Orbi WiFi 7 RBE973
Reply

mr60 DOS ATTACK ACK SCAN

SRAS23
Follower

mr60 DOS ATTACK ACK SCAN

My ISP is Xfinity and I haven't had problems with them since moving in 3 years ago. 3/21 I purchased an MR60 + 1 satellite device to utilize the mesh network feature. Conveniently, the tech support expired 6/21 for the product, so thank you Netgear for never earning my money again.

 

The last couple weeks I've been getting disconnects from internet here and there, it originally wasn't that often or that long and I assumed it was Xfinity naturally as I have a great modem and router. In the last two days it has gotten to the point of having no internet for the majority of the days.

 

Getting into the system logs I noticed there were several "DoS Attack ACK Scan" events listed. After quick research this has led me to realize Netgear sucks and has had a regular problem with false events like such on their devices. I visit Amazon and get:

 

[DoS attack: Fraggle Attack] from source 96.120.103.145,port 67 Monday, Jul 26,2021 11:09:33
[DoS attack: ACK Scan] from source 142.251.33.99,port 443 Monday, Jul 26,2021 11:08:47

 

This completely stops my internet on both wired and wireless devices for significant stretches of time before maybe starting to work again. I found if I bypassed the router and plugged my computer in from the modem, I had internet again. 

 

I'm rusty on all this tech stuff and don't know what else to do besides I manually updated the Firmware version to V1.0.6.112 since then I have spoken with Xfinity and they did their thing and it's working for the moment but I'm still getting more

 

[DoS attack: Fraggle Attack] from source 96.120.103.145,port 67 Monday, Jul 26,2021 11:33:41
[DoS attack: ACK Scan] from source 23.210.16.148,port 80 Monday, Jul 26,2021 11:28:28

 

Where do I even go from here?

Message 1 of 2

Re: mr60 DOS ATTACK ACK SCAN


@SRAS23 wrote:

Getting into the system logs I noticed there were several "DoS Attack ACK Scan" events listed. After quick research this has led me to realize Netgear sucks and has had a regular problem with false events like such on their devices. I visit Amazon and get:

 

[DoS attack: Fraggle Attack] from source 96.120.103.145,port 67 Monday, Jul 26,2021 11:09:33
[DoS attack: ACK Scan] from source 142.251.33.99,port 443 Monday, Jul 26,2021 11:08:47

 


I am not familiar with the MR60 – this is the wrong place to talk about it – but I am familiar with those messages.

 

Netgear's firmware is great at creating false reports of DoS attacks. Many of them are no such thing.

 

Search - NETGEAR Communities – DoS attacks

 

Use Whois.net to see who is behind some of them and you may find that they are from places like Facebook, Google, even your ISP.

 

Here is a useful tool for that task:

 

IPNetInfo: Retrieve IP Address Information from WHOIS servers

 

If these events are slowing down your router, that may be because it is using up processor time as it writes the events to your logs. Anything that uses processor power – event logging, QoS management, traffic metering – may cause slowdowns. Disable logging of DoS attacks and see if that reduces the problem. This does not prevent the router from protecting you from the outside world.

 

You have posted your message in the section of this community given over to Nighthawk WiFi Routers. (This is easily done, given Netgear's complicated community structure.)

Many questions apply to different types of device, so there may be useful responses here, but you might get more help, and find earlier questions and answers specific to your device, in the appropriate section for your hardware. That's probably here:

Nighthawk Mesh System - NETGEAR Communities

I will ask the Netgear moderator to move your message.

 

 

Message 2 of 2
Top Contributors
Discussion stats
  • 1 reply
  • 704 views
  • 0 kudos
  • 2 in conversation
Announcements

Orbi WiFi 7