× Introducing the Orbi 970 Series Mesh System with WiFi 7 technology. For more information visit the NETGEAR Press Room.
Orbi WiFi 7 RBE973
Reply

Dos Attacks

grace0nfire
Aspirant

Dos Attacks

[DoS Attack: Land Attack] from source: 255.255.255.255, port 67, Saturday, September 12, 2015 15:58:56
[DoS Attack: Land Attack] from source: 255.255.255.255, port 67, Saturday, September 12, 2015 14:50:46
[DoS Attack: Land Attack] from source: 255.255.255.255, port 67, Saturday, September 12, 2015 13:40:32
[DoS Attack: Land Attack] from source: 255.255.255.255, port 67, Saturday, September 12, 2015 10:54:18
[DoS Attack: Land Attack] from source: 255.255.255.255, port 67, Saturday, September 12, 2015 10:31:24
[Time synchronized with NTP server] Saturday, September 12, 2015 10:20:49
[DoS Attack: Land Attack] from source: 255.255.255.255, port 67, Saturday, September 12, 2015 08:55:26
[DHCP IP: 192.168.1.3] to MAC address b4:79:a7:03:e2:3e, Saturday, September 12, 2015 08:48:07
[DoS Attack: Land Attack] from source: 255.255.255.255, port 67, Saturday, September 12, 2015 08:41:56
[DoS Attack: Land Attack] from source: 255.255.255.255, port 67, Saturday, September 12, 2015 07:32:48
[DoS Attack: Land Attack] from source: 255.255.255.255, port 67, Saturday, September 12, 2015 06:51:22

[DoS Attack: Land Attack] from source: 255.255.255.255, port 67, Saturday, September 12, 2015 06:08:33
[DoS Attack: Land Attack] from source: 255.255.255.255, port 67, Saturday, September 12, 2015 05:29:52
[DoS Attack: Land Attack] from source: 255.255.255.255, port 67, Saturday, September 12, 2015 03:38:12
[DoS Attack: Land Attack] from source: 255.255.255.255, port 67, Friday, September 11, 2015 23:41:12
[DoS Attack: TCP/UDP Chargen] from source: 74.82.47.5, port 59305, Friday, September 11, 2015 23:33:31
[DoS Attack: Land Attack] from source: 255.255.255.255, port 67, Friday, September 11, 2015 23:14:06
[DoS Attack: Land Attack] from source: 255.255.255.255, port 67, Friday, September 11, 2015 21:38:51

 

 

There are several more of these on my router log. Is this something to worry about? It has been going on for over a week. I just got a new computer. I've changed my IP address even. Still keeps showing up. I've run AVG scan and Anti-Malware scan. Nothing is showing up. PLUS, my internet has not been interrupted at all during these times. I've been playing games like league of legends, and afterward would log onto my router, and a dos attack with that same repeated IP address shows up. However, nothing happened. What is going on?

Message 1 of 8

Accepted Solutions
TheEther
Guru

Re: Dos Attacks

Ok.  Port 67, along with port 68, is used for DHCP.  It's a little strange for the router to be complaining about DHCP unless somehow it's detecting a large burst of DHCP Requests in a short period of time.

 

According to your logs, the timestamps between "attacks" are several minutes to several hours apart, so it doesn't seem to be happening all that frequently and is probably not a real DoS attack.  Perhaps you have an old device on your network that doesn't have a good DHCP Client implementation.  If you are not seeing any performance or network issues, then I wouldn't worry about it.

View solution in original post

Message 5 of 8

All Replies
TheEther
Guru

Re: Dos Attacks

Do you, by any chance, have Access Control enabled?  Someone else on this forum started seeing this DoS attacks logged after enabling Access Control.  We guessed that there is a bug with the DoS attack detection algorithm that is exposed whenever Access Control is enabled.

 

Access Control is easily bypassed, so it's nearly useless.  It's no substitute for a good, strong Wi-Fi password.  I recommend that you disable it.

Message 2 of 8
grace0nfire
Aspirant

Re: Dos Attacks

Thank you for your reply. I'm not sure if I have it enabled. Will have to figure out how to check and how to disable it.
Message 3 of 8
grace0nfire
Aspirant

Re: Dos Attacks

No I do not have access control on. 

Message 4 of 8
TheEther
Guru

Re: Dos Attacks

Ok.  Port 67, along with port 68, is used for DHCP.  It's a little strange for the router to be complaining about DHCP unless somehow it's detecting a large burst of DHCP Requests in a short period of time.

 

According to your logs, the timestamps between "attacks" are several minutes to several hours apart, so it doesn't seem to be happening all that frequently and is probably not a real DoS attack.  Perhaps you have an old device on your network that doesn't have a good DHCP Client implementation.  If you are not seeing any performance or network issues, then I wouldn't worry about it.

Message 5 of 8
grace0nfire
Aspirant

Re: Dos Attacks

Okay. Thank you so much for replying. That really helped me!

Message 6 of 8
Pockets
Aspirant

Re: Dos Attacks

Land Attack source 255.255.255.255 is caused by fragmented/ lost  packets and not an actual attack via another computer. Im having the same issue , even going into the security section of the router keywords or closing the port 67 has no effect. I have not found any way to stop or find out more about this issue. I suspect it is a dns server problem provided by my ISP which is Charter Communications.

Message 7 of 8
grace0nfire
Aspirant

Re: Dos Attacks

I have Charter communications as well. Maybe it is with ISP.
Message 8 of 8
Discussion stats
  • 7 replies
  • 18158 views
  • 0 kudos
  • 3 in conversation
Announcements

Orbi WiFi 7