Router logs showing DoS attacks

[realrhyno]

Hey guys.

I've noticed in the mornings lately when I get up around 6 am my internet will not work. Not on wireless or on my desktop. I decided I'd log into the router to see if there was a firmware update or anything. I had checked the logs and there are quite a few entries relating to DoS. I googled around and saw that it could be some sort of packet loss and the router is mistaking it for some sort of DoS attack. And that due to it not showing up multiple times every second it likely isn't a DoS attack. Here is a few from the logs:

[DoS Attack: ACK Scan] from source: 23.3.68.62, port 1935, Thursday, September 13,2012 08:34:33
[DoS Attack: ACK Scan] from source: 69.147.86.184, port 80, Thursday, September 13,2012 07:36:32
[DoS Attack: ACK Scan] from source: 206.217.136.242, port 80, Thursday, September 13,2012 07:16:21
[DoS Attack: ACK Scan] from source: 206.217.136.242, port 80, Thursday, September 13,2012 07:15:09
[DoS Attack: ACK Scan] from source: 206.217.136.242, port 80, Thursday, September 13,2012 06:37:22

[DoS Attack: RST Scan] from source: 10.13.244.96, port 9953, Wednesday, September 12,2012 23:38:02
[DoS Attack: RST Scan] from source: 10.13.244.108, port 9953, Wednesday, September 12,2012 22:14:40
[DoS Attack: RST Scan] from source: 10.13.244.52, port 9953, Wednesday, September 12,2012 17:25:37

To get my internet to work I changed from a static IP to a dynamic IP in my router and it got the internet back to working properly yesterday. I also ran malwarebytes on both computers on my network and it came up with both being clean. Just now checked and saw these just now. Was hoping maybe someone could give me any information on what they suggest for this problem or if they have had any similar experiences.

 

[ex_bubblehead]

If that's all there is I wouldn't worry about it. Looks like nothing more than "script kiddies" trolling for targets.

 

[bill001g]

The problem you most likely had was someone else was using the same IP as you. Depends how your ISP assigns static IP. If they told you that was your ip then you need to talk to them why someone else could use it. If they did not assign it to you then you will have problems like that.

You will always get some junk traffic from the internet. The ones to port 80 are people attempting to hack any web server you have, port 1935 is related to adobe flash in a lot of cases. The other ones from 10. address are completely invalid and your ISP should have dropped them. More than likely they come from someone within the same ISP as you use and the ISP does not prevent spoofing of source IP.

 

[realrhyno]

[DoS Attack: TCP/UDP Chargen] from source: 109.200.206.189, port 58473, Thursday, September 13,2012 12:27:31
[DoS Attack: ACK Scan] from source: 23.3.68.63, port 1935, Thursday, September 13,2012 12:25:00
[DoS Attack: ACK Scan] from source: 23.3.68.14, port 1935, Thursday, September 13,2012 12:11:31
[DoS Attack: RST Scan] from source: 10.13.244.38, port 9953, Thursday, September 13,2012 11:25:50

Those are some more recent ones that I just saw when I logged back into my router to check.

Would you guys suggest I call my ISP or just ignore these things?

 

[ex_bubblehead]

They are few and from different addresses. I'd just ignore them. Now if you start to see an increase and the traffic seems to eminate from the same sources then you might want to alert your ISP.