job by detecting and DROPing those packets.
My advice: Forget about this, and move on with your life.
Your router tries to guess if there are some dangers for your network or not. However guessing often leads to errors. So you shouldn't take this message too serious. This should serve as first warning and you should look for further signs.
The IP address mentioned in your question belongs to some computer in the Krasnojarsk region. At the moment this IP is not known for sending viruses or spam or attacking other computers (see the entry at robtex.com).
You should now look how often those packets arrive or have a look if your connection speed is degraded. When there is really a Denial of Service attack going an, you will definitely 'feel' it. If the guy just send some 10 or 100 packets to your routers it is highly unlikely that he really started a DoS attack.
So in general you should try to keep calm and analyze the logs of your router if you fnd further evidence.
