Reply

Re: "DoS attack: Fraggle Attack" almost every 10 seconds

firefox111
Guide

"DoS attack: Fraggle Attack" almost every 10 seconds

Hello.  I replaced an aging gateway firewall/router/gateway lately and my Nighthawk X6S has plenty of this Fraggle Attack in its Log.   Does anyone know what is this? What port/s does this pertain to?  I have to identify this so I can report to the support for my new firewall/router/gateway.   Below is a capture of what's in the Log.  Thanks in advance.

 

[DoS attack: Fraggle Attack] from source 192.168.5.1,port 34437 Monday, Sep 13,2021 19:35:50
[DoS attack: Fraggle Attack] from source 192.168.5.1,port 34437 Monday, Sep 13,2021 19:35:40
[DoS attack: Fraggle Attack] from source 192.168.5.1,port 34437 Monday, Sep 13,2021 19:35:29
[DoS attack: Fraggle Attack] from source 192.168.5.1,port 34437 Monday, Sep 13,2021 19:35:19
[DoS attack: Fraggle Attack] from source 192.168.5.1,port 34437 Monday, Sep 13,2021 19:35:09
[DoS attack: Fraggle Attack] from source 192.168.5.1,port 34437 Monday, Sep 13,2021 19:34:59
[DoS attack: Fraggle Attack] from source 192.168.5.1,port 34437 Monday, Sep 13,2021 19:34:49
[DoS attack: Fraggle Attack] from source 192.168.5.1,port 34437 Monday, Sep 13,2021 19:34:39
[DoS attack: Fraggle Attack] from source 192.168.5.1,port 34437 Monday, Sep 13,2021 19:34:29
[DoS attack: Fraggle Attack] from source 192.168.5.1,port 36992 Monday, Sep 13,2021 19:34:18
[DoS attack: Fraggle Attack] from source 192.168.5.1,port 36992 Monday, Sep 13,2021 19:34:08
[DoS attack: Fraggle Attack] from source 192.168.5.1,port 36992 Monday, Sep 13,2021 19:33:58
[DoS attack: Fraggle Attack] from source 192.168.5.1,port 36992 Monday, Sep 13,2021 19:33:48
[DoS attack: Fraggle Attack] from source 192.168.5.1,port 36992 Monday, Sep 13,2021 19:33:38
[DoS attack: Fraggle Attack] from source 192.168.5.1,port 36992 Monday, Sep 13,2021 19:33:28
[DoS attack: Fraggle Attack] from source 192.168.5.1,port 36992 Monday, Sep 13,2021 19:33:17
[DoS attack: Fraggle Attack] from source 192.168.5.1,port 36992 Monday, Sep 13,2021 19:33:07
[DoS attack: Fraggle Attack] from source 192.168.5.1,port 36992 Monday, Sep 13,2021 19:32:57
[DoS attack: Fraggle Attack] from source 192.168.5.1,port 36992 Monday, Sep 13,2021 19:32:47
[DoS attack: Fraggle Attack] from source 192.168.5.1,port 36992 Monday, Sep 13,2021 19:32:37
[DoS attack: Fraggle Attack] from source 192.168.5.1,port 36992 Monday, Sep 13,2021 19:32:27
[DoS attack: Fraggle Attack] from source 192.168.5.1,port 36992 Monday, Sep 13,2021 19:32:16
[DoS attack: Fraggle Attack] from source 192.168.5.1,port 36992 Monday, Sep 13,2021 19:32:06
[DoS attack: Fraggle Attack] from source 192.168.5.1,port 36992 Monday, Sep 13,2021 19:31:56
[DoS attack: Fraggle Attack] from source 192.168.5.1,port 36992 Monday, Sep 13,2021 19:31:46
[DoS attack: Fraggle Attack] from source 192.168.5.1,port 36992 Monday, Sep 13,2021 19:31:36
[DoS attack: Fraggle Attack] from source 192.168.5.1,port 36992 Monday, Sep 13,2021 19:31:26
[DoS attack: Fraggle Attack] from source 192.168.5.1,port 36992 Monday, Sep 13,2021 19:31:16
[DoS attack: Fraggle Attack] from source 192.168.5.1,port 36992 Monday, Sep 13,2021 19:31:05
[DoS attack: Fraggle Attack] from source 192.168.5.1,port 36992 Monday, Sep 13,2021 19:30:55
[DoS attack: Fraggle Attack] from source 192.168.5.1,port 36992 Monday, Sep 13,2021 19:30:45
[DoS attack: Fraggle Attack] from source 192.168.5.1,port 36992 Monday, Sep 13,2021 19:30:35
[DoS attack: Fraggle Attack] from source 192.168.5.1,port 36992 Monday, Sep 13,2021 19:30:25
[DoS attack: Fraggle Attack] from source 192.168.5.1,port 48135 Monday, Sep 13,2021 19:30:15
[DoS attack: Fraggle Attack] from source 192.168.5.1,port 48135 Monday, Sep 13,2021 19:30:04
[DoS attack: Fraggle Attack] from source 192.168.5.1,port 48135 Monday, Sep 13,2021 19:29:54
[DoS attack: Fraggle Attack] from source 192.168.5.1,port 48135 Monday, Sep 13,2021 19:29:44
[DoS attack: Fraggle Attack] from source 192.168.5.1,port 48135 Monday, Sep 13,2021 19:29:34
[DoS attack: Fraggle Attack] from source 192.168.5.1,port 48135 Monday, Sep 13,2021 19:29:24
[DoS attack: Fraggle Attack] from source 192.168.5.1,port 48135 Monday, Sep 13,2021 19:29:14
[DoS attack: Fraggle Attack] from source 192.168.5.1,port 48135 Monday, Sep 13,2021 19:29:04
[DoS attack: Fraggle Attack] from source 192.168.5.1,port 48135 Monday, Sep 13,2021 19:28:53
[DoS attack: Fraggle Attack] from source 192.168.5.1,port 48135 Monday, Sep 13,2021 19:28:43
[DoS attack: Fraggle Attack] from source 192.168.5.1,port 48135 Monday, Sep 13,2021 19:28:33
[DoS attack: Fraggle Attack] from source 192.168.5.1,port 48135 Monday, Sep 13,2021 19:28:23
[DoS attack: Fraggle Attack] from source 192.168.5.1,port 48135 Monday, Sep 13,2021 19:28:13
[DoS attack: Fraggle Attack] from source 192.168.5.1,port 48135 Monday, Sep 13,2021 19:28:03
[DoS attack: Fraggle Attack] from source 192.168.5.1,port 48135 Monday, Sep 13,2021 19:27:52
[DoS attack: Fraggle Attack] from source 192.168.5.1,port 48135 Monday, Sep 13,2021 19:27:42
[DoS attack: Fraggle Attack] from source 192.168.5.1,port 48135 Monday, Sep 13,2021 19:27:32
[DoS attack: Fraggle Attack] from source 192.168.5.1,port 48135 Monday, Sep 13,2021 19:27:22

Model: R8000P|Nighthawk X6S AC4000 Tri Band WiFi Router
Message 1 of 22
robatl
Star

Re: "DoS attack: Fraggle Attack" almost every 10 seconds

It seems to be a netgear or nighthawk issue, so much so that if you google the attack it leads to netgear posts. Most people turn off that alert in their logs from what I found. Turn the alert on if you feel you are under attack, other than that turn it off. It's logging not a feature, your firewall will still work.

Message 2 of 22
robatl
Star

Re: "DoS attack: Fraggle Attack" almost every 10 seconds

You can try opening a case to report it, but it's hard to report bugs with netgear. Support doesn't seem to understand reporting bugs, it's not in their script.

Message 3 of 22
firefox111
Guide

Re: "DoS attack: Fraggle Attack" almost every 10 seconds

But the log is reporting that it comes from my firewall/router/gateway! Throughput seems to be unaffected by this Fraggle Attack!

Message 4 of 22
firefox111
Guide

Re: "DoS attack: Fraggle Attack" almost every 10 seconds

My log is now free of Fraggle Attack entries. I disabled DoS attack reporting in the Log.

Message 5 of 22

Re: "DoS attack: Fraggle Attack" almost every 10 seconds


@firefox111 wrote:

My log is now free of Fraggle Attack entries. I disabled DoS attack reporting in the Log.


Someone here recently told me I was mad for suggesting that.

 

Netgear's firmware is great at creating false reports of DoS attacks. Many of them are no such thing.

 

Search - NETGEAR Communities – DoS attacks

 

If these events are slowing down a router, that may be because it is using up processor time as it writes the events to the logs. Anything that uses processor power – event logging, QoS management, traffic metering – may cause slowdowns. Whenever people see a log full of that sort of stuff, it is worth disabling logging of DoS attacks and seeing if that reduces the problem. This does not prevent the router from protecting you from the outside world. It just doesn't write the details to the logs.

 

Some people go so far as to Disable Port Scan and DoS Protection to no ill effect.

 

Just another user.

My network DM200 -> R7800 -> GS316 -> PL1000 -> Orbi RBR40 -> Orbi RBS50Y -> RBS40V
Message 6 of 22
firefox111
Guide

Re: "DoS attack: Fraggle Attack" almost every 10 seconds

Even if I disable the reporting of the DoS attacks on the Log, it is still obvious that it is still being recorded. The reason I say this is when I re-enable the DoS attack, old entries pop up on the display!  It is obviously eating processor time writing those events in the log.

 

The Nighthawk X6S processor is damn slow!

 

 I think I'm ready to replace it.

Message 7 of 22
FURRYe38
Guru

Re: "DoS attack: Fraggle Attack" almost every 10 seconds

What Firmware version is currently loaded?
What is the Mfr and model# of the Internet Service Providers modem/ONT the NG router is connected too?

 

How do you have the routers IP configuration set up for? 192.168.5.1? 

What devices on your net work is using 192.168.5.1? 


@firefox111 wrote:

Even if I disable the reporting of the DoS attacks on the Log, it is still obvious that it is still being recorded. The reason I say this is when I re-enable the DoS attack, old entries pop up on the display!  It is obviously eating processor time writing those events in the log.

 

The Nighthawk X6S processor is damn slow!

 

 I think I'm ready to replace it.


 

 

My Setup ISP SparkLight | Internet Cable 1000↓/50↑ CM2000 Modem | Wifi Router RAXE50 and R8500(v.158) Router Mode | Switches NG GS105/8 | 

Additional NG HW: C7800/CAX80/CM1100/CM1200/CM2000, Orbi: CBK40, CBK752, RBK50, RBK853, RBK752, RBK953, SXK30 | NightHawk: R7000, R7800, R7960P, R8000, R8500, RAXE500, RAX50, XR450, EX7500/EX7700, GS308v3

Message 8 of 22
robatl
Star

Re: "DoS attack: Fraggle Attack" almost every 10 seconds

I was concerned about that, I ran several tests and did not see a performance hit. I don't think it's using much processing since there are attacks for it to block. I'm pretty sure it's a coding issue reacting to something. If you find a better product do tell.... Cisco stopped support their usb modem backup feature, I switched to this one. 

Message 9 of 22
firefox111
Guide

Re: "DoS attack: Fraggle Attack" almost every 10 seconds


@FURRYe38 wrote:

What Firmware version is currently loaded?
What is the Mfr and model# of the Internet Service Providers modem/ONT the NG router is connected too?

 

How do you have the routers IP configuration set up for? 192.168.5.1? 

What devices on your net work is using 192.168.5.1? 

Here's my infrastructure: Cable Internet going into a router/firewall/gateway with LAN subnet of 192.168.5.0/24. The R8000S WAN port is connected to that LAN on the gateway IP of 192.168.5.1.  I have port forwarding set up in the router/firewall/gateway to forward to the R8000S for dozen cameras, a file server, a PC which powers up on demand using WOL when I'm away.  Yes, the R8000S is also setup with port forwarding to forward traffic to specific cameras. Oh, one more thing that I just did today - I disabled the Port Scan and DoS Protection in the R8000S since I already have a firewall on its WAN side.

Message 10 of 22
firefox111
Guide

Re: "DoS attack: Fraggle Attack" almost every 10 seconds

Correction: I was refering to my Nighthawk X6S as "R8000S" - it should be R8000P.

 

Anyway, I forgot to mention that this R8000P is going crazy with all the devices connected to it.  This afternoon, I went to Security->Access Control and it displayed all devices as Connection Type of "Wired(wired)" even though most of the connected devices are on WiFi!  I had to reboot it quick.

 

Yes, I think it is time to replace it.  I'm researching on which one (which brand) to go with.  There are AX WiFi 6 routers out there which advertise with quad core Intel processor.  That would be awesome.

 

I just received my Netgear CM1000 cable modem today.  I have to replace my CM600 because I just upgraded my cable Internet to 1Gig.  The CM600 can only push 650+.  I'm hoping that with the CM1000, I will get around 950. We'll see.

Message 11 of 22
FURRYe38
Guru

Re: "DoS attack: Fraggle Attack" almost every 10 seconds

The Cm1000 is well capable of near 900Mpbs. You'll not see much over 900mpbs since WAN and LAN ports are only 1000Mpbs on the modem and the router. 

 

So what happens if you factory reset the router and use default IP address settings of 192.168.1.1 for the router. Does the fragle attack still happen? 

 

My Setup ISP SparkLight | Internet Cable 1000↓/50↑ CM2000 Modem | Wifi Router RAXE50 and R8500(v.158) Router Mode | Switches NG GS105/8 | 

Additional NG HW: C7800/CAX80/CM1100/CM1200/CM2000, Orbi: CBK40, CBK752, RBK50, RBK853, RBK752, RBK953, SXK30 | NightHawk: R7000, R7800, R7960P, R8000, R8500, RAXE500, RAX50, XR450, EX7500/EX7700, GS308v3

Message 12 of 22
firefox111
Guide

Re: "DoS attack: Fraggle Attack" almost every 10 seconds

I called my cable Internet provider to swap out the modem.  I'm happy to report that the highest I got was 930 Mbps.

 

2021-09-14 Gig Speed Test.jpg

Message 13 of 22
firefox111
Guide

Re: "DoS attack: Fraggle Attack" almost every 10 seconds


@FURRYe38 wrote:

The Cm1000 is well capable of near 900Mpbs. You'll not see much over 900mpbs since WAN and LAN ports are only 1000Mpbs on the modem and the router. 

 

So what happens if you factory reset the router and use default IP address settings of 192.168.1.1 for the router. Does the fragle attack still happen? 

 


Oh? Why do you want me to reset my router to default?  It's in production and I have plenty of ACL's in that firewall, MAC/IP binding, etc.  No way!  This is not in a Lab environment.

 

As I have mentioned above, I don't get that Fraggle Attack any longer because I disabled the display of it in the Logs, plus, I just disabled the DoS and Port Scan on my Nighthawk R8000P.

Message 14 of 22
firefox111
Guide

Re: "DoS attack: Fraggle Attack" almost every 10 seconds

Th


@firefox111 wrote:

I called my cable Internet provider to swap out the modem.  I'm happy to report that the highest I got was 930 Mbps.

 

Why did the picture of my 930 Mbps speedtest result not show up?  How do you attach pictures in this forum?  Let me try again. There we go!

2021-09-14 Gig Speed Test.jpg

 



 

Message 15 of 22
firefox111
Guide

Re: "DoS attack: Fraggle Attack" almost every 10 seconds

Oh, the picture did show up!  So it's not immediately displayed after the upload, unlike other forum sites where I can even paste a picture on the reply.  Also, is there a way to do an "Edit" of a post? - to fix typing mistakes or add more text?

Message 16 of 22
FURRYe38
Guru

Re: "DoS attack: Fraggle Attack" almost every 10 seconds

Are you still experiencing this after the modem was changed out? 

 

A reset maybe need to help validate and troubleshoot the problem and see if it might help resolve the issue as well. Resets are a valid and sometimes necessary step in troubleshoting problems. Also been known to resolve problems as well. 

 

Take a backup configuration to file. Something you should already have on hand. Helps save time if a reset is needed. 

 

My Setup ISP SparkLight | Internet Cable 1000↓/50↑ CM2000 Modem | Wifi Router RAXE50 and R8500(v.158) Router Mode | Switches NG GS105/8 | 

Additional NG HW: C7800/CAX80/CM1100/CM1200/CM2000, Orbi: CBK40, CBK752, RBK50, RBK853, RBK752, RBK953, SXK30 | NightHawk: R7000, R7800, R7960P, R8000, R8500, RAXE500, RAX50, XR450, EX7500/EX7700, GS308v3

Message 17 of 22

Re: "DoS attack: Fraggle Attack" almost every 10 seconds


@firefox111 wrote:

Oh, the picture did show up! 

 


It takes time before images land. To ensure that you aren't posting anything naughty, a Netgear moderator has to approve the pictures.

 

You can attach images to messages without any delay.

 


@firefox111 wrote:

.... unlike other forum sites where I can even paste a picture on the reply. 

 

 


I have seen some of those sites too. And what a mess they become. Riddled with spam and dubious junk. (We get enough of that here.)

 


@firefox111 wrote:

Also, is there a way to do an "Edit" of a post? - to fix typing mistakes or add more text?

 


 

If you get in quickly enough, you may be able to edit. Personally, make great use of the Spellcheck button.

 

 

 

SpellcheckSpellcheck

 

 

 

Just another user.

My network DM200 -> R7800 -> GS316 -> PL1000 -> Orbi RBR40 -> Orbi RBS50Y -> RBS40V
Message 18 of 22
firefox111
Guide

Re: "DoS attack: Fraggle Attack" almost every 10 seconds


@FURRYe38 wrote:

Are you still experiencing this after the modem was changed out? 

 

A reset maybe need to help validate and troubleshoot the problem and see if it might help resolve the issue as well. Resets are a valid and sometimes necessary step in troubleshoting problems. Also been known to resolve problems as well. 

 

Take a backup configuration to file. Something you should already have on hand. Helps save time if a reset is needed. 

 


Thanks but a reset is disruptive.  I don't have redundancy in my infrastructure.  I know backup/restore.  I always backup my config whenever there is a change - and I serialize my backups.

Message 19 of 22
FURRYe38
Guru

Re: "DoS attack: Fraggle Attack" almost every 10 seconds

Are you still experiencing this after the modem was changed out? 

 

Then a reset wouldn't be disruptive if you have a back up. 

 

Good Luck though. 

 

My Setup ISP SparkLight | Internet Cable 1000↓/50↑ CM2000 Modem | Wifi Router RAXE50 and R8500(v.158) Router Mode | Switches NG GS105/8 | 

Additional NG HW: C7800/CAX80/CM1100/CM1200/CM2000, Orbi: CBK40, CBK752, RBK50, RBK853, RBK752, RBK953, SXK30 | NightHawk: R7000, R7800, R7960P, R8000, R8500, RAXE500, RAX50, XR450, EX7500/EX7700, GS308v3

Message 20 of 22

Re: "DoS attack: Fraggle Attack" almost every 10 seconds


@FURRYe38 wrote:

 

 

Then a reset wouldn't be disruptive if you have a back up. 

 

 


But restoring settings from a backup is a well known way of bringing bugs back from the grave.

 

First reset, then see if the problem has gone away. If it has, restore the settings.

 

If restoring brings back the issue, then you know that you will have to steel yourself to a reset and a full reconfiguration.

 

 

 

 

Just another user.

My network DM200 -> R7800 -> GS316 -> PL1000 -> Orbi RBR40 -> Orbi RBS50Y -> RBS40V
Message 21 of 22
FURRYe38
Guru

Re: "DoS attack: Fraggle Attack" almost every 10 seconds

Yep. what I usually recommend. 

My Setup ISP SparkLight | Internet Cable 1000↓/50↑ CM2000 Modem | Wifi Router RAXE50 and R8500(v.158) Router Mode | Switches NG GS105/8 | 

Additional NG HW: C7800/CAX80/CM1100/CM1200/CM2000, Orbi: CBK40, CBK752, RBK50, RBK853, RBK752, RBK953, SXK30 | NightHawk: R7000, R7800, R7960P, R8000, R8500, RAXE500, RAX50, XR450, EX7500/EX7700, GS308v3

Message 22 of 22
Top Contributors
Discussion stats
  • 21 replies
  • 1466 views
  • 1 kudo
  • 4 in conversation
Announcements

Orbi WiFi 6E