Windows 7 - Multiple DoS Attacks

Infinite · 02-04-2012

Hi Guys, I have just had a look at my Router settings from 192.168.0.1 and it shows multiple DoS (Denial Of Service) Attacks from different IP's.

Code:

[DoS attack]from source:41.232.151.64, destination source:192.168.0.2 LEN=131 TOS=0x00 PREC=0x00 TTL=111 ID=8169 PROTO=UDP SPT=50774 DPT=56669  - Fri, 2012-02-03 19:30:58
[DoS attack]from source:111.251.185.70, destination source:192.168.0.2 LEN=129 TOS=0x00 PREC=0x00 TTL=109 ID=17904 PROTO=UDP SPT=24580 DPT=56669  - Fri, 2012-02-03 19:30:59
[DoS attack]from source:111.251.185.70, destination source:192.168.0.2 LEN=129 TOS=0x00 PREC=0x00 TTL=109 ID=17926 PROTO=UDP SPT=24580 DPT=56669  - Fri, 2012-02-03 19:31:00
[DoS attack]from source:188.27.37.114, destination source:192.168.0.2 LEN=58 TOS=0x00 PREC=0x00 TTL=115 ID=5667 PROTO=UDP SPT=50803 DPT=56669  - Fri, 2012-02-03 19:31:00
[DoS attack]from source:188.244.45.231, destination source:192.168.0.2 LEN=58 TOS=0x00 PREC=0x00 TTL=111 ID=28604 PROTO=UDP SPT=1034 DPT=56669  - Fri, 2012-02-03 19:31:00
[DoS attack]from source:82.36.113.84, destination source:192.168.0.2 LEN=52 TOS=0x00 PREC=0x00 TTL=112 ID=5826 DF PROTO=TCP SPT:62778 DPT:56669 WINDOW=8192 RES=0x00 SYN URGP=0  - Fri, 2012-02-03 19:31:00
[DoS attack]from source:188.244.45.231, destination source:192.168.0.2 LEN=52 TOS=0x00 PREC=0x00 TTL=111 ID=28602 DF PROTO=TCP SPT:64002 DPT:56669 WINDOW=8192 RES=0x00 SYN URGP=0  - Fri, 2012-02-03 19:31:00
[DoS attack]from source:111.251.185.70, destination source:192.168.0.2 LEN=129 TOS=0x00 PREC=0x00 TTL=109 ID=17963 PROTO=UDP SPT=24580 DPT=56669  - Fri, 2012-02-03 19:31:00
[DoS attack]from source:188.237.80.47, destination source:192.168.0.2 LEN=134 TOS=0x00 PREC=0x00 TTL=109 ID=42179 PROTO=UDP SPT=10000 DPT=56669  - Fri, 2012-02-03 19:31:00
[DoS attack]from source:111.251.185.70, destination source:192.168.0.2 LEN=129 TOS=0x00 PREC=0x00 TTL=109 ID=18123 PROTO=UDP SPT=24580 DPT=56669  - Fri, 2012-02-03 19:31:00
[DoS attack]from source:92.114.190.144, destination source:192.168.0.2 LEN=134 TOS=0x00 PREC=0x00 TTL=110 ID=16273 PROTO=UDP SPT=59440 DPT=56669  - Fri, 2012-02-03 19:31:00
[DoS attack]from source:111.251.185.70, destination source:192.168.0.2 LEN=129 TOS=0x00 PREC=0x00 TTL=109 ID=18129 PROTO=UDP SPT=24580 DPT=56669  - Fri, 2012-02-03 19:31:00
[DoS attack]from source:111.251.185.70, destination source:192.168.0.2 LEN=129 TOS=0x00 PREC=0x00 TTL=109 ID=19140 PROTO=UDP SPT=24580 DPT=56669  - Fri, 2012-02-03 19:31:04

I do not have much experience with Routers/Networks, so I need help blocking these or removing them.

I have a NETGEAR DGN1000SP Router with Virgin Media 10MB/s Internet.

I have 1 Netbook, 2 PC's and a iPhone. But I only use 1 PC and my iPhone. My family uses the other 2 computers.

I have installed MSE, Malwarebytes, and Comodo Firewall on the Netbook and 1 PC. Have not done it to the other PC yet, and I don't really need to do anything to my iPhone.

seavixen32 · 02-04-2012

The first thing you need to do is contact your ISP as their servers may have been compromised.

Virgin Media should help and advise as to what you can do, but you may have to upgrade your hardware.

Have a look at this article, which describes the different ways these DoS attacks work and possible solutions to get them stopped.

How to Prevent Denial of Service Attacks : Learn-Networking.com

This Wiki article has loads of useful information too.

http://en.wikipedia.org/wiki/Denial-of-service_attack

A Guy · 02-05-2012

This is apparently not uncommon with Netgear routers. I suspect it is very common, but only Netgear routers are storing them as DOS attacks. They can be random port scans. I would think you will be protected by the NAT firewall in any case. I agree with seavixen32, ask your ISP about it, if they agree it is not an issue, I think you are ok. You could not prevent a DOS from your end anyway, that is a server/ISP issue. If they were being attacked, and their bandwidth compromised, they would be all over it. A Guy

Infinite · 02-05-2012

Thanks for the help guys, I will contact my ISP as soon as I can.

seavixen32 · 02-05-2012

You're very welcome.

Do let us know what they say as it'll be interesting to know if they take it seriously.

Windows 7 - Multiple DoS Attacks

Multiple DoS Attacks problems?