1

I've read about it a little but I'm concerned. It never happened before and for last 5 hours my router gets kernel: Intrusion alerts similar to these:

info

As soon as the kernel: Intrusion is detected, it drops my ADSL line connection. I have dynamically assigned IP from my ISP, so I doubt it's DDoS.

So what can it be? I guess normal kernel intrusions don't disconnect you from network, do they?

What can I do to stop it from disconnecting me? It's been 5 hours and a disconnect every 2-5 minutes...

I know that the 'intrusions' being detected are harmless from other posts, but they are disconnecting me. There's no other explanation.

1

Your link goes down about 3 minutes after the "intrusion" has been detected. It's highly unlikely that the disconnect has been caused by one of these network packets.

The packets look like regular scans (SYN packet to TCP port 22 - that's a classic, the other is a proxy scan - looking for squid at 3128), I have serious reservations that this is something that can disrupt your connection. DDoS it isn't, you'd be seeing a LOT more packets if this was a proper DDoS.

Possible scenarios:

  1. Buggy ADSL router firmware. Try turning off some of the "security" features of your router firewall (e.g. SPI firewall, DDoS protection, etc.), and testing whether this would make any difference. You may also want to look at firmware updates, or running a good open source firmware (e.g. Tomato).

    1. Overheating chipset. Happened quite frequently with el-cheapo routers and poor heat dissipation design - dropping ADSL. Try shutting down your router for a few minutes and starting it again.

    2. Disturbance/problems with the ADSL line (most likely). You need to talk to your service provider, or have a look at ADSL diagnostics, e.g. S/N ratio, BER, etc.

Good luck and let us know how you get on with this.

  • Thanks, I will. Also, since I have Never seen kernel intrusions before, could that be that they were blocked by my ISP's firewall before it was reaching me, and now I see them because ISP turned it off? – VixinG Jul 26 '15 at 14:45
  • Strictly speaking, DDoS doesn't have to involve lots is traffic, only that your service is disrupted for legitimate users. Volumetric DDoS is the most commonly talked about, but it isn't the only type of DDoS – Lie Ryan Jul 26 '15 at 16:30
  • Strictly speaking, DDoS involves lots of packets, simply because we're talking about the distributed nature of the traffic. You've got the volumetric bit here confused - volumetric attacks are not necessarily DDoS and vice versa. And I did not confuse the number of packets with traffic volume. I just can't consider 2 packets to be DDoS, where's the D here? – Milen Jul 26 '15 at 16:36
  • It's unlikely that traffic was being blocked by your ISP - typically ISPs follow the "lowest resistance" route and only apply any sort of packet filtering that serves their own interest (not necessarily overlapping with yours). For example, they would throttle traffic down or perform traffic "engineering", but would rarely use an IPS. Having worked at several ISPs, some do apply some rudimentary DoS protection for customers, but that's an exception rather than the rule. – Milen Jul 26 '15 at 16:43
  • Kernel intrusion is caused by an iptables rule - iptables being a kernel module, that's why it looks like it's coming from the kernel itself. – Milen Jul 26 '15 at 16:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.