0

Basically, can anyone tell/assist me on how to make my NETGEAR N 300 Wireless Router stop forwarding broadcast directed traffic to the network?

So the problem is this: I've been receiving DoS attack: Smurf to my network for about a week now, and it's consuming about 10x the amount of bandwidth I normally use.

The message as follows: [DoS attack: Smurf] attacks packets in the last 20sec from ip []

I've googled the problem and many sites suggest I should go to my router settings and stop forwarding broadcast directed traffic to the network. However I can't seem to find out how to do so.. so if anyone can help please reply.

1
  • Not sure if your router has that feature. You might call your ISP and ask if they can give you a new IP address.
    – Robert
    Feb 18, 2012 at 6:41

2 Answers 2

2

You likely are misinterpreting the issue - your network is not the origin of the Smurf replies, but rather likely a victim thereof.

If the log message is from your router's logs, it probably is not forwarding the broadcasts. If it can detect threats, it typically also would block them. Also, a Smurf attack typically would be directed against a public network with hosts answering to broadcast pings - something you would not see on modern networks. Last but not least, Smurf ping replies would rather congest your upstream, not your downstream.

In short: you are probably a DoS target. Ask your ISP to do something about it. If you have a professional ISP and have not chosen a cheapo-with-no-service-at-all plan, the ISP tech support will be able to help you quickly.

7
  • thankyou for your responses robert and syneticon-dj, much appreciated. i did call telstra bigpond (after having put me on hold for about an hour) but they were no help. they wanted to connect me to their paid service.. should i have?
    – kyliees
    Feb 18, 2012 at 8:39
  • @kyliees I have no idea of the service level you are provided by your ISP. If you have little to no tech support with your data line agreement, then the paid service would be the way to go. On the other hand, if this is primarily a consumer ISP, the paid service probably would be of little help and only would ask you to "reinstall Windows" or run useless tests instead of doing what's needed - creating a blocking rule for the incoming DoS traffic
    – the-wabbit
    Feb 18, 2012 at 10:10
  • @ syneticon-dj I've manage to get through to another slightly more helpful tech support person. He told me he was getting a team to look in it... Anyways I'll make an update on Tuesday (when they'll get back to me...hopefully) and I shall mention the blocking rule [they are supposed to be created/set by the ISP, am I right?]
    – kyliees
    Feb 18, 2012 at 11:32
  • @kyliees You can tell them that you suspect to be the target of a DoS attack, ask them to verify the assumption and set up a rule temporarily blocking the traffic with DoS characteristics (if it is Smurf, this would be all ICMP echo replies) going to your site.
    – the-wabbit
    Feb 18, 2012 at 13:52
  • @syneticon-dj i should've known, but dodgy technical services did not call back.. for two days now! i'm trying to call them again, but i am curious, can computer technicians set up a rule instead of the isp (it's too hard to get in touch with them)
    – kyliees
    Feb 23, 2012 at 6:08
0

That's the problem with some ISPs - hard to get to correct support - if at all. On your side you can't do any sigificant filtering. As it seems your router is already doing what is neccessary and block the requests - but blocking a request on your side of the network has a significant disadvantage: YOU have to do the filtering, which uses resources - and all the traffic still has to traverse to your side of your network - so your bandwidth get's used up. Though some dedicated filtering might ease the load on your router (as the auto filters do take up more resources) - it won't be worth the trouble, especially when the attack pattern changes...

tsg

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .