0

Possible Duplicate:
Ping flooding: what to do about it?

My router's log, which is a D-Link DIR-600, shows 40 pages (and updating) of entries like:

Nov 19 11:17:08     PING-FLOODING flooding attack from WAN (ip:85.250.85.11) detected.
Nov 19 11:17:02     PING-FLOODING flooding attack from WAN (ip:85.131.129.176) detected.
Nov 19 11:16:57     PING-FLOODING flooding attack from WAN (ip:122.107.244.152) detected.
Nov 19 11:16:50     PING-FLOODING flooding attack from WAN (ip:88.103.8.96) detected.
Nov 19 11:16:46     PING-FLOODING flooding attack from WAN (ip:212.142.91.106) detected.
Nov 19 11:16:38     PING-FLOODING flooding attack from WAN (ip:184.170.6.63) detected.
Nov 19 11:16:34     PING-FLOODING flooding attack from WAN (ip:1.239.96.192) detected.
Nov 19 11:16:26     PING-FLOODING flooding attack from WAN (ip:120.29.76.184) detected.
Nov 19 11:16:20     PING-FLOODING flooding attack from WAN (ip:110.77.137.228) detected.
Nov 19 11:16:15     PING-FLOODING flooding attack from WAN (ip:201.141.51.210) detected.

What should I do? ICMP is disabled (router does not respond to WAN pings).

2
  • can we prevent this by adding firewall polices
    – druveen
    Dec 28, 2012 at 18:35
  • 3
    Why do you think you need to do something? Are you having an actual problem? Dec 28, 2012 at 19:13

2 Answers 2

0

First, are you running some sort of public server or other target? If not, find out what your external WAN address is. Shut down your ISP connection (unplug DSL modem/cable modem...) and keep it off for awhile (sorry, time varies). Plug back in. Hopefully your ISP will assign you a new address and you will be good. If you don't get a new address, call your ISP to get them to bump you to a new address.

If you are running a public server of some sort, someone has decided to target the URL address and rebooting won't help - your system will publish the new IP address into DNS and eventually the flood attack will find your new address and hit you again. You would need to find out why someone is targetting you in this case and work with your ISP to try and block it.

0

Unless you have reason to believe you're being targeted (you run a webpage from your connection, etc) this is probably just the typical random noise that you get from any internet-facing firewall. If you dig deeper (and your firewall logs it) you will likely also see connection attempts on common ports (21,22,23,25,80,110, etc) - these are nothing more than script kiddie portscanners hoping to find an easy target.

Not the answer you're looking for? Browse other questions tagged .