2

In my (netgear) routers logs there are entries like the following, often multiple times a second since quite some time.

[DoS Attack: RST Scan] from source: 80.218.64.172, port 10646, Tuesday, September 29, 2015 10:33:01

The IP-Address is always the same and is registered to a provider different from the one I'm currently using (Information by ip-lookup.net). The port is usually not the same, but something in the 10000-20000 range.

My internet speed is really slow, but I don't think it has anything to do with that, and more with the fact that I live on the countryside.

  • Is this something I should be worried about?
  • Should I contact them (supposed source of the supposed attack)?

Edit:

I've read that torrent-services might be detected by the router as Dos-Attacks. I'm stopping all torrenting activites right now, to see if it was that.

More info

I have stopped all torrents, but these requests keep appearing.

I have now also gotten a new IP-Address, but soon after the router was switched on again, it started again. Same IP, same port-range.

Community
  • 1
Marius Schär
  • 181
  • 6
  • Did you try Googling? http://www.tomshardware.com/answers/id-2439113/constant-dos-attacks-netgear-log.html and http://forums.xfinity.com/t5/Security-and-Anti-Virus/What-is-a-DoS-Attack-RST-Scan/td-p/1284089 and https://community.netgear.com/t5/Wired-Routers/Dos-attack/td-p/423857 and http://www.computing.net/answers/security/log-entry-on-router-has-dos-attack-rst-scan-what-is-it/39084.html – feral_fenrir Sep 29 '15 at 13:16
  • @feral_fenrir yes, I've seen those pages, but stopping all torrenting activity has not had any effect. – Marius Schär Sep 29 '15 at 13:59
  • If your ISP is assigning Dynamic Public IP addresses, you can try one of the suggestions given in the links: Switch off the router overnight to get a new IP address assigned. – feral_fenrir Sep 29 '15 at 14:01
  • @feral_fenrir I will try this tonight and report back, but I'm fairly sure I get a new IP almost daily. – Marius Schär Sep 29 '15 at 14:05
  • @feral_fenrir I have gotten a new IP, but it did not affect the situation. – Marius Schär Oct 01 '15 at 07:50
  • Have you tried resetting your modem and router, – Nikhil_CV Oct 01 '15 at 08:19
  • @Nikhil_CV as in Factory-Reset and set up again? – Marius Schär Oct 01 '15 at 08:32
  • If that's not inconvenient. I have occasionally seen this problem with netgear logs. Some went away after factory reset. – Nikhil_CV Oct 01 '15 at 08:39
  • Make sure you have the latest firmware for your netgear as well. There have been a number of significant security issues identified with some netgear models over the last few months. Note also that once you stop any bittorrent service you have running, it can take a little time before other clients stop trying to contact your client. If the issue continues and your concerned, contact your ISP. – Tim X Oct 02 '15 at 04:06

0 Answers0