Solved ~URGENT~ Disguised DoS Attacks?

Discussion in 'Network Help' started by sodapop554, Aug 17, 2012.


Thread Status:
Not open for further replies.
  1. sodapop554 Elite Member

    Elite
    Message Count:
    701
    Likes Received:
    7
    My System
    Loading...
    Starting at 1:00 AM & ending at 2:30 AM my internet was out & from all appearances I assumed that it probably had something to do with the storm we just had that had probably made it's way to my ISP's tower. Out of curiosity even though my modem's "ready" light was still blinking I decided to go ahead & my router back on. Upon logging in I kept getting the following log every few seconds, constantly.

    [Internet connected] IP address: 192.168.100.10 <----This isn't my normal IP that I connect to.

    Naturally the 1st move I should make would be to contact my ISP to verify if they were experiencing problems at that time due to the storm. Unfortunately they don't open until 8:00 AM, so in the mean time so I figured there's no harm in asking some of your opinions in the mean time. My computer itself during this time had "no network access", even though my router kept saying it was connected to the IP above. Also every few seconds my modem's "receive" light would flash a few times as if I were receiving a signal. Is it at all possible someone was DoS attacking me & somehow hiding it behind the "Internet connected" message?


    *IMPORTANT EDIT BELOW:

    Upon just now checking my ZA Free Firewall event logs there was the following one...

    http://fwalerts.zonealarm.com/fwana...1/42dd29501391c05829100cf6&tab=overview&CL=en



    *Notice that the Destination IP is: 255.255.255

    Could this be related to my question above? Is it I should be worried about or is the IP 255.255.255 for my internet connection itself?
  2. Hengis PCHF Manager

    Manager
    PCHF Staff
    Message Count:
    39,406
    Likes Received:
    5,001
    My System
    Loading...
    It's still a "local" IP address. Do an ipconfig /all in command prompt and see what your gateway address is.
  3. 12moon ␛ ␀ ␡

    Elite
    Message Count:
    2,612
    Likes Received:
    380
    My System
    Loading...
    if you are worried about other people connecting to your wireless network, you could
    1. beef up your security
    2. monitor your network with something like Wireless Network Watcher (freeware) - link
  4. Google Advertisement

  5. sodapop554 Elite Member

    Elite
    Message Count:
    701
    Likes Received:
    7
    My System
    Loading...
    If I'm reading command prompt right my Default Gateway is: 192.168.1.1

    Could it be that the IP 192.168.100.10 is for the NETGEAR server or something & the reason why these kept showing up was because my router was attempting to connect to it even though there was no internet access?
  6. Hengis PCHF Manager

    Manager
    PCHF Staff
    Message Count:
    39,406
    Likes Received:
    5,001
    My System
    Loading...
    192.168... is a Class-C IP address, and is not routable. Does the 192.168.100.xxx address appear in the results of "ipconfig /all"?
  7. sodapop554 Elite Member

    Elite
    Message Count:
    701
    Likes Received:
    7
    My System
    Loading...
    No the IP 192.168.100 doesn't show up in that list at all.
  8. Hengis PCHF Manager

    Manager
    PCHF Staff
    Message Count:
    39,406
    Likes Received:
    5,001
    My System
    Loading...
    Well personally, first off, I wouldn't worry about it - wait and see if any of the more "home network" talented members can give you a better insight.
  9. sodapop554 Elite Member

    Elite
    Message Count:
    701
    Likes Received:
    7
    My System
    Loading...
    Alright thanks, I will also update my original post with some new information that may or may not be helpful.
  10. 12moon ␛ ␀ ␡

    Elite
    Message Count:
    2,612
    Likes Received:
    380
    My System
    Loading...
    One security tip is to change the default settings of your router and implement ip/mac address filtering.
    You dont have to use 192.168.0.0/24, if your network only has a few computers and other ip devices try a smaller, more obscure network e.g. 192.168.177.240/27
    Don't broadcast the SSID.
    Change the WPA2 security key occassionally.
    The default firewall settings of your home router should only allow established traffic making it pretty difficult for someone or some website to initiate a connection from an external network. (Unless they had your login credentials).
    What is the model of your router?
  11. sodapop554 Elite Member

    Elite
    Message Count:
    701
    Likes Received:
    7
    My System
    Loading...
    Alright I just disabled the SSID broadcast for both the Wireless Settings & Guest Network, that's how it should be right?

    The router model is NETGEAR WNR1000v3, N150 Wireless Router.
  12. sodapop554 Elite Member

    Elite
    Message Count:
    701
    Likes Received:
    7
    My System
    Loading...
    Well now I have another rather disturbing update & I'm not sure how to take it. I just called my ISP & asked them if they were experiencing any down time during the time period in which my internet was out. They said no, although he did say that it could've been caused by some interference on my end. I have no clue how that could've happened, I really just hope that someone didn't figure out how to Ddos me & remain undetected by my router.
  13. Crush Administrator & Security Team Leader

    Manager
    PCHF Staff
    Message Count:
    39,884
    Likes Received:
    3,657
    My System
    Loading...
    Another layer of security, within your router you can set your policy to block certain traffic protocols, but as we've said its nothing to worry about, due to the nature of the internet you will see these kinds of connections all the time
  14. sodapop554 Elite Member

    Elite
    Message Count:
    701
    Likes Received:
    7
    My System
    Loading...
    Well the only option to "block" anything on my own are "blocked sites", is this what you mean?

    P.S: Was it right of me to disable the SSID broadcast for both my wireless & guest networks as 12moon suggested?
  15. Crush Administrator & Security Team Leader

    Manager
    PCHF Staff
    Message Count:
    39,884
    Likes Received:
    3,657
    My System
    Loading...
    Yes that's fine

    No, sometimes there will be an option to restrict protocols. But if you don't know what you're doing you may end up breaking your wireless
  16. 12moon ␛ ␀ ␡

    Elite
    Message Count:
    2,612
    Likes Received:
    380
    My System
    Loading...
    the official microsoft line
    to my surprise, it actually agrees with you

~URGENT~ Disguised DoS Attacks?

Thread Status:
Not open for further replies.