NETGEAR is aware of a growing number of phone and online scams. To learn how to stay safe click here.
Forum Discussion
DoS attacks in log
Hi, I've been getting these Dos attacks from the same ip for a couple days then turned on DoS protection and went away for a day until today I got these DoS attacks. The ip I'm talking about are the ...
I'm sorry my question is if these are DoS attacks toward me or are they using me as a bot to attack someone else? I ask because it seems one is my own isp but the other is a ip from RIPE Network Coordination and it's target is Texas Department of Information Resources.
bp31 wrote:
I'm sorry my question is if these are DoS attacks toward me or are they using me as a bot to attack someone else?
OK. See my answer.
Most people ignore these false alarms.
If you think about it, the alerts just say "we repelled this attack on your system". That there was no attack, just means that the router foiled a non-existent onslaught.
Do note that blocking these DoS attacks is rather expensive CPU-wise as iptables is not the biggest speed monster. It's more expensive than loggin them.
I'm running for years with DoS protection disabled and have had no problems. Given the amount of false positives, I question michaelkenward claim that the router will protect you if DoS is turned on.
microchip8 wrote:
Given the amount of false positives, I question michaelkenward claim that the router will protect you if DoS is turned on.
Who said that? Read it again.
First you probably mean "off".
I did not say that you should turn off "DoS". What I suggested was disabling the logging of Known DoS attacks and Port Scans.That is on the Logs page of the controls.
Here's the exact wording I used:
Disable logging of DoS attacks and see if that reduces the problem.
Emphasis added.
This is not the same as Disable Port Scan and DoS Protection which appears on a completely different WAN Setup page in the router's controls.
In the same way, disabling the logging of Router operation (startup, get time etc) does not mean that you are turning off router operation.
michaelkenward wrote:
microchip8 wrote:Given the amount of false positives, I question michaelkenward claim that the router will protect you if DoS is turned on.
Who said that? Read it again.
First you probably mean "off".
I did not say that you should turn off "DoS". What I suggested was disabling the logging of Known DoS attacks and Port Scans.That is on the Logs page of the controls.
Here's the exact wording I used:
Disable logging of DoS attacks and see if that reduces the problem.
Emphasis added.
This is not the same as Disable Port Scan and DoS Protection which appears on a completely different WAN Setup page in the router's controls.
In the same way, disabling the logging of Router operation (startup, get time etc) does not mean that you are turning off router operation.
"If these events are slowing down your router, that may be because it is using up processor time as it writes the events to your logs."
Your words.
Blocking with iptables is more expensive than logging. Turning off loging and the amount of false positives will not "protect" you from anything much. You may relieve the CPU by turning loging off, but iptables is still there putting a strain on the CPU.
