up vote 0 down vote favorite
share [g+] share [fb]

I am constantly being attacked each second by an another computer and everytime the attack is from a different IP address. Kaspersky PURE says that is a "Network DoS.Generic.SYNFlood" type attack. 2 Hours back Kaspersky blocked 5 IP addresses and now it blocked 100 IP addresses. What measures should I take ? Am I already infected ? How can I secure myself ?

link|improve this question
80% accept rate
1  
100 IPs per hour is not a DOS attack. Just keep your firewall up, your software updated & patched, and you don't need to do anything else. – haimg Dec 25 '11 at 17:03
@haimg, it could be, but a VERY small scale one. I have seen machines go down when there are a mere 1000 pages served a minute (though that was legitimate traffic). – soandos Dec 25 '11 at 17:05
What I suspect is it is trying to make my computer a zombie and thereby trying to launch a DOS attack – Failed_Noob Dec 25 '11 at 17:09
For 2 days (like 3 or 4 days ago) I disabled my protection so that I could increase my net speed. Do u think my computer is already a zombie ? – Failed_Noob Dec 25 '11 at 17:14
1  
That does not make any sense. DOS stands for Denial Of Service. It is generally used against web sites to stop the page from being sent to legitimate users, thereby shutting it down. There is no reason to use a DOS attack to turn a computer into a zombie. – soandos Dec 25 '11 at 17:15
show 2 more comments
feedback

1 Answer

up vote 4 down vote accepted

The only thing that you can really do if someone is trying to execute a denial of service attack on you is what you are already doing (blocking IP addresses). Anything else might mitigate the problem (something like a better way of handling SYN ACK requests) but will not solve it.

Just becuase you are being attacked does not mean you are infected. In fact, since this is a DOS attack the primary goal is to shut you down/make you non-responsive to legitimate traffic, not infect you with a virus (though it is possible to use a DOS attack as a distraction, if the DOS attack is successful, the virus's responsiveness will also be slowed down along with the server).

Blocking 100 IP addresses in and of itself is not a terrible thing, as long as they are actually trying to DOS you. If not, you are just blocking people that want to access your site.

link|improve this answer
"If not, you are just blocking people that want to access your site." ........Just to make it clear I am not running any website, its not a server computer , its my personal computer (client) – Failed_Noob Dec 25 '11 at 17:11
1  
So then you have nothing to worry about. – soandos Dec 25 '11 at 17:12
What if it is trying to make a zombie ? – Failed_Noob Dec 25 '11 at 17:15
4  
@Failed_Noob, a DOS attack cannot make your computer a zombie. – David X Dec 25 '11 at 17:39
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.