DoS Attack: SYN/ACK Scan

---

nagendraprasath wrote:

I keep seeing below logs in my Orbi router. What does "DoS Attack: SYN/ACK Scan" signifies? Also am not sure why it prints "DHCP IP: <ip>" for all connected devices? DHCP has a lease time of 24hrs?

---

The Orbi log contains a wide variety of items.  DHCP assignment record every time a device uses DHCP to ask Orbi to assign it an IP address.  With a "lease time" of one day (24 hours), the DHCP standard call for the device to request a renewal when the lease is half-expired.  They are entirely normal.  I know of no method to make the Orbi cease logging these events. 

The Orbi firewall refuses all connection attempts except those specifically authorized by the user (see "Port Forwarding" and Remote Management).  The firewall also has some (mysterious) mechanism for determining that a "pattern" of connection requests falls into a recognizable catagory of "scan" or "Denial of Service" attack.  There is an option to have Orbi not include those conclusions in the log.  As an analogy, suppose my practice is to never answer the telephone unless I recognize the calling number.  Calls may come in, but if I do not recognize the caller, I never answer.  I could keep a record of all the "Caller ID's" that I did not answer.  If I seem to get many calls from the same number, I might even decide to highlight them ("aha, the Heart Foundation still wants a donation from me.") and assign them a category ("public appeals for money").  That's what Orbi's firewall is logging.

There are suggestions that Orbi is too aggressive in describing things as "DoS Attacks" or "ACK Scans".  Alas, Netgear publishes nothing about how the firewall makes these determinations.

If they bother you, you can turn off the notices.