Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I recently found a DoS Defense setting in my DrayTek Vigor 2830 router, which is disabled as default. I'm running a very small server on this network and I take it very serious to have the server up and running 24/7.

I'm a bit unsure if the DoS Defense could cause me any kind of problems. I haven't experienced any DoS attacks yet, but I would like to avoid possible attacks. Is there any reason not to enable the DoS Defense setting?

share|improve this question
Rather than ask us if you should/should not enable this "DoS Defense" feature, why not ask your router vendor what it actually does when you check the box, then decide if those rules make sense in your environment? – voretaq7 Dec 20 '12 at 21:23
(After digging up the manual from their website I can say the list of things it checks for and deals with is a relatively sane one -- Unlikely to break anything legit, so no real harm in turning it on. Just don't expect it to protect you from everything - there are some attacks it can't mitigate) – voretaq7 Dec 20 '12 at 21:31
As this is mostly a risk analysis question, you might consider asking to migrate this to Information Security. – AviD Dec 21 '12 at 8:39
up vote 19 down vote accepted

It means the router has to maintain additional state and do additional work on each packet. And how can it really help in the case of a DoS? All it can do is drop a packet that you have already received. Since you've already received it, it has already done the damage by consuming your inbound Internet bandwidth.

share|improve this answer
I'm pretty sure this is to keep the service running, not to stop the bandwidth drain. I really can't agree with this answer at all. – SpacemanSpiff Dec 20 '12 at 18:37
@SpacemanSpiff: Two reasons this is not true: 1) A typical ADSL link can't carry enough traffic to take out a service anyway. Typical DoS attacks over such links work by consuming your bandwidth. 2) The device can't reliably tell attack traffic from legitimate traffic. So stopping the DoS attack is just a DoS attack on yourself since you're dropping the legitimate traffic too. (At most, this will preserve your outbound bandwidth for other services because you're not replying to the attack traffic. But with no useful inbound, protecting your outbound usually doesn't help much.) – David Schwartz Dec 20 '12 at 18:41
Pretty much... Generally, if you get dossed on any line a dreytek would be holding up, you're going down. – Sirex Dec 20 '12 at 19:21
What you've told him to do is turn off the following, just so you know: SYN flooding, UDP flooding, ICMP flooding, Port Scan Detections, IP Spoofing, Tear Drop Attacks. Just because this vendor leaves it off by default, doesn't mean everyone does. Juniper NetScreen and SRX Branch routers come out this enabled, as does the ASA5505. – SpacemanSpiff Dec 20 '12 at 21:10
@SpacemanSpiff: If they can overwhelm his bandwidth, they can take him down even with it on. He's dropping the traffic after it has consumed his bandwidth. Having a defended edge inside the slowest link does you little to no good. Most likely, his weakest link is the router CPU and his inbound bandwidth. – David Schwartz Dec 20 '12 at 21:20

One reason to not enable the DoS Defense setting is that trying to protect systems from DOSed will spike the CPU of the router/firewall causing a DoS itself.

share|improve this answer

Yes, absolutely, turn it on.

If this is implemented correctly your firewall's engine should inspect each packet. Once it's determined to drop this traffic as part of a DoS attack, it should install a rule into hardware and silently drop the traffic instead of processing it again and again. Where it will still fall on it's face is a distributed attack, but I suggest you turn this on.

What kinds of services is that server hosting?

share|improve this answer
It is running a lot of different stuff: IIS, MSSQL Databases, MySQL databases, Apache, Minecraft and all kinds of random stuff I'd need a server for :) – Cupcake Dec 20 '12 at 18:49
If the traffic was hurting your link, it'll still be hurting your link. If it wasn't, you're now likely to be dropping at least some legitimate traffic, making the DoS attack worse. On a SoHo router, this is bad advice. It's off by default for a reason. – David Schwartz Dec 20 '12 at 19:26
I'm pretty sure screens and DoS rules do not drop OTHER types of traffic. – SpacemanSpiff Dec 20 '12 at 21:02
The whole point of a DoS is to make the DoS traffic indistinguishable from legitimate traffic so the victim has to choose between dropping legitimate traffic and responding to the DoS traffic. For example, if you're serving HTTP on port 80, one typical DoS attack you'll see is a multi-source SYN flood on port 80. How can you tell the flood SYNs from legitimate client SYNs? – David Schwartz Dec 20 '12 at 21:13
"If implemented correctly" isn't assured; especially on consumer grade hardware. The Netgear router I was using at home several years ago had a major bug in it's DOS filter. It was possible to send a single packet with malformed data that would cause DOS filter to crash and take the router down with it. – Dan Neely Dec 20 '12 at 21:20

An old thread I know, but I've just had to turn off the DoS defences on my Draytek 2850 home router to prevent some connection problems (almost everyone's in-bound bandwidth dropped to 0). Oddly enough, when all the kids are using their iPhones, PCs and chatting on Skype, etc. it triggers the DoS defences!

My guess is that there's so much traffic going in both directions that the router thinks it's under attack from the outside and shuts down. Turning off the UDP flood defence didn't do a complete fix so I turned off the SYN and ICMP defences too.

Hey presto - no more connection issues. Of course, I'll turn the defences back on and better-tune the values (measured in packets/second), but I've been trying to nail this problem for ages and it was quite a shock to find out the real cause.

I hope this helps someone else.

share|improve this answer
I can confirm the same on an ASUS Wireless Router RT-N10. Enabling DoS protection will degrade the wireless connection. – user252912 Nov 8 '14 at 1:22
We had a very similar problem on a 2930 shortly after we started allowing mobile devices on the network. I upped the threshold rates for SYN, UDP and ICMP defense significantly and it stopped the problem. – user275302 Mar 9 '15 at 18:52

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.