MR60 Denial of Service Attacks

Question

The past few weeks, I have been getting a lot of DOS attacks, some bad enough that the MR60 goes offline for a minute or so, then returns.&nbsp; I have a Netgear GS108v4 switch wired into the MR60 ethernet port.&nbsp; Even the hard-wired ethernet port goes offline during the minute or two involved.&nbsp;Typical log entries:[Internet connected] IP address: 73.106.184.30, Thursday, Jan 26,2023 12:14:40[DHCP IP: (192.168.1.18)] to MAC address 9C:76:13:15:2B:8F, Thursday, Jan 26,2023 12:14:36[DHCP IP: (192.168.1.19)] to MAC address 9C:76:13:15:2B:D1, Thursday, Jan 26,2023 12:14:35[DHCP IP: (192.168.1.9)] to MAC address 34:3E:A4:85:0C:C2, Thursday, Jan 26,2023 12:14:35[DHCP IP: (192.168.1.25)] to MAC address 54:3A:D6:C0:B6:51, Thursday, Jan 26,2023 12:14:25[Internet disconnected] Thursday, Jan 26,2023 12:14:25[DoS attack: Fraggle Attack] from source 96.120.5.125,port 67 Thursday, Jan 26,2023 12:14:23My MR60 and satellites' firmware is up to date.My network is setup thus:Comcast Cable Internet (1.2 gbps download)&nbsp; &lt;--&gt; Motorola "modem" &lt;--&gt; MR-60 &lt;--&gt; Wireless Network&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;|&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;+ &lt;--&gt; Netgear switchDoes anyone have an idea on how to handle this so my system does not go offline?Thanks

microchip8 · Answer

False positives.NETGEAR's firmware is known for creating many false positives. This puts a strain on the CPU. As you can see in your log, there are even "attacks" from your local deices (192.168.x.x IP addresses).I'd disable DoS protection completely and see if the issues goes away. You're not missing much since most are, as I mentioned, false positives.

FURRYe38 · Answer

The&nbsp;[DoS attack: Fraggle Attack]&nbsp;is just the logs and MR reporting that it is blocking something. Typical entry if these are detected.&nbsp;
The&nbsp;[DHCP IP: (192.168.1.18)] are typical log entries that the MR is reporting for newly connected devices and getting a IP address from the MR. This is not a attack.&nbsp;
&nbsp;
You can do a whois lookup on those WAN side IP addresses to see where they come from:
96.120.5.125
&nbsp;
It's recommended to edit out MAC addresses and product serial numbers before posting in public forums for security reasons.&nbsp;

MSBassSinger · Answer

The MR60 has no DoS protection, at least nothing tha is settable via the web or app interface.

MSBassSinger · Answer

I can understand false positives.&nbsp; Why would the router go offline (amber light) then come back online?&nbsp; Is that preventable?

FURRYe38 · Answer

What Firmware version is currently loaded?What is the Mfr and model# of the Internet Service Providers modem/ONT the NG router is connected too? Be sure your using a good quality LAN cable between the modem and router. CAT6 is recommended.&nbsp;
&nbsp;
Whats the user manual say for LED behaviors on the MR?&nbsp;
&nbsp;

Forum Discussion

MR60 Denial of Service Attacks

7 Replies