This topic has been marked solved and closed to new posts due to inactivity. We hope you'll join the conversation by posting to an open topic or starting a new one.
DOS attack UDP port scan from private network address
Hi,
I have been getting non-stop DOS attack: UDP port scan from a private network address, is it some device in my network that is causing this issue? Can anyone guide me on how to identify the culprit device?
Example of the log shown
[DoS Attack: UDP Port Scan] from source: 169.254.32.5, port 35834, Wednesday, August 18, 2021 11:36:38 [DoS Attack: UDP Port Scan] from source: 169.254.32.5, port 34617, Wednesday, August 18, 2021 11:36:09 [DoS Attack: UDP Port Scan] from source: 169.254.32.5, port 41504, Wednesday, August 18, 2021 11:35:41 [DoS Attack: UDP Port Scan] from source: 169.254.32.5, port 46924, Wednesday, August 18, 2021 11:35:11 [DoS Attack: UDP Port Scan] from source: 169.254.32.5, port 54570, Wednesday, August 18, 2021 11:34:40
Re: DOS attack UDP port scan from private network address
This is called a "Link Local" IP address, which is created by a device when it is unable to get an IP from the network using DHCP.
I would start with the Orbi web interface Attached Devices display All of the devices shown with valid IP addresses (usually starting with 192.168.1) can be ruled out. Are there any other devices connected to the network that are not on the Attached Devices list?
Re: DOS attack UDP port scan from private network address
This is called a "Link Local" IP address, which is created by a device when it is unable to get an IP from the network using DHCP.
I would start with the Orbi web interface Attached Devices display All of the devices shown with valid IP addresses (usually starting with 192.168.1) can be ruled out. Are there any other devices connected to the network that are not on the Attached Devices list?
If you are able to capture some of these "attacks", then a tool such as Wireshare (free for Windows, Linux, Mac) will provide the MAC address that is sending the packets. Put that into an on-line tool to identify which company manufactured the network card in the device.
Re: DOS attack UDP port scan from private network address
Wow, i have too many devices connected. I think the culprit might be the yeelight with WIFI connection for home automation. Seems like one of the light is not connected to the wifi. Let me try turning them off to see if it will solve this issue.
