Blinking download light, slow download speed, DoS attacks on C7000

HrothgarS · ‎2017-10-18

My C7000 modem router is giving me very slow download speeds (5 - 40 Mbps; I pay for 200 Mbps) and the download lightning bolt indicator light is blinking. I have contacted Comcast and done their troubleshooting to no avail.

My logs also show a number of DoS attacks. I appreciate your help.

Logs:

Description	Count	Last Occurrence	Target	Source
[admin login] from source 0.0.0.0	2	Wed Oct 18 08:56:45 2017	0.0.0.0:0	0.0.0.0:0
[admin login failure] from source 0.0.0.0	1	Wed Oct 18 08:55:23 2017	0.0.0.0:0	0.0.0.0:0
[admin login] from source 0.0.0.0	1	Wed Oct 18 08:48:31 2017	0.0.0.0:0	0.0.0.0:0
[DHCP IP: 192.168.0.15] to MAC address 20:c9:d0:45:16:ff	1	Wed Oct 18 08:18:21 2017	0.0.0.0:0	0.0.0.0:0
[DHCP IP: 192.168.0.15] to MAC address 20:c9:d0:45:16:ff	1	Wed Oct 18 08:16:46 2017	0.0.0.0:0	0.0.0.0:0
[DoS attack: Illegal Fragments] from 77.2.109.144, port 0	2	Wed Oct 18 08:10:31 2017	72.198.188.191:0	77.2.109.144:0
[DoS attack: Teardrop or derivative] from 77.2.109.144, port 0	2	Wed Oct 18 08:03:37 2017	72.198.188.191:0	77.2.109.144:0
[DoS attack: Ping Of Death] from 77.2.109.144, port 0	3	Wed Oct 18 08:03:09 2017	72.198.188.191:0	77.2.109.144:0
[DoS attack: Teardrop or derivative] from 77.2.109.144, port 0	3	Wed Oct 18 08:02:30 2017	72.198.188.191:0	77.2.109.144:0
[DoS attack: Illegal Fragments] from 77.2.109.144, port 0	1	Wed Oct 18 08:02:03 2017	72.198.188.191:0	77.2.109.144:0
[DoS attack: Ping Of Death] from 77.2.109.144, port 0	1	Wed Oct 18 08:02:03 2017	72.198.188.191:0	77.2.109.144:0
[DoS attack: Teardrop or derivative] from 77.2.109.144, port 0	3	Wed Oct 18 07:59:44 2017	72.198.188.191:0	77.2.109.144:0
[DoS attack: Ping Of Death] from 77.2.109.144, port 0	10	Wed Oct 18 07:57:42 2017	72.198.188.191:0	77.2.109.144:0
[DoS attack: Teardrop or derivative] from 77.2.109.144, port 0	2	Wed Oct 18 07:56:47 2017	72.198.188.191:0	77.2.109.144:0
[DoS attack: Illegal Fragments] from 77.2.109.144, port 0	1	Wed Oct 18 07:56:39 2017	72.198.188.191:0	77.2.109.144:0
[DoS attack: Teardrop or derivative] from 77.2.109.144, port 0	7	Wed Oct 18 07:56:39 2017	72.198.188.191:0	77.2.109.144:0
[DoS attack: Ping Of Death] from 77.2.109.144, port 0	4	Wed Oct 18 07:56:17 2017	72.198.188.191:0	77.2.109.144:0
[DoS attack: Teardrop or derivative] from 77.2.109.144, port 0	1	Wed Oct 18 07:53:20 2017	72.198.188.191:0	77.2.109.144:0
[DoS attack: Ping Of Death] from 77.2.109.144, port 0	6	Wed Oct 18 07:53:18 2017	72.198.188.191:0	77.2.109.144:0
[DoS attack: Teardrop or derivative] from 77.2.109.144, port 0	4	Wed Oct 18 07:53:16 2017	72.198.188.191:0	77.2.109.144:0
[DoS attack: Ping Of Death] from 77.2.109.144, port 0	2	Wed Oct 18 07:53:06 2017	72.198.188.191:0	77.2.109.144:0
[DoS attack: Teardrop or derivative] from 77.2.109.144, port 0	2	Wed Oct 18 07:53:05 2017	72.198.188.191:0	77.2.109.144:0
[DoS attack: Ping Of Death] from 77.2.109.144, port 0	1	Wed Oct 18 07:53:03 2017	72.198.188.191:0	77.2.109.144:0
[DoS attack: Teardrop or derivative] from 77.2.109.144, port 0	2	Wed Oct 18 07:52:57 2017	72.198.188.191:0	77.2.109.144:0
[DoS attack: Illegal Fragments] from 77.2.109.144, port 0	1	Wed Oct 18 07:52:57 2017	72.198.188.191:0	77.2.109.144:0
[DoS attack: Teardrop or derivative] from 77.2.109.144, port 0	1	Wed Oct 18 07:52:56 2017	72.198.188.191:0	77.2.109.144:0
[DoS attack: Illegal Fragments] from 77.2.109.144, port 0	2	Wed Oct 18 07:51:11 2017	72.198.188.191:0	77.2.109.144:0
[DoS attack: Teardrop or derivative] from 77.2.109.144, port 0	1	Wed Oct 18 07:25:39 2017	72.198.188.191:0	77.2.109.144:0
[DoS attack: Illegal Fragments] from 77.2.109.144, port 0	2	Wed Oct 18 07:25:39 2017	72.198.188.191:0	77.2.109.144:0
[DoS attack: Teardrop or derivative] from 77.2.109.144, port 0	1	Wed Oct 18 07:25:24 2017	72.198.188.191:0	77.2.109.144:0
[DHCP IP: 192.168.0.15] to MAC address 20:c9:d0:45:16:ff	1	Wed Oct 18 07:23:07 2017	0.0.0.0:0	0.0.0.0:0
[DoS attack: Ping Of Death] from 77.2.109.144, port 0	1	Wed Oct 18 07:11:20 2017	72.198.188.191:0	77.2.109.144:0
[DoS attack: Teardrop or derivative] from 77.2.109.144, port 0	2	Wed Oct 18 07:05:59 2017	72.198.188.191:0	77.2.109.144:0
[DoS attack: Illegal Fragments] from 77.2.109.144, port 0	1	Wed Oct 18 06:41:40 2017	72.198.188.191:0	77.2.109.144:0
[DHCP IP: 192.168.0.15] to MAC address 20:c9:d0:45:16:ff	1	Wed Oct 18 05:45:28 2017	0.0.0.0:0	0.0.0.0:0
[DoS attack: Teardrop or derivative] from 77.2.109.144, port 0	1	Wed Oct 18 05:26:40 2017	72.198.188.191:0	77.2.109.144:0
[DoS attack: Ping Of Death] from 77.2.109.144, port 0	1	Wed Oct 18 04:22:53 2017	72.198.188.191:0	77.2.109.144:0
[DoS attack: Teardrop or derivative] from 77.2.109.144, port 0	4	Wed Oct 18 04:22:46 2017	72.198.188.191:0	77.2.109.144:0
[DHCP IP: 192.168.0.15] to MAC address 20:c9:d0:45:16:ff	1	Wed Oct 18 04:14:52 2017	0.0.0.0:0	0.0.0.0:0
[DoS attack: Teardrop or derivative] from 77.2.109.144, port 0	4	Wed Oct 18 04:04:27 2017	72.198.188.191:0	77.2.109.144:0
[DoS attack: IP packet w/MC or BC SRC addr] from 207.46.134.255, port 443	1	Wed Oct 18 02:45:35 2017	192.168.0.15:53514	207.46.134.255:443
[DoS attack: IP packet w/MC or BC SRC addr] from 207.46.134.255, port 443	1	Wed Oct 18 02:45:33 2017	192.168.0.15:53503	207.46.134.255:443
[DoS attack: IP packet w/MC or BC SRC addr] from 207.46.134.255, port 443	1	Wed Oct 18 02:45:07 2017	192.168.0.15:53514	207.46.134.255:443
[DoS attack: IP packet w/MC or BC SRC addr] from 207.46.134.255, port 443	1	Wed Oct 18 02:45:05 2017	192.168.0.15:53503	207.46.134.255:443
[DoS attack: IP packet w/MC or BC SRC addr] from 207.46.134.255, port 443	1	Wed Oct 18 02:44:46 2017	192.168.0.15:53514	207.46.134.255:443
[DoS attack: IP packet w/MC or BC SRC addr] from 207.46.134.255, port 443	1	Wed Oct 18 02:44:44 2017	192.168.0.15:53503	207.46.134.255:443
[DoS attack: IP packet w/MC or BC SRC addr] from 207.46.134.255, port 443	1	Wed Oct 18 02:44:36 2017	192.168.0.15:53514	207.46.134.255:443
[DoS attack: IP packet w/MC or BC SRC addr] from 207.46.134.255, port 443	1	Wed Oct 18 02:44:34 2017	192.168.0.15:53503	207.46.134.255:443
[DoS attack: IP packet w/MC or BC SRC addr] from 207.46.134.255, port 443	1	Wed Oct 18 02:44:30 2017	192.168.0.15:53514	207.46.134.255:443
[DoS attack: IP packet w/MC or BC SRC addr] from 207.46.134.255, port 443	1	Wed Oct 18 02:44:28 2017	192.168.0.15:53503	207.46.134.255:443
[DoS attack: IP packet w/MC or BC SRC addr] from 207.46.134.255, port 443	1	Wed Oct 18 02:44:27 2017	192.168.0.15:53514	207.46.134.255:443
[DoS attack: IP packet w/MC or BC SRC addr] from 207.46.134.255, port 443	1	Wed Oct 18 02:44:25 2017	192.168.0.15:53503	207.46.134.255:443

DarrenM · ‎2017-10-20

What device on your network is using 192.168.0.15 Ip address that device seems to be triggering alot of attacks you may want to disconnect it and see if that is the issue.

DarrenM

rarossin · ‎2017-10-22

Had a similar problem getting my C7100 to connect with Comcast and I had a technician out to the house. He immediately found the problem, a physical filter on the line which blocks some of the channels the modem needs.

HrothgarS · ‎2017-10-22

Thanks both of you for your responses. The slow download speeds turn out to have resulted from squirrels nibbling on our cable lines; Comcast replaced them today and the speed is back to normal.

Regarding the DoS attacks, very few of them reference an IP address of any machine I have in the house - the vast majority are coming from foreign IP addresses.

[DoS attack: Ping Of Death] from 77.2.109.144, port 0	1	Sun Oct 22 15:28:57 2017	180.108.126.95:0	77.2.109.144:0
[DoS attack: Illegal Fragments] from 77.2.109.144, port 0	1	Sun Oct 22 15:28:23 2017	85.54.72.208:0	77.2.109.144:0

Blinking download light, slow download speed, DoS attacks on C7000

Blinking download light, slow download speed, DoS attacks on C7000

Re: Blinking download light, slow download speed, DoS attacks on C7000

Re: Blinking download light, slow download speed, DoS attacks on C7000

Re: Blinking download light, slow download speed, DoS attacks on C7000