NETGEAR is aware of a growing number of phone and online scams. To learn how to stay safe click here.
Forum Discussion
DoS attack, Teardrop or derivative, Ping of Death, strange non-DHCP IP address connected to wifi
I'm getting lots of Dos attacks logged in my C3000 modem/router. They appear to be coming from inside my network, from my wifi. I keep seeing a device attached to my wifi with an IP address of 1.1.15...
I also have this problem. My iPad always have this ip address associated with its MAC address. I'm using C3000 with Comcast.
By looking into this problem I realized that it's not hacking.
The fact is that NETGEAR is not supporting IPV6 well. It's mistaking part of the ipv6 address in ipv6 packets as the src and dst of ipv4 packets.
The ipv6 packat is something like this
| --- 32 bit --- | Info
| --- 32 bit --- | Info
| --- 32 bit --- | source ip e.g. 1111:2222
| --- 32 bit --- | source ip e.g. 3333:4444
| --- 32 bit --- | source ip e.g. 5555:6666
| --- 32 bit --- | source ip e.g. 7777:8888
| --- 32 bit --- | destination ip e.g. 9999:aaaa
| --- 32 bit --- | destination ip e.g. bbbb:cccc
| --- 32 bit --- | destination ip e.g. dddd:eeee
| --- 32 bit --- | destination ip e.g. ffff:0000
While ipv4 is like this
| --- 32 bit --- | Info
| --- 32 bit --- | Info
| --- 32 bit --- | Info
| --- 32 bit --- | source ip e.g. 111.222.111.222
| --- 32 bit --- | destination ip e.g. 000.111.000.111
| --- 32 bit --- | options
Netgear is mistaking the line 4 and 5 of an ipv6 packet, which are part of the ipv6 address, as the src and dst of an ipv4 packet.
The source and destination ip addresses in my log is exactly part of my ipv6 address, which is in heximal, of my iPad.
You can verify that by yourself.
ipv6 address:
xxxx:xxxx:aabb:ccdd:eeff:gghh:xxxx:xxxx
Change aa bb cc dd ee ff gg hh from heximal to decimal AAA BBB CCC DDD EEE FFF GGG HHH
Then you can find that AAA.BBB.CCC.DDD is your source and EEE.FFF.GGG.HHH is your destination of 'DoS' packets.
Why do I keep buying netgear? I guess cause cheap, and it shows.
I have the same issue and even posted a new thread about this. As far as I know, there is no fix. I have searched all over the internet and quite a few people complain about this. In my case, my daughters Iphone shows up in the router page with a WAN IP and I see DOS attacks. This causes drops for all devices on my network for about 1 minute. It happens randomly, but, almost every day. I love the way there is no response at all from Netgear. Do they not monitor their own forums? At least acknowledge the issue. So, I decided to buy a Surfboard 6190 Model and Asus Wireless router. I'll be hooking up next week and hopefully, this issue will be behind me. Everything I read online states this is Netgear bug with IOS devices and Ipv6 packet interpretation. And of course you can't even turn off IPV6 on the C7000. That is pathetic.
thanks damianinpa,
i have to agree with what your saying, i think its also has to do with certain apps being used too. i tried latching my work iphone 6 to do some testing, and funny thing is that it changed the ip address briefly and went away. i used 2 work apps and hardly nothing else, and it appeared to be functioning as normal, when checking the logs. i noticed with certain social apps, it logs the errors immediately from another iphone being tested, which is constantly being used daily and has a ton of other apps. i feel its a cause for concern, thinking the that phone has been infected some how instead of the work phone due to its limited apps and usage. the other iphone is acting like some malicious program hiding behind those social apps, causing all these errors? hopefully, your test on the other replacement routers work out.
update:
I turned off the Router Mode on the c3000 and it rebooted itself. I added the Linksys N750 via the CD it came with and the setup could not have been easier. My speeds are amazing now! Regularly getting 115mbs upload speeds vs the 30 I was getting when i was just using the c3000 for both modem and router. no more conflicts with iphones and randomly assigned IPs.