NETGEAR is aware of a growing number of phone and online scams. To learn how to stay safe click here.
Forum Discussion
Solved
Dos Attacks
[DoS Attack: Land Attack] from source: 255.255.255.255, port 67, Saturday, September 12, 2015 15:58:56
[DoS Attack: Land Attack] from source: 255.255.255.255, port 67, Saturday, September 12, 2015 14:50:46
[DoS Attack: Land Attack] from source: 255.255.255.255, port 67, Saturday, September 12, 2015 13:40:32
[DoS Attack: Land Attack] from source: 255.255.255.255, port 67, Saturday, September 12, 2015 10:54:18
[DoS Attack: Land Attack] from source: 255.255.255.255, port 67, Saturday, September 12, 2015 10:31:24
[Time synchronized with NTP server] Saturday, September 12, 2015 10:20:49
[DoS Attack: Land Attack] from source: 255.255.255.255, port 67, Saturday, September 12, 2015 08:55:26
[DHCP IP: 192.168.1.3] to MAC address b4:79:a7:03:e2:3e, Saturday, September 12, 2015 08:48:07
[DoS Attack: Land Attack] from source: 255.255.255.255, port 67, Saturday, September 12, 2015 08:41:56
[DoS Attack: Land Attack] from source: 255.255.255.255, port 67, Saturday, September 12, 2015 07:32:48
[DoS Attack: Land Attack] from source: 255.255.255.255, port 67, Saturday, September 12, 2015 06:51:22
[DoS Attack: Land Attack] from source: 255.255.255.255, port 67, Saturday, September 12, 2015 06:08:33
[DoS Attack: Land Attack] from source: 255.255.255.255, port 67, Saturday, September 12, 2015 05:29:52
[DoS Attack: Land Attack] from source: 255.255.255.255, port 67, Saturday, September 12, 2015 03:38:12
[DoS Attack: Land Attack] from source: 255.255.255.255, port 67, Friday, September 11, 2015 23:41:12
[DoS Attack: TCP/UDP Chargen] from source: 74.82.47.5, port 59305, Friday, September 11, 2015 23:33:31
[DoS Attack: Land Attack] from source: 255.255.255.255, port 67, Friday, September 11, 2015 23:14:06
[DoS Attack: Land Attack] from source: 255.255.255.255, port 67, Friday, September 11, 2015 21:38:51
There are several more of these on my router log. Is this something to worry about? It has been going on for over a week. I just got a new computer. I've changed my IP address even. Still keeps showing up. I've run AVG scan and Anti-Malware scan. Nothing is showing up. PLUS, my internet has not been interrupted at all during these times. I've been playing games like league of legends, and afterward would log onto my router, and a dos attack with that same repeated IP address shows up. However, nothing happened. What is going on?
Ok. Port 67, along with port 68, is used for DHCP. It's a little strange for the router to be complaining about DHCP unless somehow it's detecting a large burst of DHCP Requests in a short period of time.
According to your logs, the timestamps between "attacks" are several minutes to several hours apart, so it doesn't seem to be happening all that frequently and is probably not a real DoS attack. Perhaps you have an old device on your network that doesn't have a good DHCP Client implementation. If you are not seeing any performance or network issues, then I wouldn't worry about it.
7 Replies
Do you, by any chance, have Access Control enabled? Someone else on this forum started seeing this DoS attacks logged after enabling Access Control. We guessed that there is a bug with the DoS attack detection algorithm that is exposed whenever Access Control is enabled.
Access Control is easily bypassed, so it's nearly useless. It's no substitute for a good, strong Wi-Fi password. I recommend that you disable it.
No I do not have access control on.
Ok. Port 67, along with port 68, is used for DHCP. It's a little strange for the router to be complaining about DHCP unless somehow it's detecting a large burst of DHCP Requests in a short period of time.
According to your logs, the timestamps between "attacks" are several minutes to several hours apart, so it doesn't seem to be happening all that frequently and is probably not a real DoS attack. Perhaps you have an old device on your network that doesn't have a good DHCP Client implementation. If you are not seeing any performance or network issues, then I wouldn't worry about it.
- Thank you for your reply. I'm not sure if I have it enabled. Will have to figure out how to check and how to disable it.
Land Attack source 255.255.255.255 is caused by fragmented/ lost packets and not an actual attack via another computer. Im having the same issue , even going into the security section of the router keywords or closing the port 67 has no effect. I have not found any way to stop or find out more about this issue. I suspect it is a dns server problem provided by my ISP which is Charter Communications.
- I have Charter communications as well. Maybe it is with ISP.