0

I have huge problem with my router: Sagem F@st 3202.

Here are some Security log events:

Inbound Traffic | Blocked - Default policy | TCP XX.XX.XX.XXX:80->XX.X.XX.XX:51707 on ppp0 [repeated 3 times, last time on Apr 23 02:32:08 2014]

Inbound Traffic | Blocked - Spoofing protection | IGMP 192.168.4.1->224.0.0.1 on eth2

Inbound Traffic | Blocked | Packet invalid in connection, tcp reset attack is suspected: TCP [repeated 2 times, last time on Apr 23 02:35:02 2014]

The events repeat all the time during last 24 hours.

Could you help me to identify the attack? It would be very helpful to define the attacker. Is it possible that it's some kind of wardriving? Is it a random or planned attempt?

Improve this question
1
  • How do you know it's a man-in-the-middle attack? Do you even know what that is?
    – noɥʇʎԀʎzɐɹƆ
    Jun 26, 2016 at 21:00

1 Answer 1

Reset to default
2

You could go and do a GeoIP lookup on the IP address, given that it's not spoofed (which 9/10 times it is). If the IP isn't hopping too much, you could create a drop rule to block traffic from that IP. You may even be able to drop the subnet given all the source IP's are in that subnet. It seems like they are throwing random attacks at you. There isn't a lot of information to go on with this post. Perhaps you have more log entries with different information? Are there any IP addresses that you can provide that are not your own?

Improve this answer
21
  • Thank you for fast answer. The list of IPs is huge, and they have random GeoIP results from whole world (something like Tor). I'm preparing much more data to present. Could you help me to recognize the type and purpose of the attack? It's very important for me. Is it a planned surveillance or just a random problem. It started several hours after I configured OTR messaging in my client program. I use the computer and Internet connection only in legal way, and I've started using private chatting and browsing only to protect my privacy. Should I call the police and ask them for help?
    – David
    Apr 23, 2014 at 2:20
  • Also, I would like to point that I have had some problems with stalker, and it may be the second attempt of stalking and violating my privacy. This time I would like to immediately perform appropriate actions.
    – David
    Apr 23, 2014 at 2:21
  • Important note: currently the WiFi is turned off, only Bluetooth stays on (the router backend has no option do disable it). I use only ethernet connection. The router is also resetting very often, sometimes more than 10 times per hour.
    – David
    Apr 23, 2014 at 2:24
  • David, I would recommend getting yourself a wired only modem. Bluetooth is practically less secure than WiFi. The attack looks like it's a TCP reset attack where the attacker is purposefully closing connections. I do recognize that your logs show some spoofing detections, but without IP addresses (at least first 2 octets) I can't tell much.
    – PTW-105
    Apr 23, 2014 at 3:08
  • Apr 23 03:43:49 2014 Inbound Traffic Blocked - Default policy TCP 93.191.101.181:50400->X.X.X.X:8088 on ppp0 Apr 23 03:43:48 2014 Inbound Traffic Blocked - Default policy TCP 93.191.101.181:65176->X.X.X.X:8088 on ppp0 Apr 23 03:43:46 2014 Inbound Traffic Blocked - Default policy TCP 93.191.101.181:62069->X.X.X.X:8090 on ppp0 Apr 23 03:43:45 2014 Inbound Traffic Blocked - Default policy TCP 93.191.101.181:60499->X.X.X.X:8090 on ppp0
    – David
    Apr 23, 2014 at 3:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .