DoS attack, Teardrop or derivative, Ping of Death, strange non-DHCP IP address connected to wifi

I have an HP printer as well.  I unplugged it (no power).  Problem still continues.  Its not an HP issue.

They are al getting worse, btw. More and more IP's being attacked daily. Unthinkable Netgear does nothing about this.

I am ready to buy a new NAS. Guess what company will not be getting my business?

No more routers, gateways, NAS's, etc. An irresponsive and irresponsible company in my opinion.

~Bob

I am not sure how much knowledge there is on this thread regarding Ping of Death, Teardrop, DoS and DDoS attacks but to me it seems there is lot of paranoia about being hacked. So I wanted to set the record straight as far as Netgear cable product go it appears that lot of the DoS entries that appear in the event logs. Upon further examination it appears that there is lot of cases where devices such as printer, mobile devices and etc. support IPv6 and lot of these devices are generating discovery packets or fragmented multicast IPv6 packets which cause the Netgear Cable firewall to belive it is being DoS’d when in fact it isn’t.

There is couple of mentions about HP printers with IPv6 support causing these issues and it seems that it does not matter whether you have a HP printer or not issue keeps happening. HP printers are not the only devices out there that send discovery or fragmented packets there is other devices that use these.  My suggestion is if you have a device that has IPv6 but it is not using it disable it, also other device that use multicast and discovery packets like Chromecast and so on should also be update as there was a recent issue with Google devices causing packet flooding issues which some routers believed to be DoS attacks.

As far as iOS devices showing IPs outside the subnet goes for example user that mentioned 128.60.129.150 according to public IP info this IP belongs to AS48 Navy Network Information Center ISP and based on the approximate location report this is approximate location of the Norfolk Naval Station so I doubt they you be hacking anyone’s cable gateway. In cases where mobile devices are reporting IPs outside of subnet goes I would check and make sure you are not connecting to any suspicious sites with your browsers, have any questionable apps, apps that mine your information and report it to public server installed or any type of malware infection if android OS is used.

As far as the issue with HP and other printers is concerned Netgear will be addressing that in the upcoming firmware releases once the firmwares have been tested and certified by ISPs of course.

I have to disagree with your observations and opinion. Since day 1, the Netgear C7000 will CHANGE the connected IP of my iPhone to an IP address for an AT&T customer in Dallas Texas (I am in California and iPhone is on 192.168.etc). THIS ip in Dallas then attacks 's multiple other IP's sending DDoS and other pings of death to multiple IP's including the DOD, China, France, you name it. Can be anywhere. MANY times a day, every day.

Ony changes the iPhone. Never iPad, Kindle, etc.

Help clarify?

~Bob

That IP, 128.60.129.150, is showing inside, on my lan.  For whatever reason the Netgear ARP table associates it with our Apple devices.  It changes each time it wants to scan to whatever random Apple device we have online. That "device" is then targeting random public IPs.  You can see them clearly in the logs.  I only started investigating the due to my 1.4TB of data usage this month.  That usage may or may not be realated but something is very odd here.  Netgear factory reset does not do anything.   ISP does not have a newer firmware version.  I  have a Vizio tv, Roku, desktop computers (I disabled IPv6), ipads and iphones.  I had an HP wifi printer that I've unplugged as well and a Windows laptop unplugged as well.  I even setupIP reservations on all the devices (just to try something!), and the 128 IP still associated with one of the Apple devices with an IP reservation.

I should also mention I even changed the IP of the router and have a 128 bit administrator password.

hey, all i know is when i connected your guys's product to my network...it brought my internet down to a crawl...u guys need to fix your products:(

Just with my iphone and ipad on the wifi network there is no "malicious" activity.  My devices do not show up in the netgear genie as having a public IP.  If my wife or kids add their iphones or ipads then it starts almost instantly.  One of the connected apple devices will show up with the public IP and the logs will show that public IP attacking random public IPs.  Its always one device, never more than one at a time.  Definately something apple related but I can't find what is different about my two devices compared to all of theirs.  We looked for apps they have that i don't and also device settings.  Could not isolate the difference.  Its driving me crazy!  No issues with anything wired.  

Also should be noted that all throughout the day when no one was here, no iphones at home, there was no malicious activity.  There were three ipads at home all day.   The malicious activity stopped and started at the moment the last person with an iphone left home and returned home.  When I did a test at night with just those three ipads (to confirm they were not the issues) the malicious activity started again , although not mine.  So i think that just confirms if the ipads are asleep that nothing is "calling out".  All the other ipads and iphones by themselves on the network cause these attacks when in use, but never my own ipad and iphone.............

As I mentioned before lot of these events are false positive events that generate these DoS attack, Teardrop or derivative and Ping of Death events in the event logs. As described by Netgear before devices like printers and etc. are generating discovery packets or fragmented multicast IPv6 packets which cause the Netgear Cable firewall to belive it is being DoS’d when in fact it isn’t.

Netgear has a firmware that fixes this issue but it will take time to roll it out as it has to go through certification with ISPs. So we just need to sit tight and wait for the ISPs to push the new firmware out to our devices.

As far as the iPhones and iDevices having strange non-DHCP IP address shown for them under the WiFi section on the C7000's "Attached Devices" page so looks like the issue here is related to IPv6 NAT64 feature which is a translation mechanism for algorithmically mapping IPv6 addresses to IPv4 addresses, and IPv4 addresses to IPv6 addresses. For more info on NAT64 feature you can check out RFC 6145 and 6146.

So basically what’s happening is that the IPv6 addresses associated with iPhone and other iDevices are benign translate to random IPv4 addresses as result of NAT64 feature and for some odd reason those addresses are being shown under attached devices leading us to belive that there is a non-DHCP address assigned to our device. Coincidently some of those IPs are valid addresses that show as being registered to valid 3rd parties and some are not.

So I do not think there is anything to worry about here just make sure that you go to your C7000 UI under Advanced --> Setup --> WAN Setup and uncheck Disable Port Scan and DoS Protection to enable the protection since by default it is disabled. 

I agree its a false positive.  Looking at the logs again, no "attacks" when no one is here.

Any idea if/when the new firmware will be deployed to Optimum Online? I’ve been dealing with this and very high corrected/uncorrectables for months and both your and their support have been abysmal. No one is willing to help and keeps telling me the other group is responsible for firmware updates. PLEASE help me out, I really enjoy the product but hope I didn’t waste $200 on a bad product. Thank you!

i am having same issue with new HP Envy Photo 7155 printer.  The printer is generating hundreds of UPnP packets.  The router thinks it detects a teardrop attack, and apparently resets the connection.  All of my devices lose connectivity.  I work from home, so this is especially frustrating during conference calls!

Here is one example:

[DoS attack: Teardrop or derivative] from 10.x.x.x, port 49087

Source: 10.x.x.x:49087 (HP Printer)

Target: 239.255.255.250:65535

Count: 816 packets

So, my router thinks the printer is generating a DoS attack.  However, this has to do with UPnP and SSDP uses 239.255.255.250 for the unicast and multicast adress.

Cannot decide which to return to the store... Netgear router, or the HP printer.  One of these must go!

If you turn off IPv6 on the HP printer the DOS attacks will stop! Both HP and Netgear have a fix for this issue. The patch is in testing now and will be released through your ISP. 

About time, if there is a fix. However, my situation is a bit different. iPhone sends packets always to port 0 and to sites like the Dept of Defense or something usually in the news whether  corporate or geoivernment foreign agency. Does not seem random and I still belive it is not.

Your printer (7155) and your Router (C7000,C6900, C7000v2, C3000, C3700, C6220, C7100V ) combination causes DOS errors. 

Turning off IPv6 on the Printer will stop the DOS attacks from the router and printer. You sending packets on your iPhone is not part of the fix. 

It sounds like you have a virius on your phone...

I do not have a virus. The ip address of the iPhone changes to the same IP address in Texas and sends packets. 100's of Netgear owners have this. 100's. Many posts. Its a netgear bug well know for several years and nothing done. Google it.

Sorry... I only know about HP printers and how they react to Netgear routers. It was just a guess from the info you supplied. 

Thanks, this worked!  The HP printer events stopped.  Network seems stable.

I still see suspected teardrop attacks in the logs where both To and From addresses are not on my network.  Apparently, the volume of packets (hundreds per log entry) from my HP printer caused the router to reset.  The other events have less than 20 packets per log log entry.