4

I was experiencing very low connectivity on my wireless, so I checked the router logs. Here's what I saw:

Jul 09 11:07:24 Per-source ACK Flood Attack Detect (ip=74.125.130.129) Packet Dropped
Jul 09 11:07:24 Whole System ACK Flood Attack from WAN Rule:Default deny
Jul 09 11:06:24 Per-source ACK Flood Attack Detect (ip=74.125.200.189) Packet Dropped
Jul 09 11:06:24 Whole System ACK Flood Attack from WAN Rule:Default deny
Jul 09 11:05:24 Port Scan Attack Detect (ip=74.125.200.113) Packet Dropped
Jul 09 11:05:24 Per-source ACK Flood Attack Detect (ip=74.125.200.113) Packet Dropped
Jul 09 11:05:24 Whole System ACK Flood Attack from WAN Rule:Default deny
Jul 09 11:04:24 Per-source ACK Flood Attack Detect (ip=74.125.200.113) Packet Dropped
Jul 09 11:04:24 Whole System ACK Flood Attack from WAN Rule:Default deny
Jul 09 11:03:24 Per-source ACK Flood Attack Detect (ip=74.125.200.189) Packet Dropped

....


Jul 09 10:40:24 Per-source UDP Flood Attack Detect (ip=74.125.68.189) Packet Dropped
Jul 09 10:40:24 Per-source ACK Flood Attack Detect (ip=74.125.68.189) Packet Dropped
Jul 09 10:40:24 Whole System ACK Flood Attack from WAN Rule:Default deny
Jul 09 10:40:24 Whole System UDP Flood Attack from WAN Rule:Default deny
Jul 09 10:39:24 Per-source ACK Flood Attack Detect (ip=74.125.200.95) Packet Dropped
Jul 09 10:39:24 Whole System ACK Flood Attack from WAN Rule:Default deny
Jul 09 10:38:24 Per-source UDP Flood Attack Detect (ip=74.125.68.189) Packet Dropped
Jul 09 10:38:24 Per-source ACK Flood Attack Detect (ip=74.125.130.81) Packet Dropped
Jul 09 10:38:24 Whole System ACK Flood Attack from WAN Rule:Default deny
Jul 09 10:38:24 Whole System UDP Flood Attack from WAN Rule:Default deny

This is a partial log. As it can be seen the IP address logged as an attacker keeps on changing. I suspect this ACK Flood Attack is killing my Internet connectivity, am I correct?

I tried blocking these addresses, but the router administration page just allows to block ips falling in the same subnet. How do I block this attack? Also, does this flood attack count in my Internet bandwidth usage?

What actions need to be taken for

  1. Securing my router from such connections(it's already dropping those packets so I suppose it's secure, but still it's denying me external connectivity, which is what I want to get secured against too).
  2. In case the bandwidth is counted against my usage, as seen by my ISP which is billable to me, I don't want to pay for.

Note: I checked some of these IPs, and it seems to be the company I work for. That makes me rethink, is it the reason for low connectivity?

  • 1
    You need to check the usage terms of your ISP to learn if that traffic is counted or not. Different ISPs have different ways of counting traffic. – Philipp Jul 9 '15 at 6:58
1

Apparently this traffic is coming from the Google Network:

NetRange: 74.125.0.0 - 74.125.255.255

CIDR: 74.125.0.0/16

NetName: GOOGLE

I'd recommend to send an abuse e-mail with the logs attached to:

OrgAbuseEmail: arin-contact@google.com

Are you running any services? Could it be a Google bot crawling you too fast? (At least for the ACK part of the logs)

1

@Jeroen-it-nerdbox is right and that is my recommended course of action as well. However I will try to contribute to a more general situation (when its not a legitimate company). Still the bandwidth situation is something you need to check with your ISP.

As for the attack itself, when a request comes from an external network it reaches your router first, which tries to map the request to a device connected to it, this is called port forwarding. If there isn't a device available to take this request (you do not have any web server or you have port forwarding disabled) the router's firewall should drop the packet. An ACK flood attack is indeed not targeted at finding vulnerabilities in a web server or your laptop, its meant to flood a network and make it unresponsive, so depending on the size of the attack this can have a very tangible effect in your network performance.

Some routers have a protection called Anti Spoofing, because an ACK attack fakes the return IP this mechanism is effective against this type of attack, I suggest you look into your router's settings and if its available then to enable it. Also, some routers allow remote administration, I suggest to disable that even though this attack isn't meant to exploit privileges.

Another way to protect your network if your router doesn't help, is to get a cheap switch, most switches do have rate-limiting features, deep packet inspection and even bogus ip filtering.

  • 1
    Thanks, I forgot to add, these logs are from my router. The fact that these IPs belong to Google, the company I work for, makes me think that this may be a part of actions to secure my connection to their network, just guessing. – 0xc0de Jul 9 '15 at 8:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.