All of a sudden (since yesterday morning, Saturday 5th Aug) I am getting reports from a BX2000 (which I use for its VOIP features) like the following:
2023/08/05 16:04:45 -- [DOS][Block][ip_options, option=router_alert][169.254.128.177->224.0.0.251][2][HLen=24, TLen=32]
2023/08/05 16:05:13 -- [DOS][Block][ip_options, option=router_alert][169.254.128.177->224.0.0.251][2][HLen=24, TLen=32]
2023/08/05 16:05:37 -- [DOS][Block][ip_options, option=router_alert][169.254.128.177->224.0.0.251][2][HLen=24, TLen=32]
2023/08/05 16:06:04 -- [DOS][Block][ip_options, option=router_alert][169.254.128.177->224.0.0.251][2][HLen=24, TLen=32]
2023/08/05 16:06:33 -- [DOS][Block][ip_options, option=router_alert][169.254.128.177->224.0.0.251][2][HLen=24, TLen=32]
2023/08/05 16:07:01 -- [DOS][Block][ip_options, option=router_alert][169.254.128.177->224.0.0.251][2][HLen=24, TLen=32]
2023/08/05 16:07:24 -- [DOS][Block][ip_options, option=router_alert][169.254.128.177->224.0.0.251][2][HLen=24, TLen=32]
As you can see this is something which recurs roughly every 25 seconds and seems to be categorised by the router as a DOS attack.
The two IP addresses are maybe a pointer to the nature of this in that one is a self-assigned address and the other is a multicast IP address used for Bonjour discovery. My working hypothesis is that there is a device on the LAN which has picked up a self-assigned address for some reason and is trying to find a Bonjour-advertising device on the network.
I am not aware of any device on the LAN which has a self-assigned address - could this be a sign of malware, or has anyone seen this behaviour before and can give me a pointer to a known cause?
