NETGEAR is aware of a growing number of phone and online scams. To learn how to stay safe click here.
Forum Discussion
DoS Attacks - MR60 Mesh Router
- Model Version: MR60 with 2 MS60 Satellites
- Firmware: V1.1.7.134
- Home network
Two nights ago, we were kicked off our entire network around 1 am. We logged into our router the next morning and noticed there were some DoS attacks. We reached out to Cox about the DoS attacks, they wanted to send a tech out and told us if the problem is on us, we have to pay $70 so we passed. We ended up completely resetting our router and starting fresh.
That seemed to help and then we started noticing buffering on any kind of streaming.. Hulu.. Youtube.. etc. so I took a look at the logs again and noticed we are getting a multitude of DoS attacks. Started researching and noticed this is a common issue with Netgear as they maybe false positives. We get good speeds, anywhere from 400-700 mbps and YouTube started buffering on our TV which is hardwired to one of the satellites.
I understand what a DoS attack is at a very basic level.
Per our logs, is this something we need to be concerned about?
See photo.
7 Replies
What is the Mfr and model# of the Internet Service Providers modem/ONT the NG router is connected too?
Be sure your using a good quality LAN cable between the modem and router. CAT6 is recommended.The logs mean that the system is working and reporting what it saw and blocked it.
Might look up and do a whois on those IP addresses that you see for those attacks to see where they are coming from.
Has a power off for 1 minute then back ON with the ISP modem and router been performed since last update?
Be sure to restart your network in this sequence:
Turn off and unplug modem.
Turn off router and computers.
Plug in and turn on modem. Wait 2 minutes for it to connect.
Turn on the router and wait 2 minutes for it to connect.
Turn on computers and rest of network.Recommend setting the default DHCP IP address pool range to the following after applying and a factory reset: 192.168.#.100 to 192.168.#.200.
What is the Mfr and model# of the Internet Service Providers modem/ONT the NG router is connected too?
We got rid of our ISPs modem a while back but what we are currently using is a Netgear CM1000.
Cable between modem and router is indeed a CAT6 cable.
I just looked up the following IP address and its associated with company called Deepintent Inc.
[DoS attack: ACK Scan] from source 169.197.150.7,port 443 Friday, Jan 13,2023 12:47:05
This was from a few minutes ago.
IP associated with Oath Holdings, Inc.
[DoS attack: RST Scan] from source 209.73.190.12,port 443 Friday, Jan 13,2023 12:19:15
We've unplugged the modem and the router several times but I'll try doing it again.
Recommend setting the default DHCP IP address pool range to the following after applying and a factory reset: 192.168.#.100 to 192.168.#.200.
I want to make sure I'm understanding your request correctly.
To do this I need to log onto my router, select Advanced > LAN Setup > Use Router as DHCP Server needs to be checked off > Set Starting IP Address to 192.168.1.100 > Set Ending IP Address to 192.168.1.200 ... or is that incorrect?
Correct on making changes to the LAN DHCP service.
Something also you can do, disable or uncheck all Logging options on the MR for items that you don't need to review or have the router log. It's like VPN, devices accessing allowed or blocked sites if you don't have these setup. I usually un check log items that I don't need to look at.
For your CM modem let see how that's doing. Please post a copy and paste of the modems connection status and event log page.
https://kb.netgear.com/30007/How-do-I-obtain-the-cable-connection-information-from-a-NETGEAR-cable-modem-modem-router
https://kb.netgear.com/30008/How-do-I-view-or-clear-the-event-logs-on-my-NETGEAR-cable-modem-or-modem-router
