This topic

DoS(SYN Flooding) Normal to see in the Event Log?

mysteh — Wed, 21 Aug 2024 08:31:17 GMT

Been having some weird internet problems, just curious if that's normal to see

Re: DoS(SYN Flooding) Normal to see in the Event Log?

licquorice — Wed, 21 Aug 2024 09:28:01 GMT

Perfectly normal, just your firewall doing it's job.

Re: DoS(SYN Flooding) Normal to see in the Event Log?

mysteh — Wed, 21 Aug 2024 09:47:51 GMT

Weird that you say that because I just gone done chatting with BT, and they said it's not normal. He tested my line and claimed to have fixed the problem. Maybe it was something else that was affecting my internet but I did specifically ask him if DoS(SYN Flooding) is normal and he said it's not.

Re: DoS(SYN Flooding) Normal to see in the Event Log?

WSH — Wed, 21 Aug 2024 09:52:55 GMT

It's not "normal" but sadly, it is routine today. Don't know why he said he fixed it though. It's not something he can fix unless BT's own systems are throwing a wobbley.

Re: DoS(SYN Flooding) Normal to see in the Event Log?

mysteh — Wed, 21 Aug 2024 09:57:21 GMT

Yeah I just tested playing some games, It's for sure not fixed. It's just weird because I had my router replaced the problem was fixed for a month or so, my internet speed is good, it's just sometimes when i'm playing games i have trouble connecting to servers. Driving me crazy lol

Re: DoS(SYN Flooding) Normal to see in the Event Log?

licquorice — Wed, 21 Aug 2024 10:29:26 GMT

Sadly the BT 'guides' aren't technical and their information cannot be relied upon.

Re: DoS(SYN Flooding) Normal to see in the Event Log?

mysteh — Wed, 21 Aug 2024 11:27:39 GMT

Ah well, Not sure what I can even do at this point then.

Re: DoS(SYN Flooding) Normal to see in the Event Log?

Crimliar — Sat, 24 Aug 2024 11:05:23 GMT

DoS attacks are based on the WAN IP address. So the easy fix is usually to force the WAN IP to change by rebooting or powering down the router (and possibly ONT) for a few minutes. Once you no longer have this WAN IP you should see a let up in the DoS attacks, and unfortunately some other poor soul will *probably inherit the problem.

*Probably, because if the issue is caused by a compromised device on your network advertising itself to a would-be attacker, it'll restart pretty sharpish. It's unlikely to be the case, but is possible, so don't fixate on that possibility!

Re: DoS(SYN Flooding) Normal to see in the Event Log?

WSH — Sat, 24 Aug 2024 12:13:11 GMT

It might be a flaw in the SH2 itself.

I have two SH2’s. For no obvious reason, one started doing CWMP sessions once an hour and spoofing, scanning, syn floods etc. dropped to virtually nothing. The other persists in CWMP once a day and lots of scanning, spoofing etc.

Just coincidence?

Re: DoS(SYN Flooding) Normal to see in the Event Log?

Crimliar — Sat, 24 Aug 2024 12:58:32 GMT

I use a third-party router. If I enable a more complex firewall, I can log every attempted attack. There are far more simple attacks on IP addresses than most people realise. Until it starts causing problems, it's just something you have to live with!

Re: DoS(SYN Flooding) Normal to see in the Event Log?

WSH — Sat, 24 Aug 2024 13:14:59 GMT

Oh, I agree but the shift in behaviour is interesting.