4

today I checked the log of my home router and I've found a series of port scan from different IP:

[DoS attack: ACK Scan] from source: 90.1.69.89:1158 Monday, June 15,2015 11:12:14            
[DoS attack: ACK Scan] from source: 54.172.3.106:57339 Monday, June 15,2015 11:08:43            
[DoS attack: ACK Scan] from source: 93.49.225.168:50743 Monday, June 15,2015 11:07:39                   
[DoS attack: ACK Scan] from source: 54.172.3.106:57339 Monday, June 15,2015 11:03:42            
[DoS attack: ACK Scan] from source: 2.39.195.228:42943 Monday, June 15,2015 11:03:21            
[DoS attack: ACK Scan] from source: 93.149.65.227:13056 Monday, June 15,2015 11:02:13            
[DoS attack: ACK Scan] from source: 78.200.20.149:62514 Monday, June 15,2015 11:01:32            
[DoS attack: ACK Scan] from source: 89.89.139.26:4046 Monday, June 15,2015 11:00:20            
[DoS attack: ACK Scan] from source: 78.200.20.149:56318 Monday, June 15,2015 10:58:54            
[DoS attack: ACK Scan] from source: 90.14.239.165:50872 Monday, June 15,2015 10:58:32            
[DoS attack: ACK Scan] from source: 109.20.160.134:1217 Monday, June 15,2015 10:57:12            
[DoS attack: ACK Scan] from source: 90.12.246.15:60502 Monday, June 15,2015 10:56:50            
[DoS attack: ACK Scan] from source: 90.14.239.165:50796 Monday, June 15,2015 10:56:09            
[DoS attack: ACK Scan] from source: 90.12.246.15:60487 Monday, June 15,2015 10:55:49            
[DoS attack: ACK Scan] from source: 109.20.160.134:4674 Monday, June 15,2015 10:51:40            
[DoS attack: ACK Scan] from source: 92.136.219.78:63117 Monday, June 15,2015 10:51:18            
[DoS attack: ACK Scan] from source: 92.136.219.78:63117 Monday, June 15,2015 10:50:57            
[DoS attack: IP Spoofing Attack] from source: 192.168.0.10 Monday, June 15,2015 10:50:25            
[DoS attack: ACK Scan] from source: 88.168.160.142:52687 Monday, June 15,2015 10:49:30            
[DoS attack: ACK Scan] from source: 90.39.238.30:55837 Monday, June 15,2015 10:48:49            
[DoS attack: ACK Scan] from source: 109.20.160.134:4429 Monday, June 15,2015 10:48:06            
[DoS attack: ACK Scan] from source: 109.20.160.134:4429 Monday, June 15,2015 10:47:46            
[DoS attack: ACK Scan] from source: 78.124.99.225:51579 Monday, June 15,2015 10:44:37                     
[DoS attack: ACK Scan] from source: 79.81.205.41:56038 Monday, June 15,2015 10:43:09            
[DoS attack: ACK Scan] from source: 78.200.20.149:55225 Monday, June 15,2015 10:42:28            
[DoS attack: ACK Scan] from source: 2.39.195.228:53617 Monday, June 15,2015 10:39:40            
[DoS attack: ACK Scan] from source: 2.39.195.228:51786 Monday, June 15,2015 10:30:00            
[DoS attack: ACK Scan] from source: 2.39.195.228:50828 Monday, June 15,2015 10:25:40            
[DoS attack: RST Scan] from source: 188.121.36.239:80 Monday, June 15,2015 10:22:52                      
[DoS attack: ACK Scan] from source: 2.39.195.228:65427 Monday, June 15,2015 10:13:19            
[DoS attack: ACK Scan] from source: 66.119.63.93:80 Monday, June 15,2015 10:09:33            
[DoS attack: ACK Scan] from source: 93.149.19.108:62013 Monday, June 15,2015 10:09:12            
[DoS attack: ACK Scan] from source: 93.149.19.108:62013 Monday, June 15,2015 10:08:29            
[DoS attack: RST Scan] from source: 23.21.184.61:443 Monday, June 15,2015 10:07:27            
[DoS attack: ACK Scan] from source: 90.31.134.6:64600 Monday, June 15,2015 10:04:58            
[DoS attack: ACK Scan] from source: 88.122.210.119:54055 Monday, June 15,2015 10:03:35            
[DoS attack: ACK Scan] from source: 88.185.97.103:61084 Monday, June 15,2015 10:03:14            
[DoS attack: ACK Scan] from source: 84.96.88.112:52459 Monday, June 15,2015 10:02:14            
[DoS attack: ACK Scan] from source: 88.185.97.103:59048 Monday, June 15,2015 10:00:52            
[DoS attack: ACK Scan] from source: 151.41.37.24:11476 Monday, June 15,2015 10:00:29            
[DoS attack: ACK Scan] from source: 82.246.74.78:61934 Monday, June 15,2015 09:58:04            
[DoS attack: ACK Scan] from source: 90.62.167.232:56813 Monday, June 15,2015 09:57:44            
[DoS attack: ACK Scan] from source: 88.162.97.37:64889 Monday, June 15,2015 09:57:22                      
[DoS attack: ACK Scan] from source: 82.246.74.78:61934 Monday, June 15,2015 09:56:40            
[DoS attack: ACK Scan] from source: 192.167.208.145:63666 Monday, June 15,2015 09:52:49            
[DoS attack: ACK Scan] from source: 93.45.165.134:59565 Monday, June 15,2015 09:50:24            
[DoS attack: ACK Scan] from source: 151.52.221.83:58043 Monday, June 15,2015 09:49:20            
[DoS attack: ACK Scan] from source: 93.45.165.134:59565 Monday, June 15,2015 09:47:12            
[DoS attack: ACK Scan] from source: 95.235.15.194:56262 Monday, June 15,2015 09:45:15            
[DoS attack: ACK Scan] from source: 87.4.103.222:62867 Monday, June 15,2015 09:44:24            
[DoS attack: ACK Scan] from source: 151.52.221.83:58043 Monday, June 15,2015 09:38:37            
[DoS attack: ACK Scan] from source: 23.37.43.27:80 Monday, June 15,2015 09:37:50            
[DoS attack: RST Scan] from source: 108.160.172.236:443 Monday, June 15,2015 09:36:59            
[DoS attack: ACK Scan] from source: 23.41.25.5:80 Monday, June 15,2015 09:36:58                        
[DoS attack: ACK Scan] from source: 80.180.193.193:49907 Monday, June 15,2015 09:32:54                  
[DoS attack: RST Scan] from source: 82.48.54.105:27778 Monday, June 15,2015 09:27:18            

I've never checked the log of my router but this rate of scan seem really out of ordinary. I've also tried to do a scan from my internal computer using my external ip address:

nmap -sS external.ip.address

and all the ports resulted filtered. Now,is this the normal rate of scan that an home router is subject? Other post in the forum were about a single ip doing port scan,but here i'm being scanned from different source each time.

  • Ehm,i really think that it report [Dos attack: ACK Scan] because a port scan can be effectively used to do a Dos so it report both that is a Dos and that is a port scan. – Azazel Jun 15 '15 at 10:55
  • since it is flooding your filters it can be done slow – Skaperen Jun 15 '15 at 10:55
  • the attacker wants you to turn off your filters. check earlier logs. – Skaperen Jun 15 '15 at 10:58
  • I don't have earlier logs.I've installed the router this morning.(In the old one i've never checked the log). – Azazel Jun 15 '15 at 11:24
  • 1
    is it a normal rate? well... it does look similar to what I experience in my home router but I dont have it at hand to provide an example. It looks like your router is doing a good job at stopping these requests though – Purefan Jun 15 '15 at 12:44
1

You are assuming that it is a flood, but you also state that you have never looked at the logs before. Until you get a good baseline, you can't determine if this level of traffic is unusual.

From my experience, ~30/hour is not a significant "flood" but merely the normal "background radiation" of the Internet.

0

I think what's going on is two things:

  • There may be some normal scans coming in to your IP from botnets and academic institutions that scan the internet, but that's not the majority of what you're seeing.

  • Your legitimate traffic is being false-positive flagged in your router as being DoS attack-related packets.

A search of the ARIN and RIPE databases reveals that many of these supposed "attacker" IPs are almost certainly legitimate and operated by companies with significant security unlikely to be conducting DoS attacks:

Examples: 23.41.25.5 -- Akamai, probably related to Windows Updates or many other downloads 108.160.172.236 - Dropbox

But mostly, I believe this traffic is related to your own legitimate activity getting falsely flagged as DoS because the denial of service protection on this particular router is of low quality.

In addition, the log shows an "IP Spoofing" detection from your LAN at 192.168.0.10. I'm going to also bet that is a false positive.

To touch on your point about nmap, having nmap against your public IP indicate all ports are filtered simply means no ports are exposed to the internet.

To resolve this issue I'd recommend switching off the DoS protection on your router. In a real DoS event, this will do very little to protect you as the firewall will not prevent the packets from coming in the first place. In order to mitigate a real DoS attack, you need protection upstream from your router.

  • The device categorizes the traffic as mostly ACK scans, which could trigger DoS events in older equipment. – schroeder Jun 15 '15 at 19:20
  • Ok,as i said when answering to Purefan I know that netgear router are alarmists(low level protection) and that some of the packet are actually legitimate traffic,but a lot of the ip shown are actually from proxyad,xfernet... and others host that are known to allow illegal activity.Maybe it's just that I don't have the measure of what is the background noise of internet,so I've just over reacted. – Azazel Jun 15 '15 at 19:46
  • Yes, I don't see anything in the logs to indicate this is above typical "background noise" level, but also noisy false alarms seem to be most of it. – Herringbone Cat Jun 15 '15 at 20:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.