DoS attack, Teardrop or derivative, Ping of Death, strange non-DHCP IP address connected to wifi

[LBermann]

I wanted to thank member ccunni3812 for the post tited "DoS attack and random ip addresses for iPhone"

I was having a similar problem with my IPad. As soon as my IPad was connected to my WiFI, I received DOS attacks - teardrop and SYN Flood. I had wiped my IPAD several times but it still came back.  Finally I figured out a few things.

I have my Apple device backed up and may have inadvertently backed up the "bug".  So everytime I download my backup, I got the bug again. I think I saved the bad website in my favorites. Since the DDOS attacks only happened when the wifi was turned on in my IPAD, I did the following:

1. Changed the admin password on my router (yes I know, rookie move to not have done it in the first place).
2. Turned on Access Control
3. Deleted all unnecessary websites saved in my favorites on my IPad.
4. Under Wan Setup, added the check mark to Disable port scan and Dos Protection from the router.
5. Watched my logs

I will continue to watch my logs on a regular basis to make sure the steps taken above continue to work. Honestly, I am just so happy to have my IPad back.

[fduate]

For those of us who are a bit technically challenged...see attached picture which explains this post:

[go4par]

This advice is not true. Click on the 'show/hide help center and it says only disable port scan and dos protection in rare occassions. DO NOT CHECK THE BOX.

[Astro-Cat]

[DoS attack: Teardrop or derivative] from 128.0.1.192,

Traced it to my Iphone (IP is different from my other devices.

Read the posts here, but still not 100% sure WHAT to do?

[larrycatoe]

Astro-cat, as far as I can tell there really has not been a resolution to this issue. I've researched it and have found nothing. Netgear clearly does not want to resolve this issue though. I have since moved to an Arris device.

[Astro-Cat]

---

@larrycatoe wrote:

Astro-cat, as far as I can tell there really has not been a resolution to this issue. I've researched it and have found nothing. Netgear clearly does not want to resolve this issue though. I have since moved to an Arris device.

Thanks for the reply back.  Do you happen to have a recommendation on which Arris device?

---

[larrycatoe]

I currently use the SBG6900. I recently move into a two story house and have noticed no difference in speed or coverage on my other devices up stairs. Also no TearDrop issues either. I purchased mine at Best Buy.

[Kingsquest]

Hello,

The SB6900 is a good modem. We here at HP are having printing issues with it. We are trying to work with Netgear to resolve the issue but at this time I would recomend the SB6190. it is a little cheaper but does not have the same issue. 

[larrycatoe]

Yes it is cheaper, I belive it's just a cable Modem without built in Wifi. I like all the Arris devices and believe you really cannot go wrong with any of them. I've been through a few of Linksys, Cisco and Netgear, so I have a vast amount of devices to compare them against. Thanks for bringing that model up too. 

[damianinpa]

Wow, I still can't believe Netgear never fixed this.  My advice to all reading...Get rid of your Netgear and buy a surfboard 6190 with a seperate wireless router.  I went with a good Asus.  Since my switch almost 2 years ago, I've had Zero issue.  No network drops or outages.  Just solid performance and reliable speeds.  I'm shocked that Netgear never chimed in just to say 'they are aware of the issue and will attempt a firmware fix'.  The lost a customer in me and I cannot imagine ever switching back to one of their products. 

[Astro-Cat]

I followed the advice given, got an Arris surfboard from Best Buy, $119

Only had one drop of signal in the past 6 hours of it being hooked up (usually I would get 6-7 in that same time period).  My online game (which I would get kicked from when the signal dropped) is still going after 6 hours straight.  I am sold!!!!!  Goodbye Netgear.

[Runemaster]

Here is the best fix....
1. Make sure firmware is fully up to date.
2. Keep the box checked for the dos and port scan protection setting. I played with this setting...you definitely want this checked.
3. Enable the guest band, put a strong password on it and make sure you leave the box that states something along the lines of " can access local resources and see other devices on network" unchecked
4. Put troubled devices on that guest network
5. Put new strong passwords on your router login, your 2.4 and 5 ghz regular or non guest ssid bands.

*** Strong password is 10 characters or more with upper and lower case numbers and special characters...



"Knowledge is power my friends"
"May the powershell be with you"

[fduate]

Comcast Xfinity is responsible for updating latest software, option is not possible for consumers. Also Netgear does not recommend checking box for DOS.

[go4par]

Thank you for taking the time and detail.  I did put the ipad on as guest and changed PW's as you suggested and so far so good (DNS is still DOS targeting the modem/router IP?).  I did not check the "disable port scan..." despite (1) it does stop the logging of DOS attacks AND (2) it is the default, because the same page's 'help' says not to disable it AND it doesn't make sense to me to disable DOS protection.  That is why I came to this post because it is very misleading.  I am wondering IF the line should have included the word "...and ENABLE dos Protection".?? Thanks again.