NETGEAR is aware of a growing number of phone and online scams. To learn how to stay safe click here.
Forum Discussion
Solved
DOS Attacks
how can I stop DOS attacks
Petiel315 wrote:
how can I stop DOS attacks
If this is in reference to entries appearing in the Orbi log file saying the router has detected a pattern of connection attempts (more than a couple) and has classified the pattern to be typical of a class of penetration attempts, then there is nothing the user can do to prevent them. All the user can do is choose to have the router stop identifying and logging them.
- If you have a phone number, what can you do to prevent robots from calling the number and offering to sell you "drought tolerant landscaping" or extending your car warranty? Nothing.All you can do is screen your calls and refuse to answer calls from numbers you do not recognize.
- If you have a mailbox, what can you do to prevent people from sending you junk mail? Nothing. All you can do is empty the mailbox and throw away any mail you do not want to open.
- If your front door is accessible from the street, what can you do to prevent people from ringing the doorbell and offering to sell you solar panels, Girl Scout cookies, or pray for you? Nothing. All you can do is refuse to answer the door.
If the router has a public IP address, there is nothing the customer can do to prevent connection attempts.
As oPusBlooM pointed out, if the connection attempts are from an IP address on the internal LAN, that is something to worry about.
Petiel315 wrote:
how can I stop DOS attacks
If this is in reference to entries appearing in the Orbi log file saying the router has detected a pattern of connection attempts (more than a couple) and has classified the pattern to be typical of a class of penetration attempts, then there is nothing the user can do to prevent them. All the user can do is choose to have the router stop identifying and logging them.
- If you have a phone number, what can you do to prevent robots from calling the number and offering to sell you "drought tolerant landscaping" or extending your car warranty? Nothing.All you can do is screen your calls and refuse to answer calls from numbers you do not recognize.
- If you have a mailbox, what can you do to prevent people from sending you junk mail? Nothing. All you can do is empty the mailbox and throw away any mail you do not want to open.
- If your front door is accessible from the street, what can you do to prevent people from ringing the doorbell and offering to sell you solar panels, Girl Scout cookies, or pray for you? Nothing. All you can do is refuse to answer the door.
If the router has a public IP address, there is nothing the customer can do to prevent connection attempts.
As oPusBlooM pointed out, if the connection attempts are from an IP address on the internal LAN, that is something to worry about.
I apologize, I do realize this is an old topic and I detest necroing old dusty forum posts ... but this is still out there for people to read who presumably are seeking assistance or perhaps enlightenment ... and I found the logic used as justification for doing quite literally nothing to alleviate a valid real world concern to be .... extremely disturbing.
So, do please forgive me therefore if I should continue ....
the whole "can do nothing" type statements (as you put it, several times in fact) are not only false and sadly misleading but are entirely indefensible. You really should own the fact that Netgear generally does not offer products which are worth purchasing, at any price point. Especially if they fail to provide some degree of control over the traffic which passes through their devices in question. (And as I see it, that pretty much covers the lot of it ... excepting those devices which I have not yet had the dis-satisfaction of working with. And spanning a 27+ year career in IT as a systems and network engineer, that doesn't leave too many devices that I have no direct working knowledge about. But I digress...)
With all of that having been said, there COULD be a lot that a person with this specific issue SHOULD be able to do IF the device allowed something as simple as SSH access to its CLI through the use of any number of tools ... for the sake of simplicity and elegance, lets take a brief look at iptables for example. If nothing else (and there are a lot of other possible solutions which COULD alleviate this specific concern to 100% customer satisfaction ... not none of them are "at present" possible; out of the box anyway and for most which could be "made" to allow the use of such tools ... language to the effect of voided warranty and you are on your own etc... is thrown around ad nauseum. So what? Its not like anyone has EVER been able to squeeze a single useful bit of information from Netgear support anyway, beyond what is generally considered common knowledge among those "in the industry". Netgear takes this position for one simple reason .... Netgear does not want you to be able to have access to perform those types of tasks on their equipment. They go to rather extensive lengths to try and ensure this .... I can only make wild guesses as to why that might be, especially when considering that the technology for performing said tasks is nothing new or bleeding edge, in fact, by and large most of it has been around for longer than Netgear has been a company which sells networking equipment, I'd wager. And it would cost Netgear nothing to allow that access or to provide access to those tools ... or .... would it?
Would that position somehow affect revenue for Netgear? Would profit losses occur to such a degree as to warrant such an "Amazon-esque" type attitude toward traffic control due to lost revenue from its userbase no longer having to pay some asinine service fee or temporary support subscription giving them access to a tech monkey in some far away land to be tasked with performing these mundane tasks for the customer? Assuming of course that they even WOULD in any event. Policy and all that.
Am I getting warm? No?
Well of course not, since when has any tech support person (paid or not) provided a customer with actual assistance any real world need beyond what was packaged and sold as part of the marketted and cellophane sealed box known globally as "The Product" ™. Also, not that it matters, those "Products" all too often come with incorrect information in the form of what passes as documentation manifesting itself in the form of what is globally known as "The Users Manual"™ ? How many trees had to die for the combined total of all those utterly useless pages of typed content? I shudder to consider it.
My long overdue point is this .... try just a tiny bit to offer positive advice and correct information now and then. People will take notice. You might even find that the world, in some very small way, becomes a slightly more tolerable and enjoyable place to exist within .... at least for one person, maybe a great number more. And isn't THAT whats worth waking up for each day?
Maybe not. Afterall, the world is ultimately whatever we decide to make it, isn't it? We have a very very long way to go.
So, do please forgive me therefore if I should continue ....
the whole "can do nothing" type statements (as you put it, several times in fact) are not only false and sadly misleading but are entirely indefensible. You really should own the fact that Netgear generally does not offer products which are worth purchasing, at any price point. Especially if they fail to provide some degree of control over the traffic which passes through their devices in question. (And as I see it, that pretty much covers the lot of it ... excepting those devices which I have not yet had the dis-satisfaction of working with. And spanning a 27+ year career in IT as a systems and network engineer, that doesn't leave too many devices that I have no direct working knowledge about. But I digress...)
With all of that having been said, there COULD be a lot that a person with this specific issue SHOULD be able to do IF the device allowed something as simple as SSH access to its CLI through the use of any number of tools ... for the sake of simplicity and elegance, lets take a brief look at iptables for example. If nothing else (and there are a lot of other possible solutions which COULD alleviate this specific concern to 100% customer satisfaction ... not none of them are "at present" possible; out of the box anyway and for most which could be "made" to allow the use of such tools ... language to the effect of voided warranty and you are on your own etc... is thrown around ad nauseum. So what? Its not like anyone has EVER been able to squeeze a single useful bit of information from Netgear support anyway, beyond what is generally considered common knowledge among those "in the industry". Netgear takes this position for one simple reason .... Netgear does not want you to be able to have access to perform those types of tasks on their equipment. They go to rather extensive lengths to try and ensure this .... I can only make wild guesses as to why that might be, especially when considering that the technology for performing said tasks is nothing new or bleeding edge, in fact, by and large most of it has been around for longer than Netgear has been a company which sells networking equipment, I'd wager. And it would cost Netgear nothing to allow that access or to provide access to those tools ... or .... would it?
Would that position somehow affect revenue for Netgear? Would profit losses occur to such a degree as to warrant such an "Amazon-esque" type attitude toward traffic control due to lost revenue from its userbase no longer having to pay some asinine service fee or temporary support subscription giving them access to a tech monkey in some far away land to be tasked with performing these mundane tasks for the customer? Assuming of course that they even WOULD in any event. Policy and all that.
Am I getting warm? No?
Well of course not, since when has any tech support person (paid or not) provided a customer with actual assistance any real world need beyond what was packaged and sold as part of the marketted and cellophane sealed box known globally as "The Product" ™. Also, not that it matters, those "Products" all too often come with incorrect information in the form of what passes as documentation manifesting itself in the form of what is globally known as "The Users Manual"™ ? How many trees had to die for the combined total of all those utterly useless pages of typed content? I shudder to consider it.
My long overdue point is this .... try just a tiny bit to offer positive advice and correct information now and then. People will take notice. You might even find that the world, in some very small way, becomes a slightly more tolerable and enjoyable place to exist within .... at least for one person, maybe a great number more. And isn't THAT whats worth waking up for each day?
Maybe not. Afterall, the world is ultimately whatever we decide to make it, isn't it? We have a very very long way to go.
CSLV69 wrote:
the traffic which passes through their devices in question.And this is the crux of the matter. Orbi routers (a) do not accept connections from the internet, and (b) pass through data only on connections which have been opened by a device inside the router network. All of those Orbi log entries describing "DoS Attacks" are simply reports of attempted connections which the firmware has decided fit a "pattern".
There is (literally) nothing any user can do to prevent people on the internet from attempting to make connections to their public IP address.
We can choose not to answer telephone calls from numbers we do not recognize (or any calls at all). We can choose not to open letters we receive unless we recognize the sender has a legitimate relationship with us (or not open any mail at all). We can choose not to answer a knock on the door. But we cannot stop people from calling our phones, sending us mail, or ringing our doorbell.
Our Orbi router already chooses not to accept connection attempts and passes data only through existing connections opened by our own devices.