What the Hell is a Dos Attack

[christianjb]

I have an orbi rbr 50 as my router connected to an xfinity modem, we have the fastest internet available from them yet I get constant slow downs when downloading from any game service many times. There's usually at least 8-10 devices connected total and we have one orbi satellite for the security cameras and laptop in the front of the house. And being curious as to what is going on I found the router logs on the portal, and have no idea what to make of it. Anyone have a clue what the hell all of these dos atttacks are?

log is in this pastebin: https://pastebin.com/Zb5BzThQ

[FURRYe38]

What Firmware is currently loaded?
What is the Mfr and model# of the ISP modem the NG router is connected too?

https://en.wikipedia.org/wiki/Denial-of-service_attack

Use this tool to look up those IP addresses. You may need to ask your ISP for some help on this if your getting attacked.

http://whois.domaintools.com

[christianjb]

Router has the latest firmware, V2.3.5.30, and the isp modem is the Xfinity xFi Advanced Gateway and the model # is: CGM4140COM.

[FURRYe38]

Modem/Gateway Combo Units:
This would be a double NAT condition which isn't recommended. https://kb.netgear.com/30186/What-is-Double-NAT
Couple of options,
1. Configure the modem for transparent bridge mode. Then use the Orbi router in router mode. You'll need to contact the ISP for help and information in regards to the modem being bridged correctly.
2. If you can't bridge the modem, disable ALL wifi radios on the modem, configure the modems DMZ/ExposedHost or IP Pass-Through for the IP address the Orbi router gets from the modem. Then you can use the Orbi router in Router mode.
3. Or disable all wifi radios on the modem and connect the Orbi router to the modem, configure AP mode on the Orbi router. https://kb.netgear.com/31218/How-do-I-configure-my-Orbi-router-to-act-as-an-access-point and https://www.youtube.com/watch?v=H7LOcJ8GdDo&app=desktop

[christianjb]

My orbi router is currently on router mode and the modem is already in bridge mode with wireless turned off, should I still turn on AP mode?

[FURRYe38]

Can try this. Would mean that the modem would not be passing thru any DDOS attacks and not be come the attacked unit. 

See if this changes anything...something to talk to your ISP about. See if they can give you a different WAN IP address. 

[christianjb]

I turned on ap mode and now wifi hasn't been working for 5 minutes now

[FURRYe38]

Do a full power OFF then back on with the RBR. Leave the RBS off for now. Ensure your RBR is connected with the WAN port to the LAN port on the ISP modem. 

[christianjb]

I turned on ap mode and when it was resetting my brother tried restarting it, and now there's no internet when I connect to the router, what do

[CrimpOn]

---

@christianjb wrote:

Anyone have a clue what the hell all of these dos atttacks are?

---

Others are helping with the performance issue.  The term "DoS" stands for Denial of Service.  The Orbi firewall detects when the same IP address sends a number of similar packets which could be interpreted as an attempt to "flood" the Orbi to the point that it is unable to respond. e.g. Denying the router the ability to perform service.  The Orbi firewall discards all of those packets and puts an entry in the log.

Occasionally, the news will report that somoe group of hackers has attempted a DoS attack on some entity, such as by using thousands of "bots" to bombard Google (or someone) with email or web requests in an attempt to force them out of service.

NOTE: if some "evil doers" REALLY performed a DoS on an Orbi, then performance would drop to nearly zero and remain that way until they quit.  I have accumulated all of my Orbi log files since March.  Every month there are dozens and dozens of these reports, yet my Orbi works fine.

These DoS entries are normal.  They are not related to your issue.

[christianjb]

Everything is connected properly, I did a full reset power down of both the modem and router, yet when I connect there's no internet access