NETGEAR is aware of a growing number of phone and online scams. To learn how to stay safe click here.

Forum Discussion

CDKoger's avatar
CDKoger
Guide
Jun 30, 2016
Solved

DoS attack: FIN Scan from Microsoft

Since a few weeks we have a new satellite dish operational, providing fast internet thru the 
Astra -3 satellite. I had hoped the 8-fold increase of bandwidth would solve the old problem
of a netgear router not receiving date/time signals, but NO, it is still Jan 01, 2003.

What is new and utterly annoying is a relentless attack from a Microsoft server in Singapore.
I reported the abuse and asked for an explanation but received only an automatic response.
Not only do I have to pay for every byte they send me, but as you can see it also disrupts
normal operation.
Is there anything I can do to stop this?


There are now 19 log files in my inbox containing only lines like this:

[DoS attack: FIN Scan] attack packets in last 20 sec from ip [111.221.77.151], Wednesday, [email failed] internet connection is dropped, Wednesday, Jan 01,2003 13:11:27 [DoS attack: FIN Scan] attack packets in last 20 sec from ip [111.221.77.151], Wednesday, [email failed] internet connection is dropped, Wednesday, Jan 01,2003 13:11:05 [DoS attack: FIN Scan] attack packets in last 20 sec from ip [111.221.77.151], Wednesday, [email failed] internet connection is dropped, Wednesday, Jan 01,2003 13:10:43 [DoS attack: FIN Scan] attack packets in last 20 sec from ip [111.221.77.151], Wednesday, [email failed] internet connection is dropped, Wednesday, Jan 01,2003 13:10:22 [DoS attack: FIN Scan] attack packets in last 20 sec from ip [111.221.77.151], Wednesday, [email failed] internet connection is dropped, Wednesday, Jan 01,2003 13:10:00 [DoS attack: FIN Scan] attack packets in last 20 sec from ip [111.221.77.151], Wednesday, [email failed] internet connection is dropped, Wednesday, Jan 01,2003 13:09:40
  • Wrote a complaint to cert@microsoft.com.

    No reply, but the attack has ceased.

5 Replies

  • Retired_Member's avatar
    Retired_Member

    contact ISP and have them change you IP.

     

    Do you play games, X Box?

    • CDKoger's avatar
      CDKoger
      Guide

      This is just a high speed satellite link we've hired from SES/Astra in Luxembourg. No helpdesk, no other services than providing an operational link to a fixed IP address.

      We use it for mail and normal internet traffic only. This is a remote area.

      • Retired_Member's avatar
        Retired_Member

        bypass router and connect directly to link modem, see if public IP changes, if yes reconnect router and use PC MAC in router setup, if no change get use to it or find another vendor.