DrayTek UK Users' Community Forum

Help, Advice and Solutions from DrayTek Users

[dos][block][tcp_flag, scanner=synfin_scan] = ??

  • dottedquad
  • Topic Author
  • Offline
  • Junior Member
  • Junior Member
More
20 Feb 2012 20:06 #71286 by dottedquad
I'm getting the following output from my vigor 2820n syslog:

[dos][block][tcp_flag, scanner=synfin_scan][122.248.212.202:0->:0][tcp][hlen=20, tlen=60, flag=uspaf, seq=1498319399, ack=0, win=6667]

This was repeated 3 or 4 times at intervals of 25-30 mins.

According to dns.l4x.org, 122.248.212.202 belongs to "Amazon Web Services, Elastic Compute Cloud, EC2, SG".

Is the modem claiming to detect a dos attack on my external address orginating from an Amazon server farm?

Anyone care to comment?

Please Log in or Create an account to join the conversation.

Moderators: ChrisSami