"UDP Flood to Host" Belkin N300 losing internet connectivity every 2-10 minutes when browsing

[Akaelae]

Model of desktop: Custom desktop
Make and model of router: Belkin N300 (up to date firmware)
Make and model of modem: Cisco DPQ3212
PC Specifications: CPU i5-4690K stock clocks
GPU: Sapphire R9 290 BF4 Edition
Mobo: EVGA Z87 FTW 141-HW-E877-RX
PSU: EVGA SuperNOVA NEX750G 120-PG-0750-GR
OS & Driver version: Windows 10 Build 9926
Model of USB wifi adapter: Alpha AWUS036H

ISP & connection type: Cox communications, WIFI and ethernet
Number of connections: 3-7 at any given time, 2 desktops, 2 laptops, and 3 smart phones.

I'm having this problem with both my wifi and Ethernet connections where my internet just cuts out across all devices for several minutes or until I reboot my router. The router is brand new replacement for an old netgear router that fried and the new router started having problems within days. I've called my ISP and they insist theres nothing wrong with the modem they provided. When the internet cuts out I get no icon or any sort of prompt indicating that the internet is out or having problems on my desktop/laptop, however I do get a "this page cannot be displayed" and if someone is streaming their streaming connection cuts out.

I notice it happening most often when browsing webpages before it kicks everyone offline. If people in the house are only streaming or gaming the connection is fine. My router appears to absolutely hate webpages.

Here is a recent firewall security log, the log coincides with the disconnects. The log is usually clear when nobody has used the internet, it's only when we're home that the problem occurs. I've read somewhere that the firewall senses an x number of connections before flagging them as a DDoS? Is that what I'm seeing here?



06/08/2015 17:28:07 **UDP Flood to Host** xx.x.xxx.xxx, 44552->> xx.xxx.xx.xx, 53 (from WAN Outbound)
06/08/2015 17:28:07 **UDP Flood to Host** xx.x.xxx.xxx, 44552->> xx.xxx.xx.xx, 53 (from WAN Outbound)
06/08/2015 14:00:10 **UDP Flood to Host** xx.x.xxx.xxx, 44808->> xx.xxx.xx.xx, 53 (from WAN Outbound)
06/08/2015 14:00:10 **UDP Flood to Host** xx.x.xxx.xxx, 44808->> xx.xxx.xx.xx, 53 (from WAN Outbound)
06/08/2015 13:45:35 **UDP Flood to Host** xx.x.xxx.xxx, 45064->> xx.xxx.xx.xx, 53 (from WAN Outbound)
06/08/2015 13:45:35 **UDP Flood to Host** xx.x.xxx.xxx, 45064->> xx.xxx.xx.xx, 53 (from WAN Outbound)
06/08/2015 13:29:29 **UDP Flood to Host** xx.x.xxx.xxx, 45320->> xx.xxx.xx.xx, 53 (from WAN Outbound)
06/08/2015 13:29:29 **UDP Flood to Host** xx.x.xxx.xxx, 45320->> xx.xxx.xx.xx, 53 (from WAN Outbound)

 

[RaDiKaL_]

53 is DNS port, could be a MITM (man in the middle) attempt of attack trying to replace the DNS server you're using with another one, in any case I'd start scanning the host that is the target of these attacks to make sure is not infected (run your antivirus + malwarebytes).

Another option you could try is to change your current DNS server to another like Google's: 8.8.8.8

 

[Akaelae]

I've run AVG, malwarebytes, and super anti spyware. So far every thing has come up clean, I've even isolated my router so it has only my desktop connected to it.


How exactly do I change my DNS sever?

 

[RaDiKaL_]

Control Panel->Network and Sharing Center->Change adapter settings->double click on your NIC->properties->select "Internet Protocol v4"->properties->Use the following DNS Addresses-> finally set the primary DNS to: 8.8.8.8

 

[Akaelae]

Control Panel->Network and Sharing Center->Change adapter settings->double click on your NIC->properties->select "Internet Protocol v4"->properties->Use the following DNS Addresses-> finally set the primary DNS to: 8.8.8.8

Thanks! That appears to have fixed it, no more udp floods. At least for now.

 

[Akaelae]

I just got a rather interesting security log from my router after being knocked off the internet completely, I'm now being UDP flooded from the Google DNS address I was using. I switched it to the alternate Google DNS address available and that solved it for now, but I can't help but feel I'm being targeted or something. I've also just done a format of my disks then a clean install of windows prior to swapping my DNS so I know my PC is clean.

 

[RaDiKaL_]

hmm perhaps it's your ISP the one being targeted, since the original flood came from their DNS server, such case you can't do nothing but to wait for them to handle the issue.

Perhaps your router has some additional option for treating Flood attacks, see if you find something related to it and see how it behaves enabling it.