How to get AC3200 (C7800) to not respond to probe attacks

Question

I am having constant probe attacks to my cable-modem-router. A few of them are quite persistent. See below:

[DoS attack: UDP Scan] from source: 146.88.240.4, port 42325, Sat, Apr 02, 2022 22:51:01
[DoS attack: Echo char gen] from source: 184.105.139.79, port 16301, Sat, Apr 02, 2022 19:55:09
[DoS attack: Echo char gen] from source: 146.88.240.4, port 59284, Sat, Apr 02, 2022 19:37:25
[DoS attack: Echo char gen] from source: 185.101.107.120, port 55751, Sat, Apr 02, 2022 18:55:04
[DoS attack: UDP Scan] from source: 223.71.167.165, port 31361, Sat, Apr 02, 2022 17:40:46
[DoS attack: Echo char gen] from source: 78.128.113.34, port 8080, Sat, Apr 02, 2022 16:01:39
[DoS attack: UDP Scan] from source: 167.172.72.231, port 39595, Sat, Apr 02, 2022 11:05:22
[DoS attack: Echo char gen] from source: 184.105.139.85, port 57689, Sat, Apr 02, 2022 10:15:53
[DoS attack: Echo char gen] from source: 66.240.236.116, port 58592, Sat, Apr 02, 2022 04:37:07
[DoS attack: UDP Scan] from source: 185.94.111.1, port 57786, Sat, Apr 02, 2022 02:58:30
[DoS attack: UDP Scan] from source: 185.94.111.1, port 48059, Sat, Apr 02, 2022 01:15:15
[DoS attack: UDP Scan] from source: 146.88.240.4, port 49843, Fri, Apr 01, 2022 22:51:39
[DoS attack: UDP Scan] from source: 64.225.64.99, port 54995, Fri, Apr 01, 2022 22:34:41
[DoS attack: Echo char gen] from source: 141.212.123.208, port 52400, Fri, Apr 01, 2022 22:30:20
[DoS attack: Echo char gen] from source: 146.88.240.4, port 52575, Fri, Apr 01, 2022 19:37:27
[DoS attack: Echo char gen] from source: 66.240.236.109, port 55680, Fri, Apr 01, 2022 19:24:05
[DoS attack: Echo char gen] from source: 118.123.105.86, port 47748, Fri, Apr 01, 2022 16:36:20
[DoS attack: UDP Scan] from source: 106.75.98.89, port 58914, Fri, Apr 01, 2022 05:09:54
[DoS attack: Echo char gen] from source: 64.62.197.117, port 52020, Fri, Apr 01, 2022 02:19:58
[DoS attack: Echo char gen] from source: 183.136.225.9, port 39344, Fri, Apr 01, 2022 01:38:41
[DoS attack: UDP Scan] from source: 146.88.240.4, port 43068, Thu, Mar 31, 2022 22:45:58
[DoS attack: Echo char gen] from source: 146.88.240.4, port 50739, Thu, Mar 31, 2022 19:33:15
[DoS attack: Sync flood] from source: 147.78.47.189, port 65534, Thu, Mar 31, 2022 18:19:56

I went to Shield's up (haven't gone there in a loonnnng time and I am surprised they are still there), and it shows only a few of my ports as stealth. The rest are closed but responding to the scan. This is a bit disheartening for me, and encouraging to persistent hackers. How do you put the AC3200 (C7800) in a NON-RESPONSIVE state to probing? Turning off the logging isn't the solution here. I want to be able to make it so they don't get a response and assume nothing is there.

Thanks in advance,

FURRYe38 · Answer

Is Respond to WAN pings enabled on the modem? There is a setting under Advanced Tab/Setup/WAN setup I believe...

michaelkenward · Answer

Netgear's firmware is great at creating false reports of DoS attacks. Many of them are no such thing.
&nbsp;
Search - NETGEAR Communities – DoS attacks
&nbsp;
Use Whois.net to see who is behind some of them and you may find that they are from places like Facebook, Google, even your ISP.
&nbsp;
Here is a useful tool for that task:
&nbsp;
IPNetInfo: Retrieve IP Address Information from WHOIS servers
&nbsp;
If these events are slowing down your router, that may be because it is using up processor time as it writes the events to your logs. Anything that uses processor power – event logging, QoS management, traffic metering – may cause slowdowns. Disable logging of DoS attacks and see if that reduces the problem. This does not prevent the router from protecting you from the outside world.
&nbsp;

Kakusu · Answer

I am still looking for the ability to make the C7800 NOT respond to any port probes.

GRC shields up responds with the ports being closed but NOT STEALTH. The DOS reporting is incidental. I am not asking how to prevent the router from reporting these...

Even during the GRC scans it reports port probing in the logs. So I would like it if GRC reports STEALTH and not just closed.

I have responded to the commenters and apparently it's not posting it publicly... which is fine. I am still curious if this modem even has the ability that I am asking for. The rented cable modem had that ability.

FURRYe38 · Answer

Is Respond to WAN pings enabled on the modem? There is a setting under Advanced Tab/Setup/WAN setup I believe...

michaelkenward · Answer

See if there is anything hidden here:
&nbsp;
http://routerlogin.com/debug.htm
&nbsp;
The R7800 has settings, although some, like enabling Telnet, have been removed in later firmware.

Forum Discussion

How to get AC3200 (C7800) to not respond to probe attacks

8 Replies