Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I was looking in the log on my router Netgear WNR-2000 today and found this log entry:

[DoS Attack: ACK Scan] from source: 78.72.133.126, port 27014, Friday, November 19,2010 10:49:04

What does this mean? I hardly believe that I'm under a "Dos Attack", but what does ACK Scan mean? is it a "port-scan" e.g. someone is looking what ports I have open?

Should I be worried? or is it just fine?

share|improve this question
up vote 4 down vote accepted

An ACK Scan is just that. Someone was scanning for acknowledgements from your router in the hopes they could cross your firewall and penetrate your network. An explanation with pics is available here:

http://www.networkuptime.com/nmap/page3-12.shtml

Should you be worried? Not if your equipment caught it. However, equipment won't catch everything.

share|improve this answer

DoS = Denial of Service - This is just labeling this event as a possible DoS attack. There are different forms of it and this request is one part of this type of attack.

ACK = Acknowledgement - This is a stage of the TCP network protocol.

It is looking for open ports that will respond (acknowledge) a port request or ping. Your router/firewall sounds like it is doing its job.

I would only be partially concerned if it was happening a lot or if it was trying to communicate with a known open port you have. One entry is pretty common. Most people would be surprised how much their home internet connections get scanned for open ports.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .