DDoS attacks on my Netgear C7000

JayKe_23

Commendable
Oct 5, 2016
3
0
1,510
I recently switched ISPs from AT&T to Cox Comm. They required me to purchase a router suitable for web-based business management. I now own a Netgear AC1900 Wi-Fi Cable Modem Router C7000.

My issue is that on my Netgear Event Logs, these appear:


  • [DoS Attack: Ping Of Death] from181.0.163.0, Port 0.
    [DoS Attack: TCP- or UDP-Based Port Scan] from (Primary DNS Gateway), Port 53
    [DoS Attack: TCP- or UDP-Based Port Scan] from (Secondary DNS Gateway), Port 53
    [DoS Attack: Teardrop or derivative] from 181.0.163.0, Port 0.
    [DoS Attack: Ping Of Death] from181.0.163.0, Port 0.

181.0.163.0 is from a net.ar (from Argentina)

I have called my ISP and have done a remote reset and an Update of Service to change my DNS/DHCP/Gateway/IP etc. Then, they advised me to consult Netgear Tech Support for further issue resolution.

(This isn't bashing Netgear Tech Support, but this is their exact advice suggested to my issue.)

I called Netgear Tech Support and advised me to "contact your device support". From my interpretation, I have to call Apple Customer support, Playstation Network Support and my desktop/laptop device support.

This has been happening to me for the past month and I never bothered to go down the rabbit's hole.

Any advice would be much appreciated.
 
Solution
In many cases these are false reports by the router. Most cause little to no problems because the router knows they are attacks and is configured to not be affected by them. The actually attacks that cause a issue are flooding type attacks where someone is sending excessive amounts of data.

They really should label these as attempted hacking rather than Dos.

It depends how much these happen. The ones that cause issues you will see mutltiple per second for long periods of time.

A few messages here and there spread over many minutes is very common and routers should just put that in the catagory as standard noise you see on all connections.
In many cases these are false reports by the router. Most cause little to no problems because the router knows they are attacks and is configured to not be affected by them. The actually attacks that cause a issue are flooding type attacks where someone is sending excessive amounts of data.

They really should label these as attempted hacking rather than Dos.

It depends how much these happen. The ones that cause issues you will see mutltiple per second for long periods of time.

A few messages here and there spread over many minutes is very common and routers should just put that in the catagory as standard noise you see on all connections.
 
Solution