Reply

Re: R7000 Router report DDOS SMURF attack from R7000 AP's

bascaves
Apprentice

R7000 Router report DDOS SMURF attack from R7000 AP's

Hello Community,

 

I have 3 Netgear R7000's,  One as Router and two as Access Points. All 3 devices are set to send a weekly log report. The logs from the AP's are empty besides occassional login report. The one from the R7000, obvious reports more and this fine. However when I read the logs in noticed an odd log message. It reports almost daily that my R7000 AP's (192.168.1.2 and 192.168.1.3) are the source of a DDOS SMURF attack to my R7000 Router (192.168.1.10.  I left the message before and after to show nothing else reported at the sametime. 

 

[DHCP IP: (192.168.1.51)] to MAC address 6C:AD:F8:9F:57:19, Thursday, Jul 27,2017 16:47:53


[DoS attack: Smurf] attack packets in last 20 sec from ip [192.168.1.3], Thursday, Jul 27,2017 16:43:50
[DoS attack: Smurf] attack packets in last 20 sec from ip [192.168.1.2], Thursday, Jul 27,2017 16:43:48

 

[DHCP IP: (192.168.1.115)] to MAC address E0Smiley Very HappyB:10:05:56:C7, Thursday, Jul 27,2017 16:33:01
[DHCP IP: (192.168.1.108)] to MAC address 04:52:F3:78:3F:38, Thursday, Jul 27,2017 16:31:41

 

--

DHCP IP: (192.168.1.51)] to MAC address 6C:AD:F8:9F:57:19, Wednesday, Jul 26,2017 16:47:33
[DoS attack: Smurf] attack packets in last 20 sec from ip [192.168.1.3], Wednesday, Jul 26,2017 16:43:47
[DoS attack: Smurf] attack packets in last 20 sec from ip [192.168.1.2], Wednesday, Jul 26,2017 16:43:45
[Time synchronized with NTP server] Wednesday, Jul 26,2017 16:23:49

---

 

Really are the R7000 AP's attacking my R7000 Router?

I can't believe this, this sound bogus to me.

 

Software version on all R7000.

V1.0.9.6_1.2.19

 

BTW: I reported a lot of issues with earlier version of Netgear software. This version, still using very basic functions, seems the best version since a while.

 

Brgds,

 

Bas.

Model: R7000|Nighthawk AC1900 Dual Band WiFi Router
Message 1 of 3
SystemCrash
Guide

Re: R7000 Router report DDOS SMURF attack from R7000 AP's

Try factory resetting both AP's because your own devices attacking each other doesn't make sense.

Message 2 of 3
bascaves
Apprentice

Re: R7000 Router report DDOS SMURF attack from R7000 AP's

Hello Systemcrash,

Thank you for the reply. I do not believe my AP's do this, are hacked or whatever. I have more the impression this R7000 makes a bogus entry. BTW: I can't remember if this i.e. just came with the lastest software upgrade of a few weeks ago. I can only tell I noticed it now.

However, I can factory default of course the AP's later in the week and see if this makes a difference.

 

Brgds,


Bas.

Model: R7000|Nighthawk AC1900 Dual Band WiFi Router
Message 3 of 3
Top Contributors
Discussion stats
  • 2 replies
  • 2483 views
  • 0 kudos
  • 2 in conversation
Announcements