Need information not present in the Nighthawk 7450 log to report network abuse.
Hello!
Reports of abuse to most network service/telecommunications service providers requires specific types of information to be incuded in the report before any action is taken to mitigate/prevent the abuse. While I have obtained some of the information from the router's log there is more that I need. For example;
source ports & protocols
destination ports & protocols
destination IP if different from my WAN IP
additional log excerpts showing the above information and providing some indication of the frequency/severity of the attacks
I am hard-pressed to take any action on network abuse incidents without this info as up-stream service providers will disregard any reports not including everything they ask for. How can I obtain the info not present in the log?
Re: Need information not present in the Nighthawk 7450 log to report network abuse.
Dear Thomas,
Serisously wondering on how you detect and see network abuse to report if you don't have the information available you're asking for here. Hope you don't build on the misleadinging or often false warnings from these consumer routers.
Re: Need information not present in the Nighthawk 7450 log to report network abuse.
Kurt,
Have you looked at the logs? Here are a few revealing entries from mine.......
***BEGIN LOG EXCERPT^^^
[DoS attack: ACK Scan] from source: 151.101.26.252:443 Saturday, November 06,2021 21:40:44 [DoS attack: ACK Scan] from source: 72.21.81.237:443 Saturday, November 06,2021 21:40:12 [DoS attack: ACK Scan] from source: 54.187.87.190:443 Saturday, November 06,2021 21:38:00 [DoS attack: ACK Scan] from source: 52.40.172.46:443 Saturday, November 06,2021 21:37:35 [DoS attack: ACK Scan] from source: 151.101.130.132:443 Saturday, November 06,2021 21:37:07 [DoS attack: ACK Scan] from source: 23.37.224.57:443 Saturday, November 06,2021 21:36:44 [DoS attack: ACK Scan] from source: 3.224.57.93:443 Saturday, November 06,2021 21:36:22 [DoS attack: ACK Scan] from source: 151.101.26.252:443 Saturday, November 06,2021 21:34:13 [DoS attack: ACK Scan] from source: 151.101.26.252:443 Saturday, November 06,2021 21:33:46 [DoS attack: ACK Scan] from source: 34.217.225.30:443 Saturday, November 06,2021 21:32:22 [DoS attack: ACK Scan] from source: 34.212.111.15:443 Saturday, November 06,2021 21:30:55 [DoS attack: ACK Scan] from source: 72.21.81.237:443 Saturday, November 06,2021 21:28:54 [DoS attack: ACK Scan] from source: 44.236.75.167:443 Saturday, November 06,2021 21:28:00
***END LOG EXCERPT^^^
So, the "abuse" (a DDOS attack) is identified in the log and the attack has gotten bad enough that it has made a noticeable impact on my WAN network performance.In addition, (and this is just a hunch), the amount of heat generated by the router would indicate that its 4 processors are really struggling to keep up with all the requests. Historically, my LAN (we've got just a few devices accessing the Internet) does not generate enough of a workload to cause a router to get hot. Hope that answers your question.
