NETGEAR is aware of a growing number of phone and online scams. To learn how to stay safe click here.
Forum Discussion
[DoS attack: Fraggle Attack] on RAX20 logs
Hi there, I noticed there are quite a lot of following entires from the log of my RAX20,is there anything I need to worry about? [DoS attack: Fraggle Attack] from source UNKNOWN,port 68 Thurs...
Netgear's firmware is great at creating false reports of DoS attacks. Many of them are no such thing.
Search - NETGEAR Communities – DoS attacks
Use Whois.net to see who is behind some of them and you may find that they are from places like Facebook, Google, even your ISP.
216.58.199.106 and 74.125.23.108 are Google.
157.240.199.34 is Facebook
Here is a useful tool for that task:
IPNetInfo: Retrieve IP Address Information from WHOIS servers
If these events are slowing down your router, that may be because it is using up processor time as it writes the events to your logs. Anything that uses processor power – event logging, QoS management, traffic metering – may cause slowdowns. Disable logging of DoS attacks and see if that reduces the problem. This does not prevent the router from protecting you from the outside world.
chrisling wrote:
This RAX20 is connecting to an uplink R7000 as a edge router front facing the ISP's modem.
Sounds messy. Are you running "Double NAT" because you like things that way? Heaven only knows what the modem is also doing.
michaelkenward wrote:
Sounds messy. Are you running "Double NAT" because you like things that way? Heaven only knows what the modem is also doing.michaelkenward Thanks for your reply, I have read thru all other DOS posts beforehand but trying to be certain that's all.
Anyway my ISP's modem is only assigning 1 dynamic IP to me so I doubt that I can bridge it, hence have the R7000 that sit right next to it is doing the first NAT, 192.168.1.0, mainly serving my parents devices thru wifi, further on a 50m long Cat5 cable is connecting from R7000 LAN port#1 to a RAX20 which is situateed on the other (disjointed) end of the house, the RAX20 is doing the 2nd level of NAT (network: 10.0.0.1) so yes, it's a double NAT setup, the 10.0.0.1 network is mainly for my own usage.
To make things a little bit more complicated, I have a pfSense VM setup on one of my ESXi hosts (IP: 192.168.1.2) acting as a router/firewall to the 3rd network 172.16.1.0 for other VMs. A static route on the R7000 is setup to allow access to this 3rd network from the other 2.
I don't particularly like this setup, but it's striaght forward and serve the purpose of having 3 networks segmented. I could have bridge both the Netgear routers but don't want the R7000 be the only one doing all the heavy liftings.