×

Introducing the Orbi 970 Series Mesh System with WiFi 7(BE) technology. For more information visit the NETGEAR Press Room.

Nighthawk Mesh WiFi

Welcome to the Nighthawk Mesh Community


Advanced Whole Home WiFi Click to Buy Nighthawk Mesh WiFi 6
Reply

MR60 Denial of Service Attacks

MSBassSinger
Aspirant

MR60 Denial of Service Attacks

The past few weeks, I have been getting a lot of DOS attacks, some bad enough that the MR60 goes offline for a minute or so, then returns.  I have a Netgear GS108v4 switch wired into the MR60 ethernet port.  Even the hard-wired ethernet port goes offline during the minute or two involved.
 
Typical log entries:
[Internet connected] IP address: 73.106.184.30, Thursday, Jan 26,2023 12:14:40
[DHCP IP: (192.168.1.18)] to MAC address 9C:76:13:15:2B:8F, Thursday, Jan 26,2023 12:14:36
[DHCP IP: (192.168.1.19)] to MAC address 9C:76:13:15:2B:D1, Thursday, Jan 26,2023 12:14:35
[DHCP IP: (192.168.1.9)] to MAC address 34:3E:A4:85:0C:C2, Thursday, Jan 26,2023 12:14:35
[DHCP IP: (192.168.1.25)] to MAC address 54:3A:D6:C0:B6:51, Thursday, Jan 26,2023 12:14:25
[Internet disconnected] Thursday, Jan 26,2023 12:14:25
[DoS attack: Fraggle Attack] from source 96.120.5.125,port 67 Thursday, Jan 26,2023 12:14:23


My MR60 and satellites' firmware is up to date.

My network is setup thus:

Comcast Cable Internet (1.2 gbps download)  <--> Motorola "modem" <--> MR-60 <--> Wireless Network

                                                                                                                           |

                                                                                                                           + <--> Netgear switch


Does anyone have an idea on how to handle this so my system does not go offline?

Thanks

Message 1 of 8
microchip8
Master

Re: MR60 Denial of Service Attacks

False positives.

NETGEAR's firmware is known for creating many false positives. This puts a strain on the CPU. As you can see in your log, there are even "attacks" from your local deices (192.168.x.x IP addresses).

I'd disable DoS protection completely and see if the issues goes away. You're not missing much since most are, as I mentioned, false positives.
Message 2 of 8
MSBassSinger
Aspirant

Re: MR60 Denial of Service Attacks

The MR60 has no DoS protection, at least nothing tha is settable via the web or app interface.

Message 3 of 8
FURRYe38
Guru

Re: MR60 Denial of Service Attacks

The [DoS attack: Fraggle Attack] is just the logs and MR reporting that it is blocking something. Typical entry if these are detected. 

The [DHCP IP: (192.168.1.18)] are typical log entries that the MR is reporting for newly connected devices and getting a IP address from the MR. This is not a attack. 

 

You can do a whois lookup on those WAN side IP addresses to see where they come from:

96.120.5.125

 

It's recommended to edit out MAC addresses and product serial numbers before posting in public forums for security reasons. 

Message 4 of 8
MSBassSinger
Aspirant

Re: MR60 Denial of Service Attacks

I can understand false positives.  Why would the router go offline (amber light) then come back online?  Is that preventable?

Message 5 of 8
FURRYe38
Guru

Re: MR60 Denial of Service Attacks

What Firmware version is currently loaded?
What is the Mfr and model# of the Internet Service Providers modem/ONT the NG router is connected too?
Be sure your using a good quality LAN cable between the modem and router. CAT6 is recommended. 

 

Whats the user manual say for LED behaviors on the MR? 

 

Message 6 of 8
MSBassSinger
Aspirant

Re: MR60 Denial of Service Attacks

The IP is registered to Comcast, my ISP. 🙂

Message 7 of 8
FURRYe38
Guru

Re: MR60 Denial of Service Attacks

What Firmware version is currently loaded?
What is the Mfr and model# of the Internet Service Providers modem/ONT the NG router is connected too?
Be sure your using a good quality LAN cable between the modem and router. CAT6 is recommended. 

 

What's the user manual say for LED behaviors on the MR? 

 

Message 8 of 8
Top Contributors
Discussion stats
  • 7 replies
  • 1170 views
  • 2 kudos
  • 3 in conversation
Announcements

Orbi WiFi 7