NETGEAR is aware of a growing number of phone and online scams. To learn how to stay safe click here.
Forum Discussion
What the Hell is a Dos Attack
I have an orbi rbr 50 as my router connected to an xfinity modem, we have the fastest internet available from them yet I get constant slow downs when downloading from any game service many times. There's usually at least 8-10 devices connected total and we have one orbi satellite for the security cameras and laptop in the front of the house. And being curious as to what is going on I found the router logs on the portal, and have no idea what to make of it. Anyone have a clue what the hell all of these dos atttacks are?
log is in this pastebin: https://pastebin.com/Zb5BzThQ
10 Replies
What Firmware is currently loaded?
What is the Mfr and model# of the ISP modem the NG router is connected too?https://en.wikipedia.org/wiki/Denial-of-service_attack
Use this tool to look up those IP addresses. You may need to ask your ISP for some help on this if your getting attacked.
Router has the latest firmware, V2.3.5.30, and the isp modem is the Xfinity xFi Advanced Gateway and the model # is: CGM4140COM.
Modem/Gateway Combo Units:
This would be a double NAT condition which isn't recommended. https://kb.netgear.com/30186/What-is-Double-NAT
Couple of options,
1. Configure the modem for transparent bridge mode. Then use the Orbi router in router mode. You'll need to contact the ISP for help and information in regards to the modem being bridged correctly.
2. If you can't bridge the modem, disable ALL wifi radios on the modem, configure the modems DMZ/ExposedHost or IP Pass-Through for the IP address the Orbi router gets from the modem. Then you can use the Orbi router in Router mode.
3. Or disable all wifi radios on the modem and connect the Orbi router to the modem, configure AP mode on the Orbi router. https://kb.netgear.com/31218/How-do-I-configure-my-Orbi-router-to-act-as-an-access-point and https://www.youtube.com/watch?v=H7LOcJ8GdDo&app=desktop
christianjb wrote:Anyone have a clue what the hell all of these dos atttacks are?
Others are helping with the performance issue. The term "DoS" stands for Denial of Service. The Orbi firewall detects when the same IP address sends a number of similar packets which could be interpreted as an attempt to "flood" the Orbi to the point that it is unable to respond. e.g. Denying the router the ability to perform service. The Orbi firewall discards all of those packets and puts an entry in the log.
Occasionally, the news will report that somoe group of hackers has attempted a DoS attack on some entity, such as by using thousands of "bots" to bombard Google (or someone) with email or web requests in an attempt to force them out of service.
NOTE: if some "evil doers" REALLY performed a DoS on an Orbi, then performance would drop to nearly zero and remain that way until they quit. I have accumulated all of my Orbi log files since March. Every month there are dozens and dozens of these reports, yet my Orbi works fine.
These DoS entries are normal. They are not related to your issue.
