NETGEAR is aware of a growing number of phone and online scams. To learn how to stay safe click here.
Forum Discussion
Orbi Pro SRR60 DoS attack: STN/ACK Scan
Hi,
Is is normal to see in the Logs (Advanced/Administratio/Logs) to see a lot of dos attack showing up? And is there ways to stop it?
Ans is router/WAN proteced?
Below is a copy of what I see in my log today......
[DoS Attack: SYN/ACK Scan] from source: 52.156.115.24, port 443, Sunday, September 26, 2021 13:04:41
[DoS Attack: RST Scan] from source: 104.68.230.154, port 443, Sunday, September 26, 2021 12:38:25
[DoS Attack: SYN/ACK Scan] from source: 95.217.30.172, port 443, Sunday, September 26, 2021 12:01:00
[DoS Attack: SYN/ACK Scan] from source: 168.119.232.76, port 443, Sunday, September 26, 2021 11:47:12
[DoS Attack: SYN/ACK Scan] from source: 168.119.232.76, port 443, Sunday, September 26, 2021 11:44:05
[DoS Attack: SYN/ACK Scan] from source: 109.230.238.209, port 25644, Sunday, September 26, 2021 11:37:40
[DoS Attack: SYN/ACK Scan] from source: 141.94.181.214, port 65300, Sunday, September 26, 2021 11:20:54
[DoS Attack: WinNuke Attack] from source: 47.74.92.241, port 53400, Sunday, September 26, 2021 10:58:53
[DoS Attack: SYN/ACK Scan] from source: 172.217.194.153, port 443, Sunday, September 26, 2021 10:52:13
[DoS Attack: SYN/ACK Scan] from source: 74.91.119.7, port 22, Sunday, September 26, 2021 10:51:09
4 Replies
Absolute normal router operations. The router protected certain activities on Internet -> Router/Internal Network activities. Some are side effects of devices with a lot of active connections to the Internet are going to sleep, roam away from the local WiFi or wired connections to the mobile network, roam from the mobile to the local WIFi, and so on.
Thank you schumaku much appreciated...
Hi schumaku ,
Just to clarify and insure that I have the correct option on the Orbi Pro, I attached a screen grab from the Router......Advanced-setup-WAN
Is this correct??? I assume NO check in the first line "Disable Port Scan" That means that is is on right? that is the router is doing its protection?
Remember, I am not a techy person with this new hardware.
thanks
Retired_Member wrote:
Is this correct??? I assume NO check in the first line "Disable Port Scan" That means that is is on right? that is the router is doing its protection?
Absolutely correct!
Retired_Member wrote:
Remember, I am not a techy person with this new hardware.
Asking is always a good approach of course.
The question is always if and how much logging should be done on consumer and SOHO/SMB equipment in this aspect. Other vendors simply suppress these activities, or put them to a different logging classes which are not enabled or visible by default. The Netgear way with the messages you see is always scaring non-experienced users, and long time active users here have seen virtually hundreds from scared owners.
NETGEAR Academy
Boost your skills with the Netgear Academy - Get trained, certified and stay ahead with the latest Netgear technology!
Join Us!
