Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

We're having intermittent connectivity issues with our ADSL at the office. We've been dealing with our ISP for weeks and they don't know how to fix our problem.

What happens is that at multiple times during the day, our connection becomes horribly slow, then drops, and for quite a few minutes, we're unable to reconnect to our wireless Netgear router.

When I manage to log in to our Netgear management console, the log file indicates a bunch of DoS attack attempts:

[UPnP set event:DeletePortMapping] from source 192.168.0.2, Thursday, July 25,2013 14:22:19
[UPnP set event:AddPortMapping] from source 192.168.0.2, Thursday, July 25,2013 14:22:15
[UPnP set event:DeletePortMapping] from source 192.168.0.2, Thursday, July 25,2013 14:22:13
[DHCP IP: (192.168.0.2)] to MAC address 68:A8:6D:22:A3:54, Thursday, July 25,2013 14:22:05
[DoS attack: ACK Scan] from source: 46.33.69.202:80, Thursday, July 25,2013 14:12:07
[DoS attack: ACK Scan] from source: 8.18.45.90:80, Thursday, July 25,2013 14:10:15
[UPnP set event:AddPortMapping] from source 192.168.0.16, Thursday, July 25,2013 14:04:58
[UPnP set event:AddPortMapping] from source 192.168.0.16, Thursday, July 25,2013 14:04:57
[UPnP set event:DeletePortMapping] from source 192.168.0.16, Thursday, July 25,2013 14:04:56
[UPnP set event:DeletePortMapping] from source 192.168.0.16, Thursday, July 25,2013 14:04:54
[DHCP IP: (192.168.0.16)] to MAC address 34:51:C9:AA:38:40, Thursday, July 25,2013 14:03:26
[DoS attack: ACK Scan] from source: 99.3.43.180:61897, Thursday, July 25,2013 14:00:45
[DoS attack: ACK Scan] from source: 199.30.80.32:80, Thursday, July 25,2013 13:58:22
[DoS attack: ACK Scan] from source: 199.30.80.32:80, Thursday, July 25,2013 13:57:54

Could this be what is causing connection stability issues? Is there a way to circumvent it?

What about turning off "Enable SSID Broadcast", will that offer some security by obscurity?

Thanks in advance!

share|improve this question
    
I'll let someone else more knowledgeable about this to answer, but I don't believe disabling SSID broadcast will do much to stop the DoS attacks, all that does is make your router "undiscoverable" by scanners, one could still connect directly to it if they know your SSID and credentials –  Jason Bristol Jul 25 '13 at 14:33
    
What's the model of your router? –  Darth Android Jul 25 '13 at 15:08
    
Even if you disable broadcasting your SSID it wouldn't solve your problems. Besides your not actually being attacked because the time between the two messages is to great. Your router is simply treating ever ACK scan as an attack. –  Ramhound Jul 25 '13 at 15:33
add comment

1 Answer

The DoS or DDoS attacks are coming to your public IP with attempts to port scan your network for a response on an open port (ACK Scan is looking for a port to acknowledge ICMP).

Disabling your SSIS will stop people from scanning for your private Wi-Fi from the outside, and you will need to reconfigure your devices to connect to this network by creating a new connection, manually entering your SSID into the new connection settings, and tell it to connect even if the network appears offline.

This however will not stop DoS and DDoS attacks from registering against your public IP address, you would have to have echo reply disabled on your modem. If you have access to your modem BIOS you may be able to change it yourself, if not your ISP can likely do it for you.

Are you able to connect to the network, but have no web access? Or does your network no longer appear as an available network?

share|improve this answer
    
Hi Pretzel, We often lose connectivity to the router itself. Usually this corresponds with a UPnP set event:DeletePortMapping and UPnP set event:AddPortMapping in the logs. Often I try connecting to the WiFi and my Mac is throwing a timeout error message attempting to connect to the wifi. It normally comes back after about 5-10 minutes. –  josef.van.niekerk Jul 25 '13 at 14:43
    
Are you using uPNP for any devices? Anything else in your logs such as login attempts? –  Pretzel Jul 25 '13 at 14:49
    
Not sure about uPNP, and no login attempts other than my own. –  josef.van.niekerk Jul 25 '13 at 18:54
    
In your netgear BIOS under advanced settings there should be a setting for uPNP, if you are not using uPNP (universal plug and play) disable it. Also, if you have remote management active and are not using that as well it would be best to disable it. Disabling uPNP may rectify this situation. –  Pretzel Jul 25 '13 at 19:28
    
I've turned uPNP off, will keep an eye on the logs. Also disabled SSID broadcasting. –  josef.van.niekerk Jul 29 '13 at 13:30
show 4 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.