NETGEAR is aware of a growing number of phone and online scams. To learn how to stay safe click here.
Forum Discussion
DoS Attack Trivia
Users sometimes post questions about whether the Denial of Service (DoS) attacks that Orbi posts to the log are causing their Orbi's to fail. I have kept logs for quite some time, and thought it wou...
Thanks for the summary and tips. Our SSR60 keeps logging a wide variety of DOS attacks, with no apparent ill effect.
Only lately have there been ARP attacks from ... one of the satellites? If this was just a problem with NG's algorithm, isn't it odd? You'd think they would be able to account for their own equipment.
Or does it actually mean that something's up with the satellite?
Any advice would be appreciated.
Oldguy18 wrote:
Only lately have there been ARP attacks from ... one of the satellites? If this was just a problem with NG's algorithm, isn't it odd? You'd think they would be able to account for their own equipment.
Or does it actually mean that something's up with the satellite?
I hav no information on how the Orbi Dos Analysis works. In a technical sense, I believe they have put hooks into the Linux 'iptables' software that processes packets into and out of the Orbi.
If the Orbi Pro (SRR60) has the same features as the residential Orbi (RBR50), and the reports of ARP attacks from inside the LAN occur a lot, I would use the option on the debug page to Enable LAN/WAN packet capture and then use Wireshark to see how many packets there are and verify that they are in fact coming from a satellite and what IP is being asked about. The point of ARP packets is to make the connection between an IP address and the ethernet MAC address of a device. If a satellite is constantly asking "Who has this IP? Who has this IP?", I would want to know which IP it's asking about. Maybe there's a misconfiguration somewhere and a device constantly wants something but has the wrong IP address for it.
Thanks for the suggestions -- it hadn't occurred to me that the ARP might be legit -- I guess the 'DOS Attack' message put me off. Can't seem to find a 'debug' page on my router's interface. Is there somewhere else I should be looking?
On the residential Orbi product, there is a web page http://orbilogin.net/debug.htm that has some interesting information and options. I have never had access to the "Pro" model to learn if it has a similar feature.
That works, thanks -- there's just no launch from the main UI.