Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Basically, can anyone tell/assist me on how to make my NETGEAR N 300 Wireless Router stop forwarding broadcast directed traffic to the network?

So the problem is this: I've been receiving DoS attack: Smurf to my network for about a week now, and it's consuming about 10x the amount of bandwidth I normally use.

The message as follows: [DoS attack: Smurf] attacks packets in the last 20sec from ip []

I've googled the problem and many sites suggest I should go to my router settings and stop forwarding broadcast directed traffic to the network. However I can't seem to find out how to do so.. so if anyone can help please reply.

share|improve this question
Not sure if your router has that feature. You might call your ISP and ask if they can give you a new IP address. – Robert Feb 18 '12 at 6:41
up vote 2 down vote accepted

You likely are misinterpreting the issue - your network is not the origin of the Smurf replies, but rather likely a victim thereof.

If the log message is from your router's logs, it probably is not forwarding the broadcasts. If it can detect threats, it typically also would block them. Also, a Smurf attack typically would be directed against a public network with hosts answering to broadcast pings - something you would not see on modern networks. Last but not least, Smurf ping replies would rather congest your upstream, not your downstream.

In short: you are probably a DoS target. Ask your ISP to do something about it. If you have a professional ISP and have not chosen a cheapo-with-no-service-at-all plan, the ISP tech support will be able to help you quickly.

share|improve this answer
thankyou for your responses robert and syneticon-dj, much appreciated. i did call telstra bigpond (after having put me on hold for about an hour) but they were no help. they wanted to connect me to their paid service.. should i have? – kyliees Feb 18 '12 at 8:39
@kyliees I have no idea of the service level you are provided by your ISP. If you have little to no tech support with your data line agreement, then the paid service would be the way to go. On the other hand, if this is primarily a consumer ISP, the paid service probably would be of little help and only would ask you to "reinstall Windows" or run useless tests instead of doing what's needed - creating a blocking rule for the incoming DoS traffic – the-wabbit Feb 18 '12 at 10:10
@ syneticon-dj I've manage to get through to another slightly more helpful tech support person. He told me he was getting a team to look in it... Anyways I'll make an update on Tuesday (when they'll get back to me...hopefully) and I shall mention the blocking rule [they are supposed to be created/set by the ISP, am I right?] – kyliees Feb 18 '12 at 11:32
@kyliees You can tell them that you suspect to be the target of a DoS attack, ask them to verify the assumption and set up a rule temporarily blocking the traffic with DoS characteristics (if it is Smurf, this would be all ICMP echo replies) going to your site. – the-wabbit Feb 18 '12 at 13:52
@syneticon-dj i should've known, but dodgy technical services did not call back.. for two days now! i'm trying to call them again, but i am curious, can computer technicians set up a rule instead of the isp (it's too hard to get in touch with them) – kyliees Feb 23 '12 at 6:08

That's the problem with some ISPs - hard to get to correct support - if at all. On your side you can't do any sigificant filtering. As it seems your router is already doing what is neccessary and block the requests - but blocking a request on your side of the network has a significant disadvantage: YOU have to do the filtering, which uses resources - and all the traffic still has to traverse to your side of your network - so your bandwidth get's used up. Though some dedicated filtering might ease the load on your router (as the auto filters do take up more resources) - it won't be worth the trouble, especially when the attack pattern changes...


share|improve this answer

protected by John Gardeniers Feb 23 '12 at 21:03

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.