Ask a question

Reply
Posted Sep 13, 2011
5:18:09 PM
View profile
Past month DoS Attacks: RST/ACK Scans

I've noticed every 2-10 seconds I get this showing up in my router log. After it does this for about an hour my internet speed decreases and my upload speed becomes shockingly low too.

 

my 40kb upload speed becomes 10 and my download speed that is normally 800-850kb becomes 400.

 

I've noticed the only time it does this when these attack scans keep occuring. so I did some IP lookup and tracebacks and it resulted from some in France, some in Germany etc..

 

Please, what do I do and who do I report these scans containing the IP and port number being used during the scan including the time frame down to the second and dates?

Past month DoS Attacks: RST/ACK Scans

4,746 views
16 replies
(0) Me too
(0) Me too
Post reply
View all replies
(16)
0
(0)
  • Rate this reply
View profile
Sep 13, 2011 9:01:28 PM
0
(0)
Teacher
couldn't find an update/edit button. but let me also include...

I'm concerned about this because I'm a PC gamer that is tech savvy and I know for a fact that a slow upload speed effects your gaming performance because you send more information out then what you receive...depending on the game.

I'm a long time DSL user.. since before it was called at&t where I live.. it was Bellsouth DSL, have been a customer for over 20 years and even have cellphones with At&t.. so please reply with an answer to a loyal customer...

Re: Past month DoS Attacks: RST/ACK Scans

2 of 17 (4,734 Views)
0
(0)
  • Rate this reply
View profile
Sep 15, 2011 1:09:03 PM
0
(0)
Teacher

Well I posted it here: http://forums.att.com/t5/Internet/Past-month-DoS-Attacks-RST-ACK-Scans/td-p/2861821

 

But I'll post it here too since this is a support question...

 

I've noticed every 2-10 seconds I get this showing up in my router log. After it does this for about an hour my internet speed decreases and my upload speed becomes shockingly low too.

 

my 40kb upload speed becomes 10 and my download speed that is normally 800-850kb becomes 400.

 

I've noticed the only time it does this when these attack scans keep occuring. so I did some IP lookup and tracebacks and it resulted from some in France, some in Germany etc..

 

Please, what do I do and who do I report these scans containing the IP and port number being used during the scan including the time frame down to the second and dates?

 

I'm concerned about this because I'm a PC gamer that is tech savvy and I know for a fact that a slow upload speed effects your gaming performance because you send more information out then what you receive...depending on the game.

I'm a long time DSL user.. since before it was called at&t where I live.. it was Bellsouth DSL, have been a customer for over 20 years and even have cellphones with At&t.. so please reply with an answer to a loyal customer... 



HELP! Past month DoS Attacks: RST/ACK Scans

3 of 17 (4,726 Views)
0
(0)
  • Rate this reply
View profile
Sep 27, 2011 10:06:09 PM
0
(0)
Teacher

still waiting for help...

Re: HELP! Past month DoS Attacks: RST/ACK Scans

4 of 17 (4,656 Views)
0
(0)
  • Rate this reply
View profile
Oct 14, 2011 6:03:01 PM
0
(0)
Teacher
still waiting for a reply from a SUPPORT TEAM MEMEBER... grr this is getting annoying... here is the type I'm getting. [DoS Attack: RST Scan] from source: 66.188.109.195, port 3083, Thursday, September 15,2011 18:21:05 [DoS Attack: RST Scan] from source: 24.142.74.135, port 62036, Thursday, September 15,2011 18:18:18 [DoS Attack: RST Scan] from source: 74.136.84.6, port 64560, Thursday, September 15,2011 18:17:35 [DoS Attack: RST Scan] from source: 206.54.200.202, port 49872, Thursday, September 15,2011 18:15:08 [DoS Attack: RST Scan] from source: 74.90.46.189, port 52007, Thursday, September 15,2011 18:08:44 [DoS Attack: RST Scan] from source: 67.237.175.218, port 18759, Thursday, September 15,2011 18:07:48 [DoS Attack: RST Scan] from source: 74.90.46.189, port 51964, Thursday, September 15,2011 18:07:32 I have MANY lines spamming this with different ips and ports.. so what the crap ;o

Re: HELP! Past month DoS Attacks: RST/ACK Scans

5 of 17 (4,606 Views)
0
(0)
  • Rate this reply
View profile
Oct 15, 2011 8:16:09 AM
0
(0)
ACE - Master

That is just your routers firewall telling you it's doing it's job. Everyone gets probed, as long as the router continues to block the attacks it should not be an issue. The reboots could be it's way of getting a new IP address, which is what I would do, change the IP address by disconnecting and reconnecting. That being said, if your are getting a new IP address and the attacks start back almost immediately, then I would think you have some type of malware (virus) on one of your computers that is reporting your new IP addtress back to some nefariuos server somewhere overseas.

 

 

 

 

 

 




__________________________________________________________
How can you be in two places at once, when your not anywhere at all?
------------------------------------------------------------------------------------------------------
I really want to become a procrastinator, but I keep putting it off.
------------------------------------------------------------------------------------------------------
There are three kinds of people, those that can count, and those that can't.
------------------------------------------------------------------------------------
“Our great democracies still tend to think that a stupid man is more likely to be honest than a clever man, and our politicians take advantage of this prejudice by pretending to be even more stupid than nature has made them." :Bertrand Russell

                               neon_sign.jpg

*The views and opinions expressed on this forum are purely my own. Any product claim, statistic, quote, or other representation about a product or service should be verified with the manufacturer, provider, or party.

Re: HELP! Past month DoS Attacks: RST/ACK Scans

6 of 17 (4,590 Views)
Highlighted
0
(0)
  • Rate this reply
View profile
Oct 15, 2011 9:18:03 AM
0
(0)
Teacher
I highly doubt that since the beginning of this year it never did this and middle of the year when it started doing this my 6mbps line that downloads at 800kb/s drops down to 130 or so, my jitter increases my ping rate increases by about 30 and sometimes it disconnects the modem. Happens more often around 6pm-4am central time. My system is a complete fresh install of Windows 7 Home premium 64bit. It comes back almost immediately after fresh IP renewal, I've checked that while I've been waiting and monitored that. its hammering my modem/router which after about 8 hours of doing so my internet slows dramatically down and before I converted it over to ipv6 it would disconnect me every 4 hours and started having the run around game of off on off on with only a gap of 6-10 minutes of being online and about 5-20 of being offline, max 1 hour. Main line which our internet pulls from is about 6 years old and was a fresh fiber optics line that my uncle installed for AT&T. Booster is within half a mile from where I live so I shouldn't be experiencing much (if any) drop in speed, also live in a fairly Rural area.

Re: HELP! Past month DoS Attacks: RST/ACK Scans

7 of 17 (4,587 Views)
0
(0)
  • Rate this reply
View profile
Oct 15, 2011 3:16:07 PM
0
(0)
ACE - Master

If you were only ever getting 800Kbs down on a 6Mbs account before "this problem" started, you had major problems already.

 

 

 

 

 

 

 




__________________________________________________________
How can you be in two places at once, when your not anywhere at all?
------------------------------------------------------------------------------------------------------
I really want to become a procrastinator, but I keep putting it off.
------------------------------------------------------------------------------------------------------
There are three kinds of people, those that can count, and those that can't.
------------------------------------------------------------------------------------
“Our great democracies still tend to think that a stupid man is more likely to be honest than a clever man, and our politicians take advantage of this prejudice by pretending to be even more stupid than nature has made them." :Bertrand Russell

                               neon_sign.jpg

*The views and opinions expressed on this forum are purely my own. Any product claim, statistic, quote, or other representation about a product or service should be verified with the manufacturer, provider, or party.

Re: HELP! Past month DoS Attacks: RST/ACK Scans

8 of 17 (4,580 Views)
0
(0)
  • Rate this reply
View profile
Oct 15, 2011 3:53:34 PM
0
(0)
Teacher
Kilobytes not Bits

Re: HELP! Past month DoS Attacks: RST/ACK Scans

9 of 17 (4,578 Views)
0
(0)
  • Rate this reply
View profile
Oct 15, 2011 4:23:03 PM
0
(0)
ACE - Master

Ah, so you were getting 6.4 Mbs download (800 KBs) on a 6Mbs acount?

 

To be clear, it's a clean install.

Do you have virus/malware protection software installed?

If so, is it up to date (subscription and/or virus definitions), has it come up with any alerts?

Have you checked your virus/malware protection logs/history to see if it has been blocking any incoming or outgoing connection attempts?

Have you or do you use any P2P software?

Does anyone else use your computer?

Are there other computers connected to your router/modem?

If so, same questions for those.

Does the modem/router have problems if all computers are left off after rebooting modem/router?

 

 

 

 

 

 

 

 




__________________________________________________________
How can you be in two places at once, when your not anywhere at all?
------------------------------------------------------------------------------------------------------
I really want to become a procrastinator, but I keep putting it off.
------------------------------------------------------------------------------------------------------
There are three kinds of people, those that can count, and those that can't.
------------------------------------------------------------------------------------
“Our great democracies still tend to think that a stupid man is more likely to be honest than a clever man, and our politicians take advantage of this prejudice by pretending to be even more stupid than nature has made them." :Bertrand Russell

                               neon_sign.jpg

*The views and opinions expressed on this forum are purely my own. Any product claim, statistic, quote, or other representation about a product or service should be verified with the manufacturer, provider, or party.

Re: HELP! Past month DoS Attacks: RST/ACK Scans

10 of 17 (4,575 Views)
0
(0)
  • Rate this reply
View profile
Oct 16, 2011 12:32:01 PM
0
(0)
Teacher
Yep yes yes and no it hasn't showed any alerts, it's always scanning It hasn't blocked any nope i dont use p2p Nope just me. Only through wireless and when its only for downloading sewing patterns. When not in use wireless on the laptop is turned off. It does when this is going on, modem often continually disconnects when I have the disconnect problem. Otherwise no, when the internet becomes stable when people are "normally at work" which would be about.. 9am-5pm cst I don't have any problems with it or if I do it may stop loading even though its still connected as if it froze for a minute and then it "feels" like it forces a quick reconnect and loads the page. Even google has problems loading when I have this freeze problem. If all computers are left off though I have seen it disconnect according to modem lights and come back on then go off and back on.

Re: HELP! Past month DoS Attacks: RST/ACK Scans

11 of 17 (4,167 Views)
0
(0)
  • Rate this reply
View profile
Oct 16, 2011 12:33:55 PM
0
(0)
Teacher
and at&t keeps saying the modem is still in good condition when i had them do a test and explained it to them briefly one time...

Re: HELP! Past month DoS Attacks: RST/ACK Scans

12 of 17 (4,166 Views)
0
(0)
  • Rate this reply
View profile
Oct 16, 2011 2:47:27 PM
0
(0)
ACE - Master

turtledoo wrote:
Yep yes yes and no it hasn't showed any alerts, it's always scanning It hasn't blocked any nope i dont use p2p Nope just me. Only through wireless and when its only for downloading sewing patterns. When not in use wireless on the laptop is turned off. It does when this is going on, modem often continually disconnects when I have the disconnect problem. Otherwise no, when the internet becomes stable when people are "normally at work" which would be about.. 9am-5pm cst I don't have any problems with it or if I do it may stop loading even though its still connected as if it froze for a minute and then it "feels" like it forces a quick reconnect and loads the page. Even google has problems loading when I have this freeze problem. If all computers are left off though I have seen it disconnect according to modem lights and come back on then go off and back on.


Ok, If I've got this right, you have only 1 computer (laptop), It only connects to Modem/Router wirelessly. When the laptop loses it's wireless connection to the Modem/Router the "Internet" light on the Modem/Router goes out. The only time you don't have problems with the wireless connection is between 9 and 5.

 

What about the "DSL" light on the Modem/Router?

 

 

 

 

 




__________________________________________________________
How can you be in two places at once, when your not anywhere at all?
------------------------------------------------------------------------------------------------------
I really want to become a procrastinator, but I keep putting it off.
------------------------------------------------------------------------------------------------------
There are three kinds of people, those that can count, and those that can't.
------------------------------------------------------------------------------------
“Our great democracies still tend to think that a stupid man is more likely to be honest than a clever man, and our politicians take advantage of this prejudice by pretending to be even more stupid than nature has made them." :Bertrand Russell

                               neon_sign.jpg

*The views and opinions expressed on this forum are purely my own. Any product claim, statistic, quote, or other representation about a product or service should be verified with the manufacturer, provider, or party.

Re: HELP! Past month DoS Attacks: RST/ACK Scans

13 of 17 (4,162 Views)
0
(0)
  • Rate this reply
View profile
Oct 17, 2011 2:48:16 PM
0
(0)
Teacher
it stays on but the internet light goes out sometimes... and sometimes all the lights go out I dunno why it isn't letting me add spacing in the reply messages =\

Re: HELP! Past month DoS Attacks: RST/ACK Scans

14 of 17 (4,150 Views)
0
(0)
  • Rate this reply
View profile
Oct 17, 2011 2:50:18 PM
0
(0)
Teacher
oh by the way it's almost as if the dns host is being scanned because before the at&t changed DNS for my area (updated to a newer dns) I had no problems at all and no slow downs etc.. not until the merger of the old dns to the new one when they did away with the old one.

Re: HELP! Past month DoS Attacks: RST/ACK Scans

15 of 17 (4,149 Views)
0
(0)
  • Rate this reply
View profile
Oct 19, 2011 7:01:14 AM
0
(0)
ACE - Master

Have you tried to hardwire (ethernet cable) the laptop to the Modem/Router and shut off the wireless on the laptop and Modem/Router to eliminate the wireless from the equation. Did you say that this problem usually occurs when downloading from a particular website (sewing patterns)?

 

 

 

 

 

 




__________________________________________________________
How can you be in two places at once, when your not anywhere at all?
------------------------------------------------------------------------------------------------------
I really want to become a procrastinator, but I keep putting it off.
------------------------------------------------------------------------------------------------------
There are three kinds of people, those that can count, and those that can't.
------------------------------------------------------------------------------------
“Our great democracies still tend to think that a stupid man is more likely to be honest than a clever man, and our politicians take advantage of this prejudice by pretending to be even more stupid than nature has made them." :Bertrand Russell

                               neon_sign.jpg

*The views and opinions expressed on this forum are purely my own. Any product claim, statistic, quote, or other representation about a product or service should be verified with the manufacturer, provider, or party.

Re: HELP! Past month DoS Attacks: RST/ACK Scans

16 of 17 (4,138 Views)
0
(0)
  • Rate this reply
View profile
Oct 19, 2011 10:46:04 AM
0
(0)
Teacher

I have a desktop connected and the only wireless is the laptop in which the laptop is only used for sewing patterns.

the desktop is used for gaming.

 

neither computers use p2p by the way.

 

the router used is netgear wndr3700.

I have tried disabling wireless and just using one computer and it still does it and also tried using two computer and it still does it, even tried using opposite computer when using only one and it still does it.

 

I'm still lead to believe its scans being ran through the DNS. I remember hearing how attacks like this was coming from a site called 4chan and at&t blocked that site because of it... however still having problems of this happening even after reading they blocked that website. when I say because of it I mean because of exploitation scans coming in from it. Even though the scans are bouncing off, still the obsession of purely scanning back to back is hammering rather my router, the modem or the dns which I'm connected to. It leads me to believe that its instead the DNS simply because about the time I noticed this others starting posting on the forums of disconnect problems and slow internet problems.

 

Oh by the way it occurs not on a particular website, just "any" website you visit, doesn't even matter what it is, even if its one we have never been to in our first internet browse back before 56k modems.

Re: HELP! Past month DoS Attacks: RST/ACK Scans

17 of 17 (4,133 Views)
Share this post
Share this post