Netgear Router D7800 - DDos Attacks - (yes another person asks for help)

[TrickyWoo]

Hello to all,

Having bought the D7800 at the end of March 2016, the aim was to replace a TP Link modem router and even further back a BT Home Hub 5.

Ever siince installation date I have been getting service drops and then disconnection/reconnections.

I thought it best to try opening the router settings and check what was happening. I discovered numerous DDoS attacks which included ACK SCANS, ICMP SCANS, RST SCANS and TCP/UDP Chargen scans to mention but a few, which are collectively pulling down our connection. See below:

[admin login] from source 192.168.1.114, Saturday, April 30, 2016 09:19:43
[DoS Attack: ICMP Scan] from source: 122.116.128.220, Saturday, April 30, 2016 09:17:18
[DoS Attack: ACK Scan] from source: 122.116.128.220, port 54698, Saturday, April 30, 2016 09:17:07
[DoS Attack: ACK Scan] from source: 122.116.128.220, port 54697, Saturday, April 30, 2016 09:17:06
[admin login] from source 192.168.1.114, Saturday, April 30, 2016 09:06:19
[DoS Attack: TCP/UDP Chargen] from source: 74.82.47.21, port 46913, Saturday, April 30, 2016 09:05:23
[admin login] from source 192.168.1.114, Saturday, April 30, 2016 08:53:23
[DoS Attack: ICMP Scan] from source: 93.67.167.39, Saturday, April 30, 2016 08:47:22
[admin login] from source 192.168.1.114, Saturday, April 30, 2016 08:38:56
[DHCP IP: 192.168.1.114] to MAC address 34:17:eb:a8:f0:43, Saturday, April 30, 2016 08:36:40
[DoS Attack: ACK Scan] from source: 95.100.245.84, port 80, Saturday, April 30, 2016 08:30:01
[DoS Attack: RST Scan] from source: 108.160.172.237, port 443, Saturday, April 30, 2016 08:15:31
[UPnP set event: del_nat_rule] from source 192.168.1.4, Saturday, April 30, 2016 08:09:05
[DoS Attack: ACK Scan] from source: 69.163.208.186, port 80, Saturday, April 30, 2016 08:05:10
[UPnP set event: add_nat_rule] from source 192.168.1.4, Saturday, April 30, 2016 07:59:30
[DHCP IP: 192.168.1.6] to MAC address 74:81:14:23:6f:9d, Saturday, April 30, 2016 07:49:46
[DHCP IP: 192.168.1.6] to MAC address 74:81:14:23:6f:9d, Saturday, April 30, 2016 07:49:23
[DHCP IP: 192.168.1.8] to MAC address f0:25:b7:6a:ad:c4, Saturday, April 30, 2016 07:49:09
[DoS Attack: ICMP Scan] from source: 78.227.120.101, Saturday, April 30, 2016 07:46:51
[DoS Attack: ACK Scan] from source: 78.227.120.101, port 59507, Saturday, April 30, 2016 07:46:46
[DoS Attack: ACK Scan] from source: 78.227.120.101, port 59506, Saturday, April 30, 2016 07:46:46
[admin login] from source 192.168.1.2, Saturday, April 30, 2016 07:43:11
[DHCP IP: 192.168.1.7] to MAC address 00:26:4a:c6:29:e7, Saturday, April 30, 2016 07:41:25
[DHCP IP: 192.168.1.5] to MAC address a8:5b:78:80:75:14, Saturday, April 30, 2016 07:40:44
[DHCP IP: 192.168.1.4] to MAC address 2c:1f:23:6a:29:c7, Saturday, April 30, 2016 07:40:32
[DHCP IP: 192.168.1.3] to MAC address 1c:a5:32:2b:2d:de, Saturday, April 30, 2016 07:40:28
[Time synchronized with NTP server] Saturday, April 30, 2016 07:40:17
[DHCP IP: 192.168.1.8] to MAC address f0:25:b7:6a:ad:c4, Saturday, April 30, 2016 07:40:15
[Internet connected] IP address: 86.171.65.194, Saturday, April 30, 2016 07:40:10
[DHCP IP: 192.168.1.2] to MAC address 74:81:14:23:6f:9d, Saturday, April 30, 2016 07:39:52
[Initialized, firmware version: V1.0.0.46] Saturday, April 30, 2016 07:39:03

I have tried calling support based around their 90 days of service following the date of purchase and the first time I got through to 'Lance' he recommended a re-install of firmware V1.0.0.46, which was already in place and resetting to factory default settings.

I did all this whilst on the phone with support and then he recommended changing our dynamic IP address to a static one as well as both primary and secondary DNS settings to static numbers. After doing this, we had no internet connect which i think is due to BT (our ISP) not allowing us to use Static IP addresses or Static DNS numbers so we had to reset all these back to 'Obtain Dynamic from ISP' in the settings.

Our case is still open and I am waiting for more professional advice from a dedicated Netgear representative via email or telephone call 30/04/16

In the meantime please can I ask for advice about sorting this out as I do not want to disable tthe 'Known Dos attacks and Port Scans' feature under Advanced Set Up - as this is not recommended from reading previous articles on the community. Are DDoS attacks just normal traffic trying to come back in or something more sinister e.g. trojan, malware, phishing etc.

If anyone can please please offer advice about what to change in the router settings or anything else what so ever (besides returning the defective router to Amazon) then I would very much like to here from you as our old TP Link did not seem to have this many issues and the D7800 is supposed to be an Upgrade!!!!

Thanks Rich 

[TrickyWoo]

PS - I have not got 'Respond to Ping on Internet Port' checked in WAN settings and we have dynamic IP address set up by our ISP which change each time the router is rebooted but attacks usually restart again within 20 mins

[Martenf]

I have been through all this. Since updating to the D7800, I have had continuous issues with supposed DOS attacks.

The D7800 is flagging legitimate connections as DOS attacks. These include IMAP connections, DropBox, iCloud, MS OneDrive etc. It got to the point where my connection was so flakey from being blocked that it was driving me mad.

Since purchasing the D7800 on 13 April, I have had over 12,000 DOS entries and yesterday 497 in just over 2 hours. None of them were legitimate DOS attacks. I had upgraded from the D6300 which also had spurious DOS attacks but no where near what the D7800 is doing.

I took the decision to stop DOS protection and rely on the computer's firewall and other measures. Now I am able to send and receive emails and I do not have the constant blocking of connections for my services.

I think that Netgear needs to get into gear and resolve this issue. I had logged a call but that did not amount to anything other than they will look into it.