NETGEAR is aware of a growing number of phone and online scams. To learn how to stay safe click here.
Forum Discussion
vwwanted
Mar 30, 2016Aspirant
DoS attack, Teardrop or derivative, Ping of Death, strange non-DHCP IP address connected to wifi
I'm getting lots of Dos attacks logged in my C3000 modem/router. They appear to be coming from inside my network, from my wifi. I keep seeing a device attached to my wifi with an IP address of 1.1.15...
ErnestTheGreat
Apr 05, 2018NETGEAR Employee Retired
I am not sure how much knowledge there is on this thread regarding Ping of Death, Teardrop, DoS and DDoS attacks but to me it seems there is lot of paranoia about being hacked. So I wanted to set the record straight as far as Netgear cable product go it appears that lot of the DoS entries that appear in the event logs. Upon further examination it appears that there is lot of cases where devices such as printer, mobile devices and etc. support IPv6 and lot of these devices are generating discovery packets or fragmented multicast IPv6 packets which cause the Netgear Cable firewall to belive it is being DoS’d when in fact it isn’t.
There is couple of mentions about HP printers with IPv6 support causing these issues and it seems that it does not matter whether you have a HP printer or not issue keeps happening. HP printers are not the only devices out there that send discovery or fragmented packets there is other devices that use these. My suggestion is if you have a device that has IPv6 but it is not using it disable it, also other device that use multicast and discovery packets like Chromecast and so on should also be update as there was a recent issue with Google devices causing packet flooding issues which some routers believed to be DoS attacks.
As far as iOS devices showing IPs outside the subnet goes for example user that mentioned 128.60.129.150 according to public IP info this IP belongs to AS48 Navy Network Information Center ISP and based on the approximate location report this is approximate location of the Norfolk Naval Station so I doubt they you be hacking anyone’s cable gateway. In cases where mobile devices are reporting IPs outside of subnet goes I would check and make sure you are not connecting to any suspicious sites with your browsers, have any questionable apps, apps that mine your information and report it to public server installed or any type of malware infection if android OS is used.
As far as the issue with HP and other printers is concerned Netgear will be addressing that in the upcoming firmware releases once the firmwares have been tested and certified by ISPs of course.
NtwrkG3ek
Jul 27, 2018Initiate
i am having same issue with new HP Envy Photo 7155 printer. The printer is generating hundreds of UPnP packets. The router thinks it detects a teardrop attack, and apparently resets the connection. All of my devices lose connectivity. I work from home, so this is especially frustrating during conference calls!
Here is one example:
[DoS attack: Teardrop or derivative] from 10.x.x.x, port 49087
Source: 10.x.x.x:49087 (HP Printer)
Target: 239.255.255.250:65535
Count: 816 packets
So, my router thinks the printer is generating a DoS attack. However, this has to do with UPnP and SSDP uses 239.255.255.250 for the unicast and multicast adress.
Cannot decide which to return to the store... Netgear router, or the HP printer. One of these must go!