5

There are several entries in my router's log file showing recent DoS attempts on some of its ports. They look like this:

[DoS Attack: ACK Scan] from source: 213.61.245.234, port 80, Friday, November 21,2014 11:37:59
[DoS Attack: ACK Scan] from source: 80.239.159.8, port 443, Friday, November 21,2014 11:18:09
...
[DoS Attack: RST Scan] from source: 195.39.197.142, port 30732, Wednesday, November 19,2014 22:12:35
[DoS Attack: ACK Scan] from source: 31.13.91.117, port 443, Wednesday, November 19,2014 17:56:38
[DoS Attack: ACK Scan] from source: 88.221.82.74, port 443, Wednesday, November 19,2014 17:56:33
[DoS Attack: ACK Scan] from source: 31.13.91.117, port 443, Wednesday, November 19,2014 17:56:06
[DoS Attack: ACK Scan] from source: 88.221.82.74, port 443, Wednesday, November 19,2014 17:56:01
[DoS Attack: ACK Scan] from source: 31.13.91.117, port 443, Wednesday, November 19,2014 17:55:50
[DoS Attack: ACK Scan] from source: 88.221.82.74, port 443, Wednesday, November 19,2014 17:55:44
[DoS Attack: ACK Scan] from source: 31.13.91.117, port 443, Wednesday, November 19,2014 17:55:38
[DoS Attack: ACK Scan] from source: 88.221.82.74, port 443, Wednesday, November 19,2014 17:55:36
[DoS Attack: ACK Scan] from source: 31.13.91.117, port 443, Wednesday, November 19,2014 17:55:36
[DoS Attack: ACK Scan] from source: 88.221.82.74, port 443, Wednesday, November 19,2014 17:55:30
[DoS Attack: RST Scan] from source: 128.199.49.106, port 18668, Wednesday, November 19,2014 15:06:46

Tried scanning my router's public IP for open ports:

sudo nmap <my-public-ip> -Pn --reason --top-ports 10

Starting Nmap 6.47 ( http://nmap.org ) at 2014-11-21 16:02 CET
Nmap scan report for <public-hostname> (<my-public-ip>)
Host is up, received user-set.
PORT     STATE    SERVICE       REASON
21/tcp   filtered ftp           no-response
22/tcp   filtered ssh           no-response
23/tcp   filtered telnet        no-response
25/tcp   filtered smtp          no-response
80/tcp   filtered http          no-response
110/tcp  filtered pop3          no-response
139/tcp  filtered netbios-ssn   no-response
443/tcp  filtered https         no-response
445/tcp  filtered microsoft-ds  no-response
3389/tcp filtered ms-wbt-server no-response

I'm curious, how does my router know that each one is a DoS attack in the first place? Are these cases of using nmap aggressively in some way? And should I be worried about these attacks?

  • 5
    You can't scan your router for public open ports using your private IP – Ulkoma Nov 21 '14 at 14:37
  • @Ulkoma You mean I can't scan it using its private IP address, right? Updated the question with a new scan of the public IP. – user24539 Nov 21 '14 at 16:35
  • Is there a reason why you have so many open ports? In particular I doubt for your purposes that you need telnet or ssh. You also probably have remote management on the WAN side enabled given http and https are listening, which is also generally not a good idea. – Brian Duke Nov 22 '14 at 14:27
  • @user3623501 AFAIK, the ports listed are the top 10 most common ports (--top-ports 10) which I performed a scan on. It looks like none of them are open, since I get a filtered state on each one. – user24539 Nov 25 '14 at 17:28
8

Looking up these IP addresses in Google give the following results:

Given the fact that Akamai is a content provider (CDN) which has reportedly been having Facebook as a customer, it seems that this might not be a real DOS attack, and that your router's protection is exaggerating. Is it possible that a lot of your employees/family members use Facebook, which causes a lot of (legitmate) Facebook responses to come in on your router? The router might see this as a DOS-attack, when it is in fact not. This is supported by the fact that the 'scans' come from source port 443, which is the TLS (HTTPS) port. You are connected via HTTPS to Facebook, and they reply to you.

The other IP addresses listed in your question seem a little bit more shifty, but again, this might be a legitimate site which is sending a lot of responses (lots of CSS, JS, etc.). However, the ones that list port 30372 and 18668 are very shifty. These may be part of a massive scan or just a coincidence. I wouldn't worry about them if they don't appear regularly.

  • The router is a cheap Netgear model and it sits at my mothers place. She uses Facebook, so it might be as you say that it's not handling fast traffic through some ports very well and misinterprets it as attacks? – user24539 Nov 21 '14 at 17:17
  • 1
    Yes, I'm pretty sure the ones related to Facebook are legitimate responses. See also this Netgear thread: forum1.netgear.com/showthread.php?t=85972 – Michael Nov 21 '14 at 17:23
4

One packet every 15 seconds does not constitute a DoS attack.

You say this is a basic Netgear router. These routers are usually advertised as having special firmware features to protect you from "Internet threats"; what they actually have is an ordinary NAT router configured to log anomalies in the most alarming language possible. The log entries you're seeing are the result of a primitive IDS going "Look! I'm doing something! I'm doing something!" to try to convince you that there's a real threat it's protecting you from.

88.221.82.74 is part of Akamai's content-delivery network, while 31.13.91.117 is part of Facebook's network. TCP ACKs on port 443 are quite likely legitimate traffic (delayed ACKs of packets that have already been re-sent, or other glitches in the Internet). The other log entries are probably backscatter from DDoS attacks, large-scale automated portscans, and other background noise of the Internet.

1

I cant add a comment at the moment or I would, but I would look into the port 49152 open. There is a known vulnerability within baseboard management controllers that allows admin passwords to be gained pretty easily.

http://arstechnica.com/security/2014/06/at-least-32000-servers-broadcast-admin-passwords-in-the-clear-advisory-warns/

At the moment the nmap scan shows your internal network I would recommend running nmap against your external IP address provided by your internet service provider. You can get it from

http://www.whatsmyip.org/

In regards to your actual question, looks like you might being getting hit but could also just be a mass scan that you are getting included in. Your router is dropping the connections so nothing you need to actually worry about anyway.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy