× NETGEAR is aware of a growing number of phone and online scams. To learn how to stay safe click here.
Orbi WiFi 7 RBE973
Reply

[DoS attack: Fraggle Attack] on RAX20 logs

chrisling
Aspirant

[DoS attack: Fraggle Attack] on RAX20 logs

Hi there,

 

I noticed there are quite a lot of following entires from the log of my RAX20,is there anything I need to worry about?

 

[DoS attack: Fraggle Attack] from source UNKNOWN,port 68 Thursday, Apr 23,2020 12:46:31
[DoS attack: Fraggle Attack] from source UNKNOWN,port 993 Thursday, Apr 23,2020 12:45:35

[DoS attack: ACK Scan] from source 74.125.23.108,port 993 Thursday, Apr 23,2020 12:35:14
[DoS attack: Fraggle Attack] from source UNKNOWN,port 68 Thursday, Apr 23,2020 12:35:08

[DoS attack: ACK Scan] from source 157.240.199.34,port 443 Thursday, Apr 23,2020 12:18:12
[DoS attack: ACK Scan] from source 216.58.199.106,port 443 Thursday, Apr 23,2020 12:17:26

 

This RAX20 is connecting to an uplink R7000 as a edge router front facing the ISP's modem. 

 

R7000 is NATed from the ISP Modem (192.168.1.0) and RAX20 is NATed from R7000 with a network IP 10.0.0.0

 

Similar log entries are not found on my R7000 router.

 

Any helps appreciated.

Model: RAX40|Nighthawk AX4 4-Stream WiFi Router
Message 1 of 3

Re: [DoS attack: Fraggle Attack] on RAX20 logs

Netgear's firmware is great at creating false reports of DoS attacks. Many of them are no such thing.

 

Search - NETGEAR Communities – DoS attacks

 

Use Whois.net to see who is behind some of them and you may find that they are from places like Facebook, Google, even your ISP.

 

216.58.199.106 and 74.125.23.108 are Google.

157.240.199.34 is Facebook

 

Here is a useful tool for that task:

 

IPNetInfo: Retrieve IP Address Information from WHOIS servers

 

If these events are slowing down your router, that may be because it is using up processor time as it writes the events to your logs. Anything that uses processor power – event logging, QoS management, traffic metering – may cause slowdowns. Disable logging of DoS attacks and see if that reduces the problem. This does not prevent the router from protecting you from the outside world.

 

 

 


@chrisling wrote:

This RAX20 is connecting to an uplink R7000 as a edge router front facing the ISP's modem. 

 


 

Sounds messy. Are you running "Double NAT" because you like things that way? Heaven only knows what the  modem is also doing.

 

 

Message 2 of 3
chrisling
Aspirant

Re: [DoS attack: Fraggle Attack] on RAX20 logs


@michaelkenward wrote:
Sounds messy. Are you running "Double NAT" because you like things that way? Heaven only knows what the  modem is also doing.

@michaelkenward Thanks for your reply, I have read thru all other DOS posts beforehand but trying to be certain that's all.

 

Anyway my ISP's modem is only assigning 1 dynamic IP to me so I doubt that I can bridge it, hence have the R7000 that sit right next to it is doing the first NAT, 192.168.1.0, mainly serving my parents devices thru wifi, further on a 50m long Cat5 cable is connecting from R7000 LAN port#1 to a RAX20 which is situateed on the other (disjointed) end of the house, the RAX20 is doing the 2nd level of NAT (network: 10.0.0.1) so yes, it's a double NAT setup, the 10.0.0.1 network is mainly for my own usage.

 

To make things a little bit more complicated, I have a pfSense VM setup on one of my ESXi hosts (IP: 192.168.1.2) acting as a router/firewall to the 3rd network 172.16.1.0 for other VMs.  A static route on the R7000 is setup to allow access to this 3rd network from the other 2.

 

I don't particularly like this setup, but it's striaght forward and serve the purpose of having 3 networks segmented.  I could have bridge both the Netgear routers but don't want the R7000 be the only one doing all the heavy liftings.

 


 

Message 3 of 3
Top Contributors
Discussion stats
  • 2 replies
  • 4292 views
  • 0 kudos
  • 2 in conversation
Announcements

Orbi WiFi 7