NETGEAR is aware of a growing number of phone and online scams. To learn how to stay safe click here.
Forum Discussion
DoS attack, Teardrop or derivative, Ping of Death, strange non-DHCP IP address connected to wifi
I'm getting lots of Dos attacks logged in my C3000 modem/router. They appear to be coming from inside my network, from my wifi. I keep seeing a device attached to my wifi with an IP address of 1.1.15...
I am not sure how much knowledge there is on this thread regarding Ping of Death, Teardrop, DoS and DDoS attacks but to me it seems there is lot of paranoia about being hacked. So I wanted to set the record straight as far as Netgear cable product go it appears that lot of the DoS entries that appear in the event logs. Upon further examination it appears that there is lot of cases where devices such as printer, mobile devices and etc. support IPv6 and lot of these devices are generating discovery packets or fragmented multicast IPv6 packets which cause the Netgear Cable firewall to belive it is being DoS’d when in fact it isn’t.
There is couple of mentions about HP printers with IPv6 support causing these issues and it seems that it does not matter whether you have a HP printer or not issue keeps happening. HP printers are not the only devices out there that send discovery or fragmented packets there is other devices that use these. My suggestion is if you have a device that has IPv6 but it is not using it disable it, also other device that use multicast and discovery packets like Chromecast and so on should also be update as there was a recent issue with Google devices causing packet flooding issues which some routers believed to be DoS attacks.
As far as iOS devices showing IPs outside the subnet goes for example user that mentioned 128.60.129.150 according to public IP info this IP belongs to AS48 Navy Network Information Center ISP and based on the approximate location report this is approximate location of the Norfolk Naval Station so I doubt they you be hacking anyone’s cable gateway. In cases where mobile devices are reporting IPs outside of subnet goes I would check and make sure you are not connecting to any suspicious sites with your browsers, have any questionable apps, apps that mine your information and report it to public server installed or any type of malware infection if android OS is used.
As far as the issue with HP and other printers is concerned Netgear will be addressing that in the upcoming firmware releases once the firmwares have been tested and certified by ISPs of course.
I have to disagree with your observations and opinion. Since day 1, the Netgear C7000 will CHANGE the connected IP of my iPhone to an IP address for an AT&T customer in Dallas Texas (I am in California and iPhone is on 192.168.etc). THIS ip in Dallas then attacks 's multiple other IP's sending DDoS and other pings of death to multiple IP's including the DOD, China, France, you name it. Can be anywhere. MANY times a day, every day.
Ony changes the iPhone. Never iPad, Kindle, etc.
Help clarify?
~Bob
That IP, 128.60.129.150, is showing inside, on my lan. For whatever reason the Netgear ARP table associates it with our Apple devices. It changes each time it wants to scan to whatever random Apple device we have online. That "device" is then targeting random public IPs. You can see them clearly in the logs. I only started investigating the due to my 1.4TB of data usage this month. That usage may or may not be realated but something is very odd here. Netgear factory reset does not do anything. ISP does not have a newer firmware version. I have a Vizio tv, Roku, desktop computers (I disabled IPv6), ipads and iphones. I had an HP wifi printer that I've unplugged as well and a Windows laptop unplugged as well. I even setupIP reservations on all the devices (just to try something!), and the 128 IP still associated with one of the Apple devices with an IP reservation.
I should also mention I even changed the IP of the router and have a 128 bit administrator password.
Just with my iphone and ipad on the wifi network there is no "malicious" activity. My devices do not show up in the netgear genie as having a public IP. If my wife or kids add their iphones or ipads then it starts almost instantly. One of the connected apple devices will show up with the public IP and the logs will show that public IP attacking random public IPs. Its always one device, never more than one at a time. Definately something apple related but I can't find what is different about my two devices compared to all of theirs. We looked for apps they have that i don't and also device settings. Could not isolate the difference. Its driving me crazy! No issues with anything wired.
Also should be noted that all throughout the day when no one was here, no iphones at home, there was no malicious activity. There were three ipads at home all day. The malicious activity stopped and started at the moment the last person with an iphone left home and returned home. When I did a test at night with just those three ipads (to confirm they were not the issues) the malicious activity started again , although not mine. So i think that just confirms if the ipads are asleep that nothing is "calling out". All the other ipads and iphones by themselves on the network cause these attacks when in use, but never my own ipad and iphone.............
As I mentioned before lot of these events are false positive events that generate these DoS attack, Teardrop or derivative and Ping of Death events in the event logs. As described by Netgear before devices like printers and etc. are generating discovery packets or fragmented multicast IPv6 packets which cause the Netgear Cable firewall to belive it is being DoS’d when in fact it isn’t.
Netgear has a firmware that fixes this issue but it will take time to roll it out as it has to go through certification with ISPs. So we just need to sit tight and wait for the ISPs to push the new firmware out to our devices.
As far as the iPhones and iDevices having strange non-DHCP IP address shown for them under the WiFi section on the C7000's "Attached Devices" page so looks like the issue here is related to IPv6 NAT64 feature which is a translation mechanism for algorithmically mapping IPv6 addresses to IPv4 addresses, and IPv4 addresses to IPv6 addresses. For more info on NAT64 feature you can check out RFC 6145 and 6146.
So basically what’s happening is that the IPv6 addresses associated with iPhone and other iDevices are benign translate to random IPv4 addresses as result of NAT64 feature and for some odd reason those addresses are being shown under attached devices leading us to belive that there is a non-DHCP address assigned to our device. Coincidently some of those IPs are valid addresses that show as being registered to valid 3rd parties and some are not.
So I do not think there is anything to worry about here just make sure that you go to your C7000 UI under Advanced --> Setup --> WAN Setup and uncheck Disable Port Scan and DoS Protection to enable the protection since by default it is disabled.
I agree its a false positive. Looking at the logs again, no "attacks" when no one is here.
Any idea if/when the new firmware will be deployed to Optimum Online? I’ve been dealing with this and very high corrected/uncorrectables for months and both your and their support have been abysmal. No one is willing to help and keeps telling me the other group is responsible for firmware updates. PLEASE help me out, I really enjoy the product but hope I didn’t waste $200 on a bad product. Thank you!