Is it just me?

Question

Starting July 1, my Orbi logs have been filling up with [DoS Attack: SYN/ACK Scan] on port 80 entries from all the IP's in the 212.133.164.x subnet.&nbsp; If the IP's are not being spoofed, then this from Ankara, Turkey.&nbsp; This sort of thing happens from time to time, and usually whoever is doing it either tires of the exercise or accomplishes whatever they intended and the scans stop. Continuing for six days is a bit unusual.&nbsp; No effect on the performance of my Orbi, but I wonder are others seeing the same phenomenon?

UK_Wildcats · Answer

I have a XR700 router, and I have been seeing a LOT of the same subnet DOS attacks in my system logs.&nbsp; In addition, I have been have a lot more internet disruptions that correlate to the same times as this DOS attacks in the logs.

CrimpOn · Answer

UK_Wildcats&nbsp;wrote:I have a XR700 router, and I have been seeing a LOT of the same subnet DOS attacks in my system logs.&nbsp; In addition, I have been have a lot more internet disruptions that correlate to the same times as this DOS attacks in the logs.Thanks for responding.&nbsp; day 10 and "still going..." (like the Energizer Bunny). I would think after hammering at port 80 and never getting a connection, this goofball would move on to something else.&nbsp;My Orbi does not seem bothered by the connection attempts.&nbsp; I have PingInfoView from Nirsoft pinging three DNS servers every 30 seconds (CloudFlare, Google, and Cloud Nine)&nbsp; Out of the last 10,000 or so pings, only a handful have failed to respond and they do not seem to be "clustered".&nbsp; i.e. One of the three will miss a ping, but not the other two.&nbsp; ICMP is a UDP packet, which is not guaranteed to be delivered, so there is no way to know whether the missing ping isa packet that never reached the DNS servera packet that got dropped somewhere along the way backa packet that arrived at my Orbi but the Orbi was "too busy" to process itThere could be different types of DoS attacks that have greater impact on the Orbi, or my experiment is flawed, but so far I do not see a strong correlation beteen Orbi log entries and service disruptions.&nbsp;I really wish Netgear had published something describing how the DoS attack mechanism works.&nbsp; Surely a single connection attempt is not enough to be called an "attack".&nbsp; Would it be 10? 20?&nbsp; 100?&nbsp; No idea.

FURRYe38 · Answer

I'm currently seeing some entries from this address:23.62.78.137Some other entries but mostly from this domain:&nbsp;23.62.

CrimpOn · Answer

FURRYe38&nbsp;wrote:I'm currently seeing some entries from this address:23.62.78.137Some other entries but mostly from this domain:&nbsp;23.62.Looks as if this phenomenon is geographically different.&nbsp; I collect log files from two Orbi systems in the US (East Coast, West Coast) and have combined the DoS log reports from July 1 through mid July 10. (11,634 log entries).&nbsp; Put them in an Excel file that can be sorted on various columns. On Dropbox at https://www.dropbox.com/s/i2qmfep2v6e0y2d/July-1-10-Attacks.xlsx?dl=0&nbsp;&nbsp; (My parsing algorithym messed up a couple of entries.)&nbsp;It is bizzare. Some hit both systems, others only one.&nbsp; I can see trying ports 80, 443, 8080, etc. but some of the port numbers are just strange.

SGINAZ · Answer

Same, same. &nbsp;Flooded with hits on port 80 from that subnet. &nbsp;Seems to be slacking off a little now but still going. &nbsp;Like you, no apparent impact from the noise.

Forum Discussion

Is it just me?

9 Replies