NETGEAR is aware of a growing number of phone and online scams. To learn how to stay safe click here.
Forum Discussion
Trying to understand nature of "DoS attack: RST Scan" log messages
Disclaimer: I am a security engineer, so my questions which follow are not to understand what a DoS attack or RST scan are; I know what those are -- I'm trying to understand the behavior of my router...
Thank you brado77 for a post on this topic I'm trying to learn more about.
I had 2 computers even before getting both the Tandy 1000EX and 1000SX (dual floppy / no HDD).
Fast forward to today. The last 2 evenings, the TV is buffering and game machine losing service brought me to looking at the logs. Could be the ISP due to solar activity (2/22/24) and AT&T outages? Central USA location.
The log shows DoS attacks within 2 minutes of reset. Most are Fraggle and RST. Thanks to reading this thread I realize it is more inherent to the firmware than real attacks. Fraggles show port 67. RST scans on port 443. Also ACK scan on port 993, resolves to googleplex, CA.
I bought a pfsense SG1100 last year. I've been trying to teach myself it's setup. Now with the new buffering problem, I'm going to install the Nighthawk AX5400 for computers (whitelisting) and the Nighthawk R7960P as an access point for IOT devices. That is until I feel good enough about rules and subnetting setup on the pfsense to implement it.
Just posting this to say thank you and others on the thread for the insights on the DoS log messages. Now I am off to read about email did not resolve topic.