DrayTek UK Users' Community Forum

Help, Advice and Solutions from DrayTek Users

Am I Under Attack?

  • wildwalker
  • Topic Author
  • Offline
  • Junior Member
  • Junior Member
More
26 Feb 2013 11:36 #75339 by wildwalker
Am I Under Attack? was created by wildwalker
Hello all,

  • 2013/02/26 11:19:13 -- [DOS][Block][trace_route][81.145.150.253:60217->217.155.64.19:33434][UDP][HLen=20, TLen=71]2013/02/26 11:19:14 -- [DOS][Block][trace_route][81.145.150.253:60217->217.155.64.19:33434][UDP][HLen=20, TLen=72]2013/02/26 11:19:15 -- [DOS][Block][trace_route][81.145.150.253:60217->217.155.64.19:33434][UDP][HLen=20, TLen=73]2013/02/26 11:19:16 -- [DOS][Block][trace_route][81.145.150.253:60217->217.155.64.19:33434][UDP][HLen=20, TLen=74]2013/02/26 11:19:17 -- [DOS][Block][trace_route][81.145.150.253:60217->217.155.64.19:33434][UDP][HLen=20, TLen=75]2013/02/26 11:22:03 -- [DOS][Block][trace_route][178.78.121.130:51760->217.155.64.19:33434][UDP][HLen=20, TLen=71]2013/02/26 11:22:04 -- [DOS][Block][trace_route][178.78.121.130:51760->217.155.64.19:33434][UDP][HLen=20, TLen=72]2013/02/26 11:22:05 -- [DOS][Block][trace_route][178.78.121.130:51760->217.155.64.19:33434][UDP][HLen=20, TLen=73]


I have been getting emails from my router every 10 to 15 minutes that look like the log above
sorry about the formatting

I only enabled DoS Defense yesterday, I used the Select All Option.

I have been getting these all day and night, always to 217.155.64.19, from differing addresses.

Any help greatly appreciated
Alan.

Please Log in or Create an account to join the conversation.

More
26 Feb 2013 12:45 #75344 by sicon
Replied by sicon on topic Re: Am I Under Attack?
Some ISPs run a constant Trace route to your external IP, have you checked where that IP address is?

Please Log in or Create an account to join the conversation.

  • wildwalker
  • Topic Author
  • Offline
  • Junior Member
  • Junior Member
More
26 Feb 2013 12:51 #75345 by wildwalker
Replied by wildwalker on topic Re: Am I Under Attack?
No, but to be fair, these are not the only addresses.

I will have a check, I wasnt sure if a traceroute would show up as a DoS attack?

Alan.

Please Log in or Create an account to join the conversation.

More
26 Feb 2013 12:59 #75346 by sicon
Replied by sicon on topic Re: Am I Under Attack?
Yup, any trace route will show up. Under DOS there is a tick box for it.

Please Log in or Create an account to join the conversation.

  • wildwalker
  • Topic Author
  • Offline
  • Junior Member
  • Junior Member
More
26 Feb 2013 13:08 #75348 by wildwalker
Replied by wildwalker on topic Re: Am I Under Attack?
OK, I will definately check,thank you.

Just a quick question if I may, I have a small subnet from my ISP, and at least 3 are in permanent use, would they not scan all of them?

Alan.

Please Log in or Create an account to join the conversation.

  • wildwalker
  • Topic Author
  • Offline
  • Junior Member
  • Junior Member
More
26 Feb 2013 15:10 #75355 by wildwalker
Replied by wildwalker on topic Re: Am I Under Attack?
So here is the activity from the last hour:

195.188.217.194 213-48-75-26-bra.dial.cable.virginmedia.com [213.48.75.26]


178.78.121.130 ftip003170588.vhsaccess1.birmingham.fixed-nte.btnet [81.134.229.94]


81.145.150.252 ftip003269664.acc2.kingston.21cn-nte.bt.net [81.147.48.77]


83.100.145.205 ge-3-0-2.er10.the.ipc.kcom.com [195.66.236.119]


81.145.150.250 ftip003269664.acc2.kingston.21cn-nte.bt.net [81.147.48.77]


83.100.145.195 ge-3-0-2.er10.the.ipc.kcom.com [195.66.236.119]


83.100.145.194 ge-3-0-2.er10.the.ipc.kcom.com [195.66.236.119]

Should I start ringing ISPs and asking them WTF? or will they just say its not down to them what their users are doing?

Alan.

Please Log in or Create an account to join the conversation.

Moderators: ChrisSami