Hundreds of TCP FIN scans while playing leagueoflegends causing lag.

Domenique01 · 13 Jul 2013

Hello,

I have been playing a game (League of Legends) for a long time. When I start playing I get insane lag, of course I checked all the troubleshooting on the games forums and tried (almost) all the solutions. Nothing worked.
Today I decided to look into my routers logs, this (see beneath) showed up during the game, and stopped immediately after ending the game. Ill post a short version of the log, otherwise this thread will look awful.

07/12/2013 23:11:55 **TCP FIN Scan** 85.181.210.124, 65003->> 192.168.2.10, 57058 (from ATM1 Inbound)
07/12/2013 23:11:55 **TCP FIN Scan** 88.180.185.159, 61388->> 192.168.2.10, 57058 (from ATM1 Inbound)
07/12/2013 23:11:55 **TCP FIN Scan** 2.11.48.117, 63417->> 192.168.2.10, 57058 (from ATM1 Inbound)
07/12/2013 23:11:55 **TCP FIN Scan** 90.194.97.66, 58752->> 192.168.2.10, 57058 (from ATM1 Inbound)
07/12/2013 23:11:55 **TCP FIN Scan** 188.64.36.169, 62702->> 192.168.2.10, 57058 (from ATM1 Inbound)
07/12/2013 23:11:55 **TCP FIN Scan** 188.82.224.241, 58390->> 192.168.2.10, 57058 (from ATM1 Inbound)
07/12/2013 23:11:55 **TCP FIN Scan** 95.34.148.81, 60873->> 192.168.2.10, 57058 (from ATM1 Inbound)
07/12/2013 23:11:55 **TCP FIN Scan** 62.16.143.136, 55252->> 192.168.2.10, 57058 (from ATM1 Inbound)
07/12/2013 23:11:55 **TCP FIN Scan** 88.161.199.48, 59859->> 192.168.2.10, 57058 (from ATM1 Inbound)
07/12/2013 23:11:55 **TCP FIN Scan** 83.254.212.226, 56239->> 192.168.2.10, 57058 (from ATM1 Inbound)
07/12/2013 23:11:55 **TCP FIN Scan** 84.86.28.104, 64540->> 192.168.2.10, 57058 (from ATM1 Inbound)
07/12/2013 23:11:55 **TCP FIN Scan** 90.22.62.89, 56845->> 192.168.2.10, 57058 (from ATM1 Inbound)
07/12/2013 23:11:55 **TCP FIN Scan** 149.172.46.48, 60235->> 192.168.2.10, 57058 (from ATM1 Inbound)
07/12/2013 23:11:55 **TCP FIN Scan** 91.91.185.33, 1420->> 192.168.2.10, 57058 (from ATM1 Inbound)

This happens every second of playing, more than 20 incoming scans per second.
All targeted at a local IP address not in use.
When using a random IP-lookup site all the IP's seem to come from Europe.
It even looks like it is all from EU-west, the server where I'm playing.

Please help, its something I've never seen before. And I cannot find alot about TCP FIN scans.

diplo · 16 Jul 2013

It's hard to say whether this is malicious or a false positive. To me it seems less likely that it's a distributed scanning attack and more likely that something is trying to close a connection. Here's some of what's happening during a FIN handshake. This article by Novell briefly touches on what a FIN scan does. Can you delete the DHCP lease going to the local IP in an attempt to stop it? Can you be sure that there are no other machines on your network that could be responsible for this traffic? If you are able or willing to do a factory reset on your router, this could be a step worth taking and go from there.

Domenique01 · 22 Jul 2013

If did not receive any other "FIN scans" so I guess my problem is over.
I could not find where to delete the lease going to the local IP, but it expired automatically after 24 hours.
Also I did reset the router to factory settings because there were multiple problems at the same time, most of them are over now!

I'll mark this as solved