Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have Netgear Wnr1000v2 router. I have set my NAT to secure mode ( I don't know if that helps ). Many a times when I see my router's log I see lots of DOS attack: RST Scan. I somehow think that these occur only when I use uTorrent or Tunngle. Also when I got hit with these DOS attacks my internet goes too slow, and then it completely disconnects.

See latest logs:

[Internet disconnected] Sunday, July 01, 2012 15:52:27 [DoS Attack: RST Scan] from source: 222.232.111.93, port 37111, Sunday, July 01, 2012 15:51:35 [DoS Attack: RST Scan] from source: 122.162.82.230, port 14544, Sunday, July 01, 2012 15:51:01 [DoS Attack: RST Scan] from source: 122.162.82.230, port 14426, Sunday, July 01, 2012 15:50:12 [DoS Attack: RST Scan] from source: 122.162.82.230, port 14261, Sunday, July 01, 2012 15:49:47 [DoS Attack: RST Scan] from source: 88.88.236.33, port 14102, Sunday, July 01, 2012 15:49:01 [DoS Attack: RST Scan] from source: 222.232.111.93, port 36430, Sunday, July 01, 2012 15:46:59 [DoS Attack: RST Scan] from source: 222.232.111.93, port 36166, Sunday, July 01, 2012 15:45:07 [DoS Attack: RST Scan] from source: 177.40.143.78, port 40460, Sunday, July 01, 2012 15:43:52 [DoS Attack: RST Scan] from source: 177.40.143.78, port 40405, Sunday, July 01, 2012 15:43:16 [DoS Attack: ACK Scan] from source: 117.254.153.44, port 40523, Sunday, July 01, 2012 15:41:11 [DoS Attack: RST Scan] from source: 71.218.6.227, port 26307, Sunday, July 01, 2012 15:40:15 [DoS Attack: ACK Scan] from source: 117.254.153.44, port 40523, Sunday, July 01, 2012 15:38:49 [DoS Attack: RST Scan] from source: 71.218.6.227, port 25949, Sunday, July 01, 2012 15:38:34 [DoS Attack: ACK Scan] from source: 88.181.25.230, port 54096, Sunday, July 01, 2012 15:37:31

See after continuous DOS attacks internet eventually disconnected. Then I had to reboot the router to get it work. It happens most often. Is there something I can do? These IP address doing DOS attacks always change, so I guess there is no use of blocking these IP addresses.

Even if I am equipped with best anti-virus , anti-malware or any other software, the thing is I just don't want to get disconnected because of these DOS attacks. Please let me know what can I do?

share|improve this question
    
Torrenting may appear like a DOS attack to the router, since it's loads of connections from different IPs. That doesn't necessarily mean it is a DOS attack though... Have you opened the port your torrent program uses for incoming connections? Have you tried decreasing the allowed amount of connections in your torrent program? Cheers. –  Ryqiem Jul 1 '12 at 12:35
    
@Ryqiem But how does that disconnects my internet every time? –  Rakesh Juyal Jul 1 '12 at 12:45
    
SOHO routers are often incapable to handle large amounts of connections and sometimes just crash/reset in these cases. Reducing the amount of allowed connections will likely fix your problem. Sometimes a firmware update might help to at least prevent the crashes. –  Gurken Papst Jul 1 '12 at 13:01
    
Related topic explaining the problem you are probably facing: superuser.com/questions/121657/… - Your real question is likely a duplicate of this. The logged DOS attack is a red herring. –  Gurken Papst Jul 1 '12 at 13:13

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.