1. Visiting from the US? Why not try DIYnot.US instead? Click here to continue to DIYnot.US.
    Dismiss Notice

strange router log entries

Discussion in 'Software' started by joinerjohn, 21 Jun 2010.

  1. joinerjohn

    joinerjohn

    Joined:
    28 Nov 2009
    Messages:
    6,145
    Thanks Received:
    201
    Location:
    Derby
    Country:
    United Kingdom
    Recently my router has been disconnecting from the interwebthingy for short times.
    I have logging enabled on it so I have had a look tonight. Here's a copy of part of the internet log from Sunday.

    "[DOS attack: FIN Scan] attack packets in last 20 sec from ip [84.53.178.115], Sunday, Jun 20,2010 12:11:00"

    Am I right in thinking this is a Denial Of Service attack, or am I completely mistaken?
    Antivirus and firewall don't seem to pick this up when it happens though.
    Cheers JB
     
  2. Sponsored Links
  3. tapir

    tapir

    Joined:
    22 Mar 2006
    Messages:
    205
    Thanks Received:
    13
    Location:
    Essex
    Country:
    United Kingdom
    These will only detect issues if you've configured them to monitor your router. Usually they're monitoring the PC only.
     
  4. joinerjohn

    joinerjohn

    Joined:
    28 Nov 2009
    Messages:
    6,145
    Thanks Received:
    201
    Location:
    Derby
    Country:
    United Kingdom
    Thanks Tapir, But surely the firewall is monitoring the internet connection which comes through the router. Why would it not pick up this?
     
  5. Monkeh

    Monkeh

    Joined:
    25 Jan 2010
    Messages:
    4,149
    Thanks Received:
    329
    Location:
    Cornwall
    Country:
    United Kingdom
    No, it doesn't work that way. It's monitoring traffic reaching your PC.

    Because it's networking, not magic.

    Frankly this is most likely a false alarm on the part of the router: Consumer equipment has no idea what a DoS looks like, and just normal rapid packet flow triggers these 'warnings'.
     
    • Thanks Thanks x 1
  6. joinerjohn

    joinerjohn

    Joined:
    28 Nov 2009
    Messages:
    6,145
    Thanks Received:
    201
    Location:
    Derby
    Country:
    United Kingdom
    Thanks Monkeh. I take it, this is nothing to be worried about then? ;) ;)
     
  7. Sponsored Links
  8. Monkeh

    Monkeh

    Joined:
    25 Jan 2010
    Messages:
    4,149
    Thanks Received:
    329
    Location:
    Cornwall
    Country:
    United Kingdom
    Let me put it this way.. You're one person, who most likely has never annoyed anyone with the capability or will to perform a DoS attack against you. What are the odds someone would target you?
     
  9. joinerjohn

    joinerjohn

    Joined:
    28 Nov 2009
    Messages:
    6,145
    Thanks Received:
    201
    Location:
    Derby
    Country:
    United Kingdom
    Dunno, some of the topics in GD get a bit heated :LOL: :LOL: :LOL:
    Could be I've upset some cyber terrorists and their getting revenge. ;) ;) ;) ;) ;)
    I'll just wait till my computer blows up again.
    ;) ;)
     
  10. joinerjohn

    joinerjohn

    Joined:
    28 Nov 2009
    Messages:
    6,145
    Thanks Received:
    201
    Location:
    Derby
    Country:
    United Kingdom
    Just out of interest, If I try to connect to the IP address as above, I get the message " Invalid Address, yet if I run the CMD and type in ping 84.53.178.115 I get the results I'd expect from any valid IP address. It pings it and gets the return (average 21ms). Weird. ;) ;)
     
  11. Monkeh

    Monkeh

    Joined:
    25 Jan 2010
    Messages:
    4,149
    Thanks Received:
    329
    Location:
    Cornwall
    Country:
    United Kingdom
    This is because the IP is from a content delivery network (Akamai). The URL is invalid, not the address.
     
Loading...

Share This Page