Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Possible Duplicate:
Ping flooding: what to do about it?

My router's log, which is a D-Link DIR-600, shows 40 pages (and updating) of entries like:

Nov 19 11:17:08     PING-FLOODING flooding attack from WAN (ip:85.250.85.11) detected.
Nov 19 11:17:02     PING-FLOODING flooding attack from WAN (ip:85.131.129.176) detected.
Nov 19 11:16:57     PING-FLOODING flooding attack from WAN (ip:122.107.244.152) detected.
Nov 19 11:16:50     PING-FLOODING flooding attack from WAN (ip:88.103.8.96) detected.
Nov 19 11:16:46     PING-FLOODING flooding attack from WAN (ip:212.142.91.106) detected.
Nov 19 11:16:38     PING-FLOODING flooding attack from WAN (ip:184.170.6.63) detected.
Nov 19 11:16:34     PING-FLOODING flooding attack from WAN (ip:1.239.96.192) detected.
Nov 19 11:16:26     PING-FLOODING flooding attack from WAN (ip:120.29.76.184) detected.
Nov 19 11:16:20     PING-FLOODING flooding attack from WAN (ip:110.77.137.228) detected.
Nov 19 11:16:15     PING-FLOODING flooding attack from WAN (ip:201.141.51.210) detected.

What should I do? ICMP is disabled (router does not respond to WAN pings).

share|improve this question

marked as duplicate by Oliver Salzburg Jan 4 '13 at 0:47

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

    
can we prevent this by adding firewall polices –  druveen Dec 28 '12 at 18:35
3  
Why do you think you need to do something? Are you having an actual problem? –  David Schwartz Dec 28 '12 at 19:13
add comment

2 Answers

First, are you running some sort of public server or other target? If not, find out what your external WAN address is. Shut down your ISP connection (unplug DSL modem/cable modem...) and keep it off for awhile (sorry, time varies). Plug back in. Hopefully your ISP will assign you a new address and you will be good. If you don't get a new address, call your ISP to get them to bump you to a new address.

If you are running a public server of some sort, someone has decided to target the URL address and rebooting won't help - your system will publish the new IP address into DNS and eventually the flood attack will find your new address and hit you again. You would need to find out why someone is targetting you in this case and work with your ISP to try and block it.

share|improve this answer
add comment

Unless you have reason to believe you're being targeted (you run a webpage from your connection, etc) this is probably just the typical random noise that you get from any internet-facing firewall. If you dig deeper (and your firewall logs it) you will likely also see connection attempts on common ports (21,22,23,25,80,110, etc) - these are nothing more than script kiddie portscanners hoping to find an easy target.

share|improve this answer
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.