Re: Frequent Lag Spikes/DoS Attacks

kev11n · ‎2016-01-04

I need help figuring out why my internet keeps going out on me and lagging horibbly.

I think I am getting DoS attacked, but don't understand how since what I believe to be the DoS attacks aren't targetted at me.

I found out that the 1.0.77.208 seems to be coming from Japan, and is flooding my network.

I have Comcast Xfinity 250 / 25 Mbps. Using the NETGEAR C7000-100NAS Firmware Version V1.01.19

I have been having these issues for the past 3 months and have finally narrowed it down to what seems to be this.

My roommate Streams on Twitch and it completely shuts off his streaming capabilities when this occurs. Our speeds go from 250 / 25 Mbps down to 10 / 0.7 Mbps for 4-7 minutes and then will be fine anywhere from 1 hour to 10 hours.

[DoS attack: Ping Of Death] from 1.0.77.208, port 0   6   Sun Jan 03 22:17:32 2016   64.230.252.119:0   1.0.77.208:0
[DoS attack: Teardrop or derivative] from 1.0.77.208, port 0   3   Sun Jan 03 22:17:25 2016   64.230.252.119:0   1.0.77.208:0
[DoS attack: Ping Of Death] from 1.0.77.208, port 0   6   Sun Jan 03 22:17:22 2016   64.230.252.119:0   1.0.77.208:0
[DoS attack: Teardrop or derivative] from 1.0.77.208, port 0   2   Sun Jan 03 22:17:22 2016   64.230.252.119:0   1.0.77.208:0
[DoS attack: Ping Of Death] from 1.0.77.208, port 0   3   Sun Jan 03 22:17:17 2016   64.230.252.119:0   1.0.77.208:0
[DoS attack: Teardrop or derivative] from 1.0.77.208, port 0   1   Sun Jan 03 22:17:04 2016   64.230.252.119:0   1.0.77.208:0
[DoS attack: Ping Of Death] from 1.0.77.208, port 0   3   Sun Jan 03 22:17:04 2016   64.230.252.119:0   1.0.77.208:0
[DoS attack: Teardrop or derivative] from 1.0.77.208, port 0   2   Sun Jan 03 22:16:33 2016   64.230.252.119:0   1.0.77.208:0
[DoS attack: Ping Of Death] from 1.0.77.208, port 0   1   Sun Jan 03 22:16:33 2016   64.230.252.119:0   1.0.77.208:0
[DoS attack: Illegal Fragments] from 1.0.77.208, port 0   1   Sun Jan 03 22:16:33 2016   64.230.252.119:0   1.0.77.208:0
[DoS attack: Ping Of Death] from 1.0.77.208, port 0   7   Sun Jan 03 22:16:27 2016   64.230.252.119:0   1.0.77.208:0
[DoS attack: Teardrop or derivative] from 1.0.77.208, port 0   3   Sun Jan 03 22:16:18 2016   64.230.252.119:0   1.0.77.208:0
[DoS attack: Ping Of Death] from 1.0.77.208, port 0   6   Sun Jan 03 22:16:18 2016   64.230.252.119:0   1.0.77.208:0
[DoS attack: Teardrop or derivative] from 1.0.77.208, port 0   1   Sun Jan 03 22:16:11 2016   64.230.252.119:0   1.0.77.208:0
[DoS attack: Ping Of Death] from 1.0.77.208, port 0   11   Sun Jan 03 22:16:11 2016   64.230.252.119:0   1.0.77.208:0
[DoS attack: Teardrop or derivative] from 1.0.77.208, port 0   4   Sun Jan 03 22:15:49 2016   64.230.252.119:0   1.0.77.208:0
[DoS attack: Ping Of Death] from 1.0.77.208, port 0   8   Sun Jan 03 22:15:29 2016   64.230.252.119:0   1.0.77.208:0
[DoS attack: Teardrop or derivative] from 1.0.77.208, port 0   1   Sun Jan 03 22:15:22 2016   64.230.252.119:0   1.0.77.208:0
[DoS attack: Ping Of Death] from 1.0.77.208, port 0   5   Sun Jan 03 22:15:22 2016   64.230.252.119:0   1.0.77.208:0
[DoS attack: Teardrop or derivative] from 1.0.77.208, port 0   3   Sun Jan 03 22:15:08 2016   64.230.252.119:0   1.0.77.208:0
[DoS attack: Ping Of Death] from 1.0.77.208, port 0   2   Sun Jan 03 22:14:58 2016   64.230.252.119:0   1.0.77.208:0
[DoS attack: Teardrop or derivative] from 1.0.77.208, port 0   1   Sun Jan 03 22:14:56 2016   64.230.252.119:0   1.0.77.208:0
[DoS attack: Ping Of Death] from 1.0.77.208, port 0   1   Sun Jan 03 22:14:54 2016   64.230.252.119:0   1.0.77.208:0
[DoS attack: Teardrop or derivative] from 1.0.77.208, port 0   6   Sun Jan 03 22:14:54 2016   64.230.252.119:0   1.0.77.208:0
[DoS attack: Illegal Fragments] from 1.0.77.208, port 0   1   Sun Jan 03 22:14:33 2016   64.230.252.119:0   1.0.77.208:0
[DoS attack: Teardrop or derivative] from 1.0.77.208, port 0   6   Sun Jan 03 22:14:33 2016   64.230.252.119:0   1.0.77.208:0
[DoS attack: Ping Of Death] from 1.0.77.208, port 0   4   Sun Jan 03 22:14:28 2016   64.230.252.119:0   1.0.77.208:0
[DoS attack: Teardrop or derivative] from 1.0.77.208, port 0   1   Sun Jan 03 22:14:24 2016   64.230.252.119:0   1.0.77.208:0
[DoS attack: Ping Of Death] from 1.0.77.208, port 0   3   Sun Jan 03 22:14:19 2016   64.230.252.119:0   1.0.77.208:0
[DoS attack: Teardrop or derivative] from 1.0.77.208, port 0   6   Sun Jan 03 22:14:02 2016   64.230.252.119:0   1.0.77.208:0
[DoS attack: Ping Of Death] from 1.0.77.208, port 0   1   Sun Jan 03 22:13:57 2016   64.230.252.119:0   1.0.77.208:0
[DoS attack: Teardrop or derivative] from 1.0.77.208, port 0   2   Sun Jan 03 22:13:57 2016   64.230.252.119:0   1.0.77.208:0
[DoS attack: Ping Of Death] from 1.0.77.208, port 0   1   Sun Jan 03 22:13:50 2016   64.230.252.119:0   1.0.77.208:0
[DoS attack: Teardrop or derivative] from 1.0.77.208, port 0   2   Sun Jan 03 22:13:50 2016   64.230.252.119:0   1.0.77.208:0
[DoS attack: Ping Of Death] from 1.0.77.208, port 0   2   Sun Jan 03 22:13:49 2016   64.230.252.119:0   1.0.77.208:0
[DoS attack: Teardrop or derivative] from 1.0.77.208, port 0   1   Sun Jan 03 22:13:35 2016   64.230.252.119:0   1.0.77.208:0
[DoS attack: Ping Of Death] from 1.0.77.208, port 0   3   Sun Jan 03 22:13:34 2016   64.230.252.119:0   1.0.77.208:0
[DoS attack: Teardrop or derivative] from 1.0.77.208, port 0   1   Sun Jan 03 22:13:30 2016   64.230.252.119:0   1.0.77.208:0
[DoS attack: Ping Of Death] from 1.0.77.208, port 0   3   Sun Jan 03 22:13:29 2016   64.230.252.119:0   1.0.77.208:0
[DoS attack: Teardrop or derivative] from 1.0.77.208, port 0   2   Sun Jan 03 22:13:27 2016   64.230.252.119:0   1.0.77.208:0
[DoS attack: Ping Of Death] from 1.0.77.208, port 0   2   Sun Jan 03 22:13:14 2016   64.230.252.119:0   1.0.77.208:0
[DoS attack: Teardrop or derivative] from 1.0.77.208, port 0   7   Sun Jan 03 22:13:01 2016   64.230.252.119:0   1.0.77.208:0
[DoS attack: Ping Of Death] from 1.0.77.208, port 0   1   Sun Jan 03 22:12:55 2016   64.230.252.119:0   1.0.77.208:0
[DoS attack: Teardrop or derivative] from 1.0.77.208, port 0   2   Sun Jan 03 22:12:46 2016   64.230.252.119:0   1.0.77.208:0
[DoS attack: Ping Of Death] from 1.0.77.208, port 0   4   Sun Jan 03 22:12:41 2016   64.230.252.119:0   1.0.77.208:0
[DoS attack: Teardrop or derivative] from 1.0.77.208, port 0   2   Sun Jan 03 22:12:40 2016   64.230.252.119:0   1.0.77.208:0
[DoS attack: Ping Of Death] from 1.0.77.208, port 0   2   Sun Jan 03 22:12:38 2016   64.230.252.119:0   1.0.77.208:0
[DoS attack: Teardrop or derivative] from 1.0.77.208, port 0   1   Sun Jan 03 22:12:31 2016   64.230.252.119:0   1.0.77.208:0
[DoS attack: Ping Of Death] from 1.0.77.208, port 0   2   Sun Jan 03 22:12:31 2016   64.230.252.119:0   1.0.77.208:0
[DoS attack: Illegal Fragments] from 1.0.77.208, port 0   1   Sun Jan 03 22:12:30 2016   64.230.252.119:0   1.0.77.208:0
[DoS attack: Teardrop or derivative] from 1.0.77.208, port 0   1   Sun Jan 03 22:12:29 2016   64.230.252.119:0   1.0.77.208:0
[DoS attack: Ping Of Death] from 1.0.77.208, port 0   3   Sun Jan 03 22:12:25 2016   64.230.252.119:0   1.0.77.208:0
[DoS attack: Teardrop or derivative] from 1.0.77.208, port 0   1   Sun Jan 03 22:12:14 2016   64.230.252.119:0   1.0.77.208:0
[DoS attack: Ping Of Death] from 1.0.77.208, port 0   12   Sun Jan 03 22:12:12 2016   64.230.252.119:0   1.0.77.208:0
[DoS attack: Teardrop or derivative] from 1.0.77.208, port 0   3   Sun Jan 03 22:12:04 2016   64.230.252.119:0   1.0.77.208:0
[DoS attack: Ping Of Death] from 1.0.77.208, port 0   1   Sun Jan 03 22:12:01 2016   209.186.64.22:0   1.0.77.208:0
[DoS attack: Illegal Fragments] from 1.0.77.208, port 0   3   Sun Jan 03 22:12:01 2016   209.186.64.22:0   1.0.77.208:0
[DoS attack: Ping Of Death] from 1.0.77.208, port 0   13   Sun Jan 03 22:12:00 2016   64.230.252.119:0   1.0.77.208:0
[DoS attack: Teardrop or derivative] from 1.0.77.208, port 0   3   Sun Jan 03 22:11:51 2016   64.230.252.119:0   1.0.77.208:0
[DoS attack: Ping Of Death] from 1.0.77.208, port 0   2   Sun Jan 03 22:11:22 2016   64.230.252.119:0   1.0.77.208:0
[DoS attack: Teardrop or derivative] from 1.0.77.208, port 0   1   Sun Jan 03 22:11:14 2016   64.230.252.119:0   1.0.77.208:0
[DoS attack: Ping Of Death] from 1.0.77.208, port 0   4   Sun Jan 03 22:11:12 2016   64.230.252.119:0   1.0.77.208:0
[DoS attack: Teardrop or derivative] from 1.0.77.208, port 0   1   Sun Jan 03 22:11:09 2016   64.230.252.119:0   1.0.77.208:0
[DoS attack: Ping Of Death] from 1.0.77.208, port 0   3   Sun Jan 03 22:11:09 2016   64.230.252.119:0   1.0.77.208:0
[DoS attack: Teardrop or derivative] from 1.0.77.208, port 0   2   Sun Jan 03 22:11:04 2016   64.230.252.119:0   1.0.77.208:0
[DoS attack: Ping Of Death] from 1.0.77.208, port 0   27   Sun Jan 03 22:10:38 2016   64.230.252.119:0   1.0.77.208:0
[DoS attack: Teardrop or derivative] from 1.0.77.208, port 0   1   Sun Jan 03 22:10:15 2016   64.230.252.119:0   1.0.77.208:0
[DoS attack: Ping Of Death] from 1.0.77.208, port 0   7   Sun Jan 03 22:10:12 2016   64.230.252.119:0   1.0.77.208:0
[DoS attack: Teardrop or derivative] from 1.0.77.208, port 0   1   Sun Jan 03 22:10:02 2016   64.230.252.119:0   1.0.77.208:0
[DoS attack: Ping Of Death] from 1.0.77.208, port 0   2   Sun Jan 03 22:10:02 2016   64.230.252.119:0   1.0.77.208:0
[DoS attack: Teardrop or derivative] from 1.0.77.208, port 0   1   Sun Jan 03 22:10:00 2016   64.230.252.119:0   1.0.77.208:0
[DoS attack: Ping Of Death] from 1.0.77.208, port 0   7   Sun Jan 03 22:09:59 2016   64.230.252.119:0   1.0.77.208:0
[DoS attack: Teardrop or derivative] from 1.0.77.208, port 0   2   Sun Jan 03 22:09:50 2016   64.230.252.119:0   1.0.77.208:0
[DoS attack: Ping Of Death] from 1.0.77.208, port 0   9   Sun Jan 03 22:09:46 2016   64.230.252.119:0   1.0.77.208:0
[DoS attack: Ping Of Death] from 1.0.77.208, port 0   1   Sun Jan 03 22:09:17 2016   209.186.64.22:0   1.0.77.208:0
[DoS attack: Illegal Fragments] from 1.0.77.208, port 0   2   Sun Jan 03 22:09:17 2016   209.186.64.22:0   1.0.77.208:0
[DoS attack: Ping Of Death] from 1.0.77.208, port 0   1   Sun Jan 03 22:09:17 2016   64.230.252.119:0   1.0.77.208:0
[DoS attack: Teardrop or derivative] from 1.0.77.208, port 0   4   Sun Jan 03 22:09:16 2016   209.186.64.22:0   1.0.77.208:0
[DoS attack: Ping Of Death] from 1.0.77.208, port 0   10   Sun Jan 03 22:09:10 2016   209.186.64.22:0   1.0.77.208:0
[DoS attack: Teardrop or derivative] from 1.0.77.208, port 0   1   Sun Jan 03 22:09:09 2016   209.186.64.22:0   1.0.77.208:0
[DoS attack: Illegal Fragments] from 1.0.77.208, port 0   2   Sun Jan 03 22:09:08 2016   209.186.64.22:0   1.0.77.208:0
[DoS attack: Ping Of Death] from 1.0.77.208, port 0   1   Sun Jan 03 22:09:06 2016   64.230.252.119:0   1.0.77.208:0
[DoS attack: Teardrop or derivative] from 1.0.77.208, port 0   4   Sun Jan 03 22:09:06 2016   209.186.64.22:0   1.0.77.208:0
[DoS attack: Illegal Fragments] from 1.0.77.208, port 0   1   Sun Jan 03 22:09:06 2016   209.186.64.22:0   1.0.77.208:0
[DoS attack: Teardrop or derivative] from 1.0.77.208, port 0   6   Sun Jan 03 22:09:06 2016   209.186.64.22:0   1.0.77.208:0
[DoS attack: Ping Of Death] from 1.0.77.208, port 0   5   Sun Jan 03 22:09:02 2016   64.230.252.119:0   1.0.77.208:0
[DoS attack: Teardrop or derivative] from 1.0.77.208, port 0   1   Sun Jan 03 22:08:59 2016   64.230.252.119:0   1.0.77.208:0
[DoS attack: Illegal Fragments] from 1.0.77.208, port 0   1   Sun Jan 03 22:08:59 2016   64.230.252.119:0   1.0.77.208:0
[DoS attack: Ping Of Death] from 1.0.77.208, port 0   1   Sun Jan 03 22:08:59 2016   64.230.252.119:0   1.0.77.208:0
[DoS attack: Teardrop or derivative] from 1.0.77.208, port 0   3   Sun Jan 03 22:08:59 2016   64.230.252.119:0   1.0.77.208:0
[DoS attack: Ping Of Death] from 1.0.77.208, port 0   1   Sun Jan 03 22:08:57 2016   64.230.252.119:0   1.0.77.208:0
[DoS attack: Illegal Fragments] from 1.0.77.208, port 0   1   Sun Jan 03 22:08:57 2016   64.230.252.119:0   1.0.77.208:0
[DoS attack: Teardrop or derivative] from 1.0.77.208, port 0   1   Sun Jan 03 22:08:19 2016   64.230.252.119:0   1.0.77.208:0
[DoS attack: Ping Of Death] from 1.0.77.208, port 0   5   Sun Jan 03 22:08:19 2016   64.230.252.119:0   1.0.77.208:0
[DoS attack: Teardrop or derivative] from 1.0.77.208, port 0   1   Sun Jan 03 22:07:58 2016   209.186.64.22:0   1.0.77.208:0
[DoS attack: Teardrop or derivative] from 1.0.77.208, port 0   3   Sun Jan 03 22:07:55 2016   64.230.252.119:0   1.0.77.208:0
[DoS attack: Ping Of Death] from 1.0.77.208, port 0   4   Sun Jan 03 22:07:49 2016   64.230.252.119:0   1.0.77.208:0
[DoS attack: Ping Of Death] from 1.0.77.208, port 0   1   Sun Jan 03 22:07:40 2016   64.230.252.119:0   1.0.77.208:0
[DoS attack: Teardrop or derivative] from 1.0.77.208, port 0   1   Sun Jan 03 22:07:39 2016   64.230.252.119:0   1.0.77.208:0
[DoS attack: Ping Of Death] from 1.0.77.208, port 0   2   Sun Jan 03 22:07:33 2016   64.230.252.119:0   1.0.77.208:0
[DoS attack: Teardrop or derivative] from 1.0.77.208, port 0   4   Sun Jan 03 22:07:32 2016   64.230.252.119:0   1.0.77.208:0
[DoS attack: Ping Of Death] from 1.0.77.208, port 0   3   Sun Jan 03 22:07:25 2016   64.230.252.119:0   1.0.77.208:0
[DoS attack: Teardrop or derivative] from 1.0.77.208, port 0   1   Sun Jan 03 22:07:21 2016   64.230.252.119:0   1.0.77.208:0
[DoS attack: Ping Of Death] from 1.0.77.208, port 0   7   Sun Jan 03 22:07:19 2016   64.230.252.119:0   1.0.77.208:0
[DoS attack: Teardrop or derivative] from 1.0.77.208, port 0   3   Sun Jan 03 22:07:19 2016   64.230.252.119:0   1.0.77.208:0
[DoS attack: Illegal Fragments] from 1.0.77.208, port 0   1   Sun Jan 03 22:07:13 2016   64.230.252.119:0   1.0.77.208:0
[DoS attack: Ping Of Death] from 1.0.77.208, port 0   1   Sun Jan 03 22:07:03 2016   64.230.252.119:0   1.0.77.208:0
[DoS attack: Teardrop or derivative] from 1.0.77.208, port 0   3   Sun Jan 03 22:07:00 2016   64.230.252.119:0   1.0.77.208:0
[DoS attack: Ping Of Death] from 1.0.77.208, port 0   3   Sun Jan 03 22:06:34 2016   64.230.252.119:0   1.0.77.208:0
[DoS attack: Teardrop or derivative] from 1.0.77.208, port 0   1   Sun Jan 03 22:06:33 2016   64.230.252.119:0   1.0.77.208:0
[DoS attack: Ping Of Death] from 1.0.77.208, port 0   6   Sun Jan 03 22:06:32 2016   64.230.252.119:0   1.0.77.208:0
[DoS attack: Illegal Fragments] from 1.0.77.208, port 0   1   Sun Jan 03 22:06:27 2016   64.230.252.119:0   1.0.77.208:0
[DoS attack: Teardrop or derivative] from 1.0.77.208, port 0   1   Sun Jan 03 22:06:18 2016   64.230.252.119:0   1.0.77.208:0
[DoS attack: Ping Of Death] from 1.0.77.208, port 0   6   Sun Jan 03 22:06:14 2016   64.230.252.119:0   1.0.77.208:0
[DoS attack: Ping Of Death] from 1.0.77.208, port 0   10   Sun Jan 03 22:05:59 2016   64.230.252.119:0   1.0.77.208:0
[DoS attack: Ping Of Death] from 1.0.77.208, port 0   1   Sun Jan 03 22:03:23 2016   209.186.64.22:0   1.0.77.208:0
[DoS attack: Teardrop or derivative] from 1.0.77.208, port 0   2   Sun Jan 03 22:03:07 2016   209.186.64.22:0   1.0.77.208:0
[DoS attack: Illegal Fragments] from 1.0.77.208, port 0   1   Sun Jan 03 22:02:51 2016   209.186.64.22:0   1.0.77.208:0
[DoS attack: Teardrop or derivative] from 1.0.77.208, port 0   4   Sun Jan 03 22:02:51 2016   209.186.64.22:0   1.0.77.208:0
[DoS attack: Teardrop or derivative] from 1.0.77.208, port 0   16   Sun Jan 03 22:02:49 2016   209.186.64.22:0   1.0.77.208:0
[DoS attack: Teardrop or derivative] from 1.0.77.208, port 0   3   Sun Jan 03 22:02:49 2016   209.186.64.22:0   1.0.77.208:0
[DoS attack: Teardrop or derivative] from 1.0.77.208, port 0   6   Sun Jan 03 22:02:49 2016   209.186.64.22:0   1.0.77.208:0
[DoS attack: Illegal Fragments] from 1.0.77.208, port 0   2   Sun Jan 03 22:02:48 2016   209.186.64.22:0   1.0.77.208:0
[DoS attack: Teardrop or derivative] from 1.0.77.208, port 0   4   Sun Jan 03 22:02:47 2016   209.186.64.22:0   1.0.77.208:0

Babylon5 · ‎2016-01-04

Have you contacted your ISP about this? The logged messages don’t appear to be too frequent; the router can handle tens of thousands of packets per second, so I don’t think this is targeted at you specifically. Your ISP may be able to tell you if this is prevalent across their network and if so then I would expect then to take action against the source, if it is not prevalent then they may still take action, and/or they could allocate you a different Public IP address to see if the issue goes away. It is also possible that a PC on you LAN.

kev11n · ‎2016-01-04

I have been contacting them about this since Sept. when I got the service initally. They have sent 5-6 techs out and even ran a brand new line and all new coax through the house, and installed a new coax jack on the wall. I am done talking with them as they just keep telling me I need to reset my modem. They are complete idiots over at comcast. They told me I needed to contact Netgear in order to get my Public IP changed, which is just hilarious to me. These attacks happen very frequently, almost every hour, I couldnt post a bigger log due to a 20000 character limit on a post, and also the log can only show so much before it erases old and writes new.

Babylon5 · ‎2016-01-04

That’s a peculiar response to what clearly isn’t a hardware issue.

Netgear can’t change the Public IP address, that’s issued by the ISP equipment. For some cable services the Public IP address can be forced to change by changing the MAC address reported by the router to the modem, in your case you may be able change the C7000 Gateway MAC Address, but I’m not sure if you might then have to contact your ISP to have the new MAC address registered (which may be the MAC address of the computer – I can’t tell for sure reading the manual). At the end of the day, the Public IP address issued by your ISP is certainly not under Netgear control.

kev11n · ‎2016-01-04

I know its not, which is why I laughed in their face. I guess I'm just SOL.

Babylon5 · ‎2016-01-05

I’m sorry, if I could offer more practical advice I would, but what you are seeing in the log is what is arriving at the Internet port of the router, and is being blocked. The router has no way to stop that traffic arriving, that’s down to your ISP.

yurik · ‎2016-01-07

Hey kev11n,

I've been having a similar issue for the past week or so. Another piece of information which is odd, is that I can see the external (source) ip in my attached devices with my iPhone's MAC address. You should check to see if you are seeing the same behavior. Did you ever figure out what the issue is?