NETGEAR is aware of a growing number of phone and online scams. To learn how to stay safe click here.

Forum Discussion

HrothgarS's avatar
HrothgarS
Aspirant
Oct 18, 2017

Blinking download light, slow download speed, DoS attacks on C7000

My C7000 modem router is giving me very slow download speeds (5 - 40 Mbps; I pay for 200 Mbps) and the download lightning bolt indicator light is blinking. I have contacted Comcast and done their troubleshooting to no avail.

 

My logs also show a number of DoS attacks. I appreciate your help.

Logs:

 

DescriptionCountLast OccurrenceTargetSource
[admin login] from source 0.0.0.02Wed Oct 18 08:56:45 20170.0.0.0:00.0.0.0:0
[admin login failure] from source 0.0.0.01Wed Oct 18 08:55:23 20170.0.0.0:00.0.0.0:0
[admin login] from source 0.0.0.01Wed Oct 18 08:48:31 20170.0.0.0:00.0.0.0:0
[DHCP IP: 192.168.0.15] to MAC address 20:c9:d0:45:16:ff1Wed Oct 18 08:18:21 20170.0.0.0:00.0.0.0:0
[DHCP IP: 192.168.0.15] to MAC address 20:c9:d0:45:16:ff1Wed Oct 18 08:16:46 20170.0.0.0:00.0.0.0:0
[DoS attack: Illegal Fragments] from 77.2.109.144, port 02Wed Oct 18 08:10:31 201772.198.188.191:077.2.109.144:0
[DoS attack: Teardrop or derivative] from 77.2.109.144, port 02Wed Oct 18 08:03:37 201772.198.188.191:077.2.109.144:0
[DoS attack: Ping Of Death] from 77.2.109.144, port 03Wed Oct 18 08:03:09 201772.198.188.191:077.2.109.144:0
[DoS attack: Teardrop or derivative] from 77.2.109.144, port 03Wed Oct 18 08:02:30 201772.198.188.191:077.2.109.144:0
[DoS attack: Illegal Fragments] from 77.2.109.144, port 01Wed Oct 18 08:02:03 201772.198.188.191:077.2.109.144:0
[DoS attack: Ping Of Death] from 77.2.109.144, port 01Wed Oct 18 08:02:03 201772.198.188.191:077.2.109.144:0
[DoS attack: Teardrop or derivative] from 77.2.109.144, port 03Wed Oct 18 07:59:44 201772.198.188.191:077.2.109.144:0
[DoS attack: Ping Of Death] from 77.2.109.144, port 010Wed Oct 18 07:57:42 201772.198.188.191:077.2.109.144:0
[DoS attack: Teardrop or derivative] from 77.2.109.144, port 02Wed Oct 18 07:56:47 201772.198.188.191:077.2.109.144:0
[DoS attack: Illegal Fragments] from 77.2.109.144, port 01Wed Oct 18 07:56:39 201772.198.188.191:077.2.109.144:0
[DoS attack: Teardrop or derivative] from 77.2.109.144, port 07Wed Oct 18 07:56:39 201772.198.188.191:077.2.109.144:0
[DoS attack: Ping Of Death] from 77.2.109.144, port 04Wed Oct 18 07:56:17 201772.198.188.191:077.2.109.144:0
[DoS attack: Teardrop or derivative] from 77.2.109.144, port 01Wed Oct 18 07:53:20 201772.198.188.191:077.2.109.144:0
[DoS attack: Ping Of Death] from 77.2.109.144, port 06Wed Oct 18 07:53:18 201772.198.188.191:077.2.109.144:0
[DoS attack: Teardrop or derivative] from 77.2.109.144, port 04Wed Oct 18 07:53:16 201772.198.188.191:077.2.109.144:0
[DoS attack: Ping Of Death] from 77.2.109.144, port 02Wed Oct 18 07:53:06 201772.198.188.191:077.2.109.144:0
[DoS attack: Teardrop or derivative] from 77.2.109.144, port 02Wed Oct 18 07:53:05 201772.198.188.191:077.2.109.144:0
[DoS attack: Ping Of Death] from 77.2.109.144, port 01Wed Oct 18 07:53:03 201772.198.188.191:077.2.109.144:0
[DoS attack: Teardrop or derivative] from 77.2.109.144, port 02Wed Oct 18 07:52:57 201772.198.188.191:077.2.109.144:0
[DoS attack: Illegal Fragments] from 77.2.109.144, port 01Wed Oct 18 07:52:57 201772.198.188.191:077.2.109.144:0
[DoS attack: Teardrop or derivative] from 77.2.109.144, port 01Wed Oct 18 07:52:56 201772.198.188.191:077.2.109.144:0
[DoS attack: Illegal Fragments] from 77.2.109.144, port 02Wed Oct 18 07:51:11 201772.198.188.191:077.2.109.144:0
[DoS attack: Teardrop or derivative] from 77.2.109.144, port 01Wed Oct 18 07:25:39 201772.198.188.191:077.2.109.144:0
[DoS attack: Illegal Fragments] from 77.2.109.144, port 02Wed Oct 18 07:25:39 201772.198.188.191:077.2.109.144:0
[DoS attack: Teardrop or derivative] from 77.2.109.144, port 01Wed Oct 18 07:25:24 201772.198.188.191:077.2.109.144:0
[DHCP IP: 192.168.0.15] to MAC address 20:c9:d0:45:16:ff1Wed Oct 18 07:23:07 20170.0.0.0:00.0.0.0:0
[DoS attack: Ping Of Death] from 77.2.109.144, port 01Wed Oct 18 07:11:20 201772.198.188.191:077.2.109.144:0
[DoS attack: Teardrop or derivative] from 77.2.109.144, port 02Wed Oct 18 07:05:59 201772.198.188.191:077.2.109.144:0
[DoS attack: Illegal Fragments] from 77.2.109.144, port 01Wed Oct 18 06:41:40 201772.198.188.191:077.2.109.144:0
[DHCP IP: 192.168.0.15] to MAC address 20:c9:d0:45:16:ff1Wed Oct 18 05:45:28 20170.0.0.0:00.0.0.0:0
[DoS attack: Teardrop or derivative] from 77.2.109.144, port 01Wed Oct 18 05:26:40 201772.198.188.191:077.2.109.144:0
[DoS attack: Ping Of Death] from 77.2.109.144, port 01Wed Oct 18 04:22:53 201772.198.188.191:077.2.109.144:0
[DoS attack: Teardrop or derivative] from 77.2.109.144, port 04Wed Oct 18 04:22:46 201772.198.188.191:077.2.109.144:0
[DHCP IP: 192.168.0.15] to MAC address 20:c9:d0:45:16:ff1Wed Oct 18 04:14:52 20170.0.0.0:00.0.0.0:0
[DoS attack: Teardrop or derivative] from 77.2.109.144, port 04Wed Oct 18 04:04:27 201772.198.188.191:077.2.109.144:0
[DoS attack: IP packet w/MC or BC SRC addr] from 207.46.134.255, port 4431Wed Oct 18 02:45:35 2017192.168.0.15:53514207.46.134.255:443
[DoS attack: IP packet w/MC or BC SRC addr] from 207.46.134.255, port 4431Wed Oct 18 02:45:33 2017192.168.0.15:53503207.46.134.255:443
[DoS attack: IP packet w/MC or BC SRC addr] from 207.46.134.255, port 4431Wed Oct 18 02:45:07 2017192.168.0.15:53514207.46.134.255:443
[DoS attack: IP packet w/MC or BC SRC addr] from 207.46.134.255, port 4431Wed Oct 18 02:45:05 2017192.168.0.15:53503207.46.134.255:443
[DoS attack: IP packet w/MC or BC SRC addr] from 207.46.134.255, port 4431Wed Oct 18 02:44:46 2017192.168.0.15:53514207.46.134.255:443
[DoS attack: IP packet w/MC or BC SRC addr] from 207.46.134.255, port 4431Wed Oct 18 02:44:44 2017192.168.0.15:53503207.46.134.255:443
[DoS attack: IP packet w/MC or BC SRC addr] from 207.46.134.255, port 4431Wed Oct 18 02:44:36 2017192.168.0.15:53514207.46.134.255:443
[DoS attack: IP packet w/MC or BC SRC addr] from 207.46.134.255, port 4431Wed Oct 18 02:44:34 2017192.168.0.15:53503207.46.134.255:443
[DoS attack: IP packet w/MC or BC SRC addr] from 207.46.134.255, port 4431Wed Oct 18 02:44:30 2017192.168.0.15:53514207.46.134.255:443
[DoS attack: IP packet w/MC or BC SRC addr] from 207.46.134.255, port 4431Wed Oct 18 02:44:28 2017192.168.0.15:53503207.46.134.255:443
[DoS attack: IP packet w/MC or BC SRC addr] from 207.46.134.255, port 4431Wed Oct 18 02:44:27 2017192.168.0.15:53514207.46.134.255:443
[DoS attack: IP packet w/MC or BC SRC addr] from 207.46.134.255, port 4431Wed Oct 18 02:44:25 2017192.168.0.15:53503207.46.134.255:443

 

Troubleshooting

3 Replies

  • DarrenM's avatar
    DarrenM
    Sr. NETGEAR Moderator
    Oct 20, 2017

    What device on your network is using 192.168.0.15 Ip address that device seems to be triggering alot of attacks you may want to disconnect it and see if that is the issue.

     

    DarrenM

    • rarossin's avatar
      rarossin
      Aspirant
      Oct 22, 2017

      Had a similar problem getting my C7100 to connect with Comcast and I had a technician out to the house. He immediately found the problem, a physical filter on the line which blocks some of the channels the modem needs.

      • HrothgarS's avatar
        HrothgarS
        Aspirant
        Oct 22, 2017

        Thanks both of you for your responses. The slow download speeds turn out to have resulted from squirrels nibbling on our cable lines; Comcast replaced them today and the speed is back to normal.

         

        Regarding the DoS attacks, very few of them reference an IP address of any machine I have in the house - the vast majority are coming from foreign IP addresses.

         

        [DoS attack: Ping Of Death] from 77.2.109.144, port 01Sun Oct 22 15:28:57 2017180.108.126.95:077.2.109.144:0
        [DoS attack: Illegal Fragments] from 77.2.109.144, port 01Sun Oct 22 15:28:23 201785.54.72.208:077.2.109.144:0