× Introducing the Orbi 970 Series Mesh System with WiFi 7 technology. For more information visit the NETGEAR Press Room.
Orbi WiFi 7 RBE973
Reply

DoS attack: FIN Scan from Microsoft

CDKoger
Guide

DoS attack: FIN Scan from Microsoft

Since a few weeks we have a new satellite dish operational, providing fast internet thru the 
Astra -3 satellite. I had hoped the 8-fold increase of bandwidth would solve the old problem
of a netgear router not receiving date/time signals, but NO, it is still Jan 01, 2003.

What is new and utterly annoying is a relentless attack from a Microsoft server in Singapore.
I reported the abuse and asked for an explanation but received only an automatic response.
Not only do I have to pay for every byte they send me, but as you can see it also disrupts
normal operation.
Is there anything I can do to stop this?


There are now 19 log files in my inbox containing only lines like this:

[DoS attack: FIN Scan] attack packets in last 20 sec from ip [111.221.77.151], Wednesday, [email failed] internet connection is dropped, Wednesday, Jan 01,2003 13:11:27 [DoS attack: FIN Scan] attack packets in last 20 sec from ip [111.221.77.151], Wednesday, [email failed] internet connection is dropped, Wednesday, Jan 01,2003 13:11:05 [DoS attack: FIN Scan] attack packets in last 20 sec from ip [111.221.77.151], Wednesday, [email failed] internet connection is dropped, Wednesday, Jan 01,2003 13:10:43 [DoS attack: FIN Scan] attack packets in last 20 sec from ip [111.221.77.151], Wednesday, [email failed] internet connection is dropped, Wednesday, Jan 01,2003 13:10:22 [DoS attack: FIN Scan] attack packets in last 20 sec from ip [111.221.77.151], Wednesday, [email failed] internet connection is dropped, Wednesday, Jan 01,2003 13:10:00 [DoS attack: FIN Scan] attack packets in last 20 sec from ip [111.221.77.151], Wednesday, [email failed] internet connection is dropped, Wednesday, Jan 01,2003 13:09:40
Model: WNDR3400v2|N600 Wireless Dual Band Router
Message 1 of 6

Accepted Solutions
CDKoger
Guide

Re: DoS attack: FIN Scan from Microsoft

Wrote a complaint to cert@microsoft.com.

No reply, but the attack has ceased.

View solution in original post

Message 6 of 6

All Replies
Retired_Member
Not applicable

Re: DoS attack: FIN Scan from Microsoft

contact ISP and have them change you IP.

 

Do you play games, X Box?

Message 2 of 6
CDKoger
Guide

Re: DoS attack: FIN Scan from Microsoft

This is just a high speed satellite link we've hired from SES/Astra in Luxembourg. No helpdesk, no other services than providing an operational link to a fixed IP address.

We use it for mail and normal internet traffic only. This is a remote area.

Message 3 of 6
Retired_Member
Not applicable

Re: DoS attack: FIN Scan from Microsoft

bypass router and connect directly to link modem, see if public IP changes, if yes reconnect router and use PC MAC in router setup, if no change get use to it or find another vendor. 

Message 4 of 6
CDKoger
Guide

Re: DoS attack: FIN Scan from Microsoft

The IP address is assigned to the (hardwired) modem number, even with the router powered down at night I can see the the RX LED blink on the modem. I will switch off the whole hardware to check if the behaviour changes.

I guess I'm screwed!

Message 5 of 6
CDKoger
Guide

Re: DoS attack: FIN Scan from Microsoft

Wrote a complaint to cert@microsoft.com.

No reply, but the attack has ceased.

Message 6 of 6
Top Contributors
Discussion stats
  • 5 replies
  • 13442 views
  • 2 kudos
  • 2 in conversation
Announcements

Orbi WiFi 7