DoS Attacks for a week on C6300

[Sewbie]

I'm not too sure what to do here, i've got a vpn but they keep coming. Its targeting my ff02:0000:0000:0000:0000:0000:0000:0001 domain from a fe80:0000:0000:0000:0201:5cff:fe24:18c1  What exactly is going on here? I use a dynamic ip and even though my IP has changed im still getting these dos attacks.

Anyone know what i can do here?

[TheEther]

ff02:0000:0000:0000:0000:0000:0000:0001 is the all-nodes, link-local IPv6 multicast address.  Every IPv6 device on the link will be forced to process packets sent to that address.  The C6300 is probably treating excessive traffic to that address as a DoS attack.

fe80:0000:0000:0000:0201:5cff:fe24:18c1 is a link-local IPv6 address.  In other words, it belongs to a directly connected device.  It's like one of those horror movies where the victim learns that the killer is making phone calls from within the house!  

[Sewbie]

So whats the solution? I'm still dealing with slow speeds and complete disconection from some online games at times. And the things connected to my router are my TV/comp, 2 phones and 1 tablet on wifi.

[TheEther]

Find out who is using the fe80 address. The MAC address will be 02:01:5c:24:18:c1. Then figure out why it's spewing those packets.

Or you can simply turn off IPv6 on your C6300.

[Sewbie]

None of my devices has that mac adress 😕 also 

Ive had ipv6 disabled for a while now 

[TheEther]

Is IPv6 disabled on the C6300?

Do you have any other devices that could be running IPv6? Smartphone? DVR? Streaming device (Chromecast, Roku, AppleTV, etc.)?

[Sewbie]

Only thing i can think of is my moms tablet. Its not showing up on my network map 

[Sewbie]

Oh, since i saw these "attacks" i purchased a VPN if that matters

[TheEther]

Where is the VPN terminating on your end?  If it's on that PC with IPv6 already disabled, then the VPN shouldn't be a factor.  

Still, you could try disabling the VPN and see if that makes any difference.

[Sewbie]

Yeah that didn't do anything. These attacks are still coming and none of my gear has the mac adress thats attacking. Wifi disabled and they still come.

[TheEther]

I'm out of ideas.  I did find a few threads on the Internet, including this one with the same problem.  Even the recommendation is the same, disable IPv6.  Unfortunately, there doesn't seem to be any way to do that on the C6300.  There is speculation that the C6300's DoS attack detection algorithm is a little too paranoid.  If your Internet service is not otherwise acting up (i.e. speeds are good), then perhaps you can ignore the logs.