NETGEAR is aware of a growing number of phone and online scams. To learn how to stay safe click here.

Forum Discussion

X0DX0A's avatar
X0DX0A
Aspirant
Sep 24, 2018

Recieving DoS Attacks

Hello All,

 

I have a netgear C3700 for my home router/modem. My ISP is currently Comcast. Firmware - 2.02.17. A few weeks ago my wireless started dropping off frequently and at first I thought it was maybe EOL, end of life, as ive had the router now for about 1.5 years. But I decided to take a look through the logs and noticed multiple DoS SYN Flood Attacks, Teardrop Attacks and Ping of Death attacks. After running the source IP in geolocate, they usually point to some foreign country (Russia, France, Netherlands), mostly countries for bad actors? But anyways, so first thought is to look for GeoBlock settings or IP based blocking settings. Which I do not see as a possibility with this router. Tried to call comcast and explain to them that I wanted to buy a seperate static IP for my home account and they just didnt understand. Also looked into installing DD-WRT on this, but after looking through their wiki, it doesnt look like this model is compatible.

Im wondering if its just time for me to get a new router and submit to the advice of Comcast or if there is some rock I have not turned here. Apologies for the novel. Logs are available - I did clear them this morning to take a fresh set.

Security

3 Replies

    • JBGarza92's avatar
      JBGarza92
      Aspirant
      Sep 27, 2018
      Hello, I have the same model, what would the printer being connected cause? Because I'm having issues similar and i have a printer connected
    • X0DX0A's avatar
      X0DX0A
      Aspirant
      Oct 03, 2018

      I do not have any printers plugged in. I do have VOIP phone plugged in but this issue pre-dates me using a VOIP phone and the issue stilll occurs when my phone is unplugged. This is what I see in my logs. I notice the occurnacy for these is a "1" I have more info showing ones of 30-40 occurances as well.

       

      DoS attack: SYN Flood] from 195.154.161.224, port 7118 1 Wed Oct 03 05:12:51 2018 192.168.0.12:52358 195.154.161.224:7118
      [DoS attack: SYN Flood] from 23.206.121.25, port 443 1 Wed Oct 03 05:12:34 2018 192.168.0.12:52249 23.206.121.25:443
      [admin login] from source 192.168.0.12 1 Wed Oct 03 05:12:26 2018 0.0.0.0:0 192.168.0.12:0
      [DoS attack: SYN Flood] from 23.206.121.15, port 443 1 Wed Oct 03 05:12:23 2018 192.168.0.12:52149 23.206.121.15:443
      [DoS attack: SYN Flood] from 23.64.215.152, port 443 1 Wed Oct 03 05:12:14 2018 192.168.0.12:52095 23.64.215.152:443
      [DoS attack: SYN Flood] from 35.165.181.113, port 443 1 Wed Oct 03 05:11:23 2018 192.168.0.12:51910 35.165.181.113:443
      [DoS attack: SYN Flood] from 195.154.161.224, port 7118 1 Wed Oct 03 05:11:13 2018 192.168.0.12:51850 195.154.161.224:7118
      [DoS attack: SYN Flood] from 62.210.106.166, port 3875 1 Wed Oct 03 05:11:00 2018 192.168.0.12:51748 62.210.106.166:3875
      [DoS attack: SYN Flood] from 172.217.14.198, port 443 1 Wed Oct 03 05:10:49 2018 192.168.0.12:51739 172.217.14.198:443
      [DoS attack: SYN Flood] from 216.58.217.46, port 80 1 Wed Oct 03 05:10:36 2018 192.168.0.12:51693 216.58.217.46:80
      [DoS attack: SYN Flood] from 208.74.205.20, port 443 1 Wed Oct 03 05:10:25 2018 192.168.0.12:51644 208.74.205.20:443