Orbi WiFi 7 RBE973
Reply

Orbi Pro SRR60 DoS attack: STN/ACK Scan

DH_1
Apprentice

Orbi Pro SRR60 DoS attack: STN/ACK Scan

Hi,

 

Is is normal to see in the Logs (Advanced/Administratio/Logs) to see a lot of dos attack showing up? And is there ways to stop it? 

Ans is router/WAN proteced?  

 

Below is a copy of what I see in my log today......

 

[DoS Attack: SYN/ACK Scan] from source: 52.156.115.24, port 443, Sunday, September 26, 2021 13:04:41
[DoS Attack: RST Scan] from source: 104.68.230.154, port 443, Sunday, September 26, 2021 12:38:25
[DoS Attack: SYN/ACK Scan] from source: 95.217.30.172, port 443, Sunday, September 26, 2021 12:01:00
[DoS Attack: SYN/ACK Scan] from source: 168.119.232.76, port 443, Sunday, September 26, 2021 11:47:12
[DoS Attack: SYN/ACK Scan] from source: 168.119.232.76, port 443, Sunday, September 26, 2021 11:44:05
[DoS Attack: SYN/ACK Scan] from source: 109.230.238.209, port 25644, Sunday, September 26, 2021 11:37:40
[DoS Attack: SYN/ACK Scan] from source: 141.94.181.214, port 65300, Sunday, September 26, 2021 11:20:54
[DoS Attack: WinNuke Attack] from source: 47.74.92.241, port 53400, Sunday, September 26, 2021 10:58:53
[DoS Attack: SYN/ACK Scan] from source: 172.217.194.153, port 443, Sunday, September 26, 2021 10:52:13
[DoS Attack: SYN/ACK Scan] from source: 74.91.119.7, port 22, Sunday, September 26, 2021 10:51:09

Model: SRK60B03|Orbi Pro Tri-Band Business WiFi System
Message 1 of 5
schumaku
Guru

Re: Orbi Pro SRR60 DoS attack: STN/ACK Scan

Absolute normal router operations. The router protected certain activities on Internet -> Router/Internal Network activities. Some are side effects of devices with a lot of active connections to the Internet are going to sleep, roam away from the local WiFi or wired connections to the mobile network, roam from the mobile to the local WIFi, and so on.

Message 2 of 5
DH_1
Apprentice

Re: Orbi Pro SRR60 DoS attack: STN/ACK Scan

Thank you @schumaku much appreciated...

Message 3 of 5
DH_1
Apprentice

Re: Orbi Pro SRR60 DoS attack: STN/ACK Scan

Hi @schumaku ,

 

Just to clarify and insure that I have the correct option on the Orbi Pro, I attached a screen grab from the Router......Advanced-setup-WAN

 

Is this correct???  I assume NO check in the first line  "Disable Port Scan"  That means that is is on right?  that is the router is doing its protection? 

 

Remember, I am not a techy person with this new hardware.

 

thanks   

Message 4 of 5
schumaku
Guru

Re: Orbi Pro SRR60 DoS attack: STN/ACK Scan


@DH_1 wrote:

Is this correct???  I assume NO check in the first line  "Disable Port Scan"  That means that is is on right?  that is the router is doing its protection? 


Absolutely correct!

 


@DH_1 wrote:

Remember, I am not a techy person with this new hardware.


Asking is always a good approach of course.

 

The question is always if and how much logging should be done on consumer and SOHO/SMB equipment in this aspect. Other vendors simply suppress these activities, or put them to a different logging classes which are not enabled or visible by default. The Netgear way with the messages you see is always scaring non-experienced users, and long time active users here have seen virtually hundreds from scared owners.

 

 

Message 5 of 5
Top Contributors
Discussion stats
  • 4 replies
  • 1054 views
  • 1 kudo
  • 2 in conversation
Announcements