3

I have a Netgear Wnr1000v2 router. I have set my NAT to secure mode ( I don't know if that helps). Many times when I see my router's log I see lots of DoS attack: RST Scan. I think that these only occur when I use uTorrent or Tunngle. Whenever I get hit with these DoS attacks my Internet slows down significantly, then it completely disconnects.

See the latest logs:

[Internet disconnected] Sunday, July 01, 2012 15:52:27
[DoS Attack: RST Scan] from source: 222.232.111.93, port 37111, Sunday, July 01, 2012 15:51:35
[DoS Attack: RST Scan] from source: 122.162.82.230, port 14544, Sunday, July 01, 2012 15:51:01
[DoS Attack: RST Scan] from source: 122.162.82.230, port 14426, Sunday, July 01, 2012 15:50:12
[DoS Attack: RST Scan] from source: 122.162.82.230, port 14261, Sunday, July 01, 2012 15:49:47
[DoS Attack: RST Scan] from source: 88.88.236.33, port 14102, Sunday, July 01, 2012 15:49:01
[DoS Attack: RST Scan] from source: 222.232.111.93, port 36430, Sunday, July 01, 2012 15:46:59
[DoS Attack: RST Scan] from source: 222.232.111.93, port 36166, Sunday, July 01, 2012 15:45:07
[DoS Attack: RST Scan] from source: 177.40.143.78, port 40460, Sunday, July 01, 2012 15:43:52
[DoS Attack: RST Scan] from source: 177.40.143.78, port 40405, Sunday, July 01, 2012 15:43:16
[DoS Attack: ACK Scan] from source: 117.254.153.44, port 40523, Sunday, July 01, 2012 15:41:11
[DoS Attack: RST Scan] from source: 71.218.6.227, port 26307, Sunday, July 01, 2012 15:40:15
[DoS Attack: ACK Scan] from source: 117.254.153.44, port 40523, Sunday, July 01, 2012 15:38:49
[DoS Attack: RST Scan] from source: 71.218.6.227, port 25949, Sunday, July 01, 2012 15:38:34
[DoS Attack: ACK Scan] from source: 88.181.25.230, port 54096, Sunday, July 01, 2012 15:37:31

After continuous DoS attacks you can see that the Internet eventually disconnected. I then had to reboot the router to get it work again. This happens quite often - is there something I can do? The IP address doing DoS attacks always change, so I guess there is no use in blocking these IP addresses.

Even if I am equipped with the best antivirus , anti-malware or other software, I really want to avoid getting disconnected because of these DoS attacks.

4
  • Torrenting may appear like a DOS attack to the router, since it's loads of connections from different IPs. That doesn't necessarily mean it is a DOS attack though... Have you opened the port your torrent program uses for incoming connections? Have you tried decreasing the allowed amount of connections in your torrent program? Cheers. – Ryqiem Jul 1 '12 at 12:35
  • @Ryqiem But how does that disconnects my internet every time? – Rakesh Juyal Jul 1 '12 at 12:45
  • 1
    SOHO routers are often incapable to handle large amounts of connections and sometimes just crash/reset in these cases. Reducing the amount of allowed connections will likely fix your problem. Sometimes a firmware update might help to at least prevent the crashes. – Gurken Papst Jul 1 '12 at 13:01
  • Related topic explaining the problem you are probably facing: superuser.com/questions/121657/… - Your real question is likely a duplicate of this. The logged DOS attack is a red herring. – Gurken Papst Jul 1 '12 at 13:13
0

I had the same problem and I looked up the IPs listed in my router log. I found the IPs belonged to well known companies like Facebook, Microsoft, Tencent Games, ... and I know I browsed these sites.

I'm unsure why my router log shows the entries as DDOS but I don't think it is a point to panic.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.