DoS attacks - Connection dropping every 5 minutes

[ArthurFoxache]

Hi,

For the last few days my connectivity has been intermittent with the line dropping out every five minutes (approx.) and reconnecting thereafter. After perusing my router logs I can see there have been several DoS records, followed by the ADSL connection dropping. 

NOTES:

• My speed is fine when connected
• The error can be replicated with or without micro-filter (although I usually do not use one as it reduces speed dramatically)
• I am hard wired to this PC. I have changed all potential wires, CAT 5 etc.
• I am running the latest firmware
• If you read the log you can see disconnections are preceded by DoS
• Gaps in the log are from my attempts at using different routers - three in all HH2, 3Com, and Netgear, none of which resolve the issue.
• Any help would be greatly appreciated!

Regards,
Arthur

Here is a small sample of the security log, can provide more if necessary:

[Internet disconnected] Friday, September 27,2013 12:10:56
[DSL: Down] Friday, September 27,2013 12:10:52
[Internet connected] IP address: ***.***.***.***, Friday, September 27,2013 12:09:56
[DSL: Up] Friday, September 27,2013 12:09:54
[DSL: Down] Friday, September 27,2013 12:09:04
[DSL: Up] Friday, September 27,2013 12:08:52
[DSL: Down] Friday, September 27,2013 12:08:03
[DSL: Up] Friday, September 27,2013 12:07:48
[Internet disconnected] Friday, September 27,2013 12:07:03
[DSL: Down] Friday, September 27,2013 12:06:58
[Internet connected] IP address: ***.***.***.***, Friday, September 27,2013 12:03:55
[DSL: Up] Friday, September 27,2013 12:03:52
[Internet disconnected] Friday, September 27,2013 12:03:11
[DSL: Down] Friday, September 27,2013 12:03:06
[DoS attack: ACK Scan] from source: 143.127.93.101:80, Friday, September 27,2013 11:59:51
[DoS attack: ACK Scan] from source: 143.127.93.101:80, Friday, September 27,2013 11:59:03
[DoS attack: ACK Scan] from source: 143.127.93.101:80, Friday, September 27,2013 11:58:39
[DoS attack: ACK Scan] from source: 143.127.93.101:80, Friday, September 27,2013 11:58:18
[DoS attack: ACK Scan] from source: 108.160.163.36:80, Friday, September 27,2013 11:57:00
[Internet connected] IP address: ***.***.***.***, Friday, September 27,2013 11:56:44
[DSL: Up] Friday, September 27,2013 11:56:42
[Internet disconnected] Friday, September 27,2013 11:55:57
[DSL: Down] Friday, September 27,2013 11:55:52
[DoS attack: ACK Scan] from source: 81.111.47.83:443, Friday, September 27,2013 11:02:22
[DoS attack: ACK Scan] from source: 81.111.47.83:443, Friday, September 27,2013 11:01:59
[Internet connected] IP address: ***.***.***.***, Friday, September 27,2013 11:01:41
[DSL: Up] Friday, September 27,2013 11:01:35
[Internet disconnected] Friday, September 27,2013 11:00:51
[DSL: Down] Friday, September 27,2013 11:00:46
[Internet connected] IP address: ***.***.***.***, Friday, September 27,2013 10:39:49
[DSL: Up] Friday, September 27,2013 10:39:43
[Internet disconnected] Friday, September 27,2013 10:39:02
[DSL: Down] Friday, September 27,2013 10:38:57
[Internet connected] IP address: ***.***.***.***, Friday, September 27,2013 10:05:00
[DSL: Up] Friday, September 27,2013 10:04:57
[DSL: Down] Friday, September 27,2013 10:04:08
[DSL: Up] Friday, September 27,2013 10:03:56
[DSL: Down] Friday, September 27,2013 10:03:09
[DSL: Up] Friday, September 27,2013 10:02:57
[Internet disconnected] Friday, September 27,2013 10:02:13
[DSL: Down] Friday, September 27,2013 10:02:08
[Internet connected] IP address: ***.***.***.***, Friday, September 27,2013 10:01:55
[DSL: Up] Friday, September 27,2013 10:01:50
[DSL: Down] Friday, September 27,2013 10:01:03
[DSL: Up] Friday, September 27,2013 10:00:51
[Internet disconnected] Friday, September 27,2013 10:00:07
[DSL: Down] Friday, September 27,2013 10:00:02
[DoS attack: ACK Scan] from source: 173.224.216.175:80, Friday, September 27,2013 09:55:16
[DoS attack: ACK Scan] from source: 192.241.151.93:80, Friday, September 27,2013 09:52:07
[DoS attack: ACK Scan] from source: 37.59.28.189:29000, Friday, September 27,2013 09:18:16
[DoS attack: ACK Scan] from source: 206.217.205.112:80, Friday, September 27,2013 09:13:52
[DoS attack: ACK Scan] from source: 173.194.67.108:993, Friday, September 27,2013 07:48:53
[DoS attack: ACK Scan] from source: 173.194.67.108:993, Friday, September 27,2013 07:48:26
[DoS attack: ACK Scan] from source: 173.201.192.205:110, Friday, September 27,2013 07:46:24
[DoS attack: ACK Scan] from source: 173.201.192.205:110, Friday, September 27,2013 07:45:57
[DoS attack: ACK Scan] from source: 173.201.192.205:110, Friday, September 27,2013 07:45:29
[DoS attack: ACK Scan] from source: 17.172.232.146:443, Friday, September 27,2013 07:43:02
[DoS attack: ACK Scan] from source: 17.172.232.146:443, Friday, September 27,2013 07:42:14
[DoS attack: ACK Scan] from source: 17.172.232.146:443, Friday, September 27,2013 07:41:50
[DoS attack: ACK Scan] from source: 17.172.232.146:443, Friday, September 27,2013 07:41:28
[DoS attack: ACK Scan] from source: 69.171.235.48:443, Friday, September 27,2013 07:30:24
[DoS attack: ACK Scan] from source: 1.201.1.219:5228, Friday, September 27,2013 07:29:12
[DoS attack: ACK Scan] from source: 69.171.235.48:443, Friday, September 27,2013 07:28:47
[DoS attack: ACK Scan] from source: 69.171.235.48:443, Friday, September 27,2013 07:26:54
[DoS attack: ACK Scan] from source: 69.171.235.48:443, Friday, September 27,2013 07:25:58
[DoS attack: ACK Scan] from source: 69.171.235.48:443, Friday, September 27,2013 07:25:30
[Internet connected] IP address: ***.***.***.***, Friday, September 27,2013 07:25:19
[DSL: Up] Friday, September 27,2013 07:25:16
[DSL: Down] Friday, September 27,2013 07:24:30
[DSL: Up] Friday, September 27,2013 07:24:18
[Internet disconnected] Friday, September 27,2013 07:23:33
[DSL: Down] Friday, September 27,2013 07:23:28
[DoS attack: ACK Scan] from source: 113.11.222.177:80, Friday, September 27,2013 07:14:57
[DoS attack: ACK Scan] from source: 176.31.90.155:80, Friday, September 27,2013 06:56:30
[DoS attack: ACK Scan] from source: 65.52.116.70:80, Friday, September 27,2013 06:49:23
[DoS attack: ACK Scan] from source: 82.192.97.25:80, Friday, September 27,2013 06:42:00
[DoS attack: ACK Scan] from source: 176.31.90.155:80, Friday, September 27,2013 06:35:17
[DoS attack: ACK Scan] from source: 182.50.130.68:80, Friday, September 27,2013 06:28:18
[DoS attack: ACK Scan] from source: 182.50.130.68:80, Friday, September 27,2013 06:25:31
[DoS attack: ACK Scan] from source: 176.31.90.155:80, Friday, September 27,2013 06:17:39
[DoS attack: ACK Scan] from source: 176.31.90.155:80, Friday, September 27,2013 06:14:38
[DoS attack: ACK Scan] from source: 173.194.78.188:5228, Friday, September 27,2013 06:10:14
[DoS attack: ACK Scan] from source: 173.194.78.188:5228, Friday, September 27,2013 06:09:54
[DoS attack: ACK Scan] from source: 173.194.78.188:5228, Friday, September 27,2013 06:09:27
[DoS attack: ACK Scan] from source: 202.106.199.34:80, Friday, September 27,2013 05:17:57
[DoS attack: ACK Scan] from source: 176.31.90.155:80, Friday, September 27,2013 05:07:44
[DoS attack: ACK Scan] from source: 176.31.90.155:80, Friday, September 27,2013 04:46:58
[DoS attack: ACK Scan] from source: 210.205.6.66:8487, Friday, September 27,2013 04:29:59
[DoS attack: ACK Scan] from source: 176.31.90.155:80, Friday, September 27,2013 04:29:33
[DoS attack: ACK Scan] from source: 176.31.90.155:80, Friday, September 27,2013 04:26:28
[DoS attack: ACK Scan] from source: 188.165.95.171:30800, Friday, September 27,2013 03:57:59
[DoS attack: ACK Scan] from source: 97.74.135.219:110, Friday, September 27,2013 03:47:08
[DoS attack: ACK Scan] from source: 97.74.135.219:110, Friday, September 27,2013 03:46:42
[DoS attack: ACK Scan] from source: 97.74.135.219:110, Friday, September 27,2013 03:46:15
[DoS attack: RST Scan] from source: 4.23.53.126:80, Friday, September 27,2013 03:34:40
[DoS attack: RST Scan] from source: 8.27.0.125:80, Friday, September 27,2013 03:31:31
[DoS attack: ACK Scan] from source: 97.74.135.226:110, Friday, September 27,2013 03:00:56
[DoS attack: ACK Scan] from source: 97.74.135.226:110, Friday, September 27,2013 03:00:30
[DoS attack: ACK Scan] from source: 97.74.135.226:110, Friday, September 27,2013 03:00:04
[DoS attack: ACK Scan] from source: 210.205.6.66:8487, Friday, September 27,2013 02:49:36
[DoS attack: ACK Scan] from source: 68.178.252.40:110, Friday, September 27,2013 02:10:51
[DoS attack: ACK Scan] from source: 68.178.252.40:110, Friday, September 27,2013 02:10:22
[DoS attack: ACK Scan] from source: 68.178.252.40:110, Friday, September 27,2013 02:09:53
[UPnP set event:AddPortMapping] from source 192.168.0.2, Friday, September 27,2013 01:49:40
[UPnP set event:AddPortMapping] from source 192.168.0.2, Friday, September 27,2013 01:49:39
[UPnP set event: DeletePortMapping] from source 192.168.0.2, Friday, September 27,2013 01:49:38
[UPnP set event: DeletePortMapping] from source 192.168.0.2, Friday, September 27,2013 01:49:37
[Internet connected] IP address: ***.***.***.***, Friday, September 27,2013 01:49:31
[DSL: Up] Friday, September 27,2013 01:49:29
[DSL: Down] Friday, September 27,2013 01:48:40
[DSL: Up] Friday, September 27,2013 01:48:28
[DSL: Down] Friday, September 27,2013 01:47:41
[DSL: Up] Friday, September 27,2013 01:47:26
[admin login] from source 192.168.0.2, Friday, September 27,2013 01:47:19
[admin login failure] from source 192.168.0.2, Friday, September 27,2013 01:47:10
[DSL: Down] Friday, September 27,2013 01:46:40
[DSL: Up] Friday, September 27,2013 01:46:28
[DSL: Down] Friday, September 27,2013 01:45:38
[DSL: Up] Friday, September 27,2013 01:45:26
[DSL: Down] Friday, September 27,2013 01:44:40
[DSL: Up] Friday, September 27,2013 01:44:28
[Internet disconnected] Friday, September 27,2013 01:43:43
[DSL: Down] Friday, September 27,2013 01:43:38
[DoS attack: ACK Scan] from source: 91.190.216.62:12350, Friday, September 27,2013 01:42:25
[DoS attack: ACK Scan] from source: 91.190.216.62:12350, Friday, September 27,2013 01:41:57
[UPnP set event:AddPortMapping] from source 192.168.0.2, Friday, September 27,2013 01:41:57
[UPnP set event:AddPortMapping] from source 192.168.0.2, Friday, September 27,2013 01:41:56
[DoS attack: ACK Scan] from source: 91.190.216.62:12350, Friday, September 27,2013 01:41:55
[UPnP set event: DeletePortMapping] from source 192.168.0.2, Friday, September 27,2013 01:41:55
[DoS attack: ACK Scan] from source: 91.190.216.62:12350, Friday, September 27,2013 01:41:54
[UPnP set event: DeletePortMapping] from source 192.168.0.2, Friday, September 27,2013 01:41:54
[DoS attack: ACK Scan] from source: 91.190.216.62:12350, Friday, September 27,2013 01:41:53
[Internet connected] IP address: ***.***.***.***, Friday, September 27,2013 01:41:48
[DSL: Up] Friday, September 27,2013 01:41:42
[Internet disconnected] Friday, September 27,2013 01:40:58
[DSL: Down] Friday, September 27,2013 01:40:53
[DoS attack: ACK Scan] from source: 184.173.161.179:443, Friday, September 27,2013 01:40:39
[UPnP set event:AddPortMapping] from source 192.168.0.2, Friday, September 27,2013 01:40:37
[UPnP set event:AddPortMapping] from source 192.168.0.2, Friday, September 27,2013 01:40:36
[UPnP set event: DeletePortMapping] from source 192.168.0.2, Friday, September 27,2013 01:40:35
[UPnP set event: DeletePortMapping] from source 192.168.0.2, Friday, September 27,2013 01:40:34
[Internet connected] IP address: ***.***.***.***, Friday, September 27,2013 01:40:28
[DSL: Up] Friday, September 27,2013 01:40:25
[Internet disconnected] Friday, September 27,2013 01:39:40
[DSL: Down] Friday, September 27,2013 01:39:36
[DoS attack: RST Scan] from source: 71.50.156.105:16467, Friday, September 27,2013 01:20:37
[DoS attack: ACK Scan] from source: 198.24.167.226:35738, Friday, September 27,2013 01:17:51
[DoS attack: ACK Scan] from source: 15.240.233.250:5222, Friday, September 27,2013 01:10:06
[DoS attack: ACK Scan] from source: 15.240.233.250:5222, Friday, September 27,2013 01:08:06
[DoS attack: ACK Scan] from source: 15.240.233.250:5222, Friday, September 27,2013 01:06:06
[DoS attack: ACK Scan] from source: 15.240.233.250:5222, Friday, September 27,2013 01:04:06
[DoS attack: ACK Scan] from source: 15.240.233.250:5222, Friday, September 27,2013 01:02:06
[DoS attack: ACK Scan] from source: 15.240.233.250:5222, Friday, September 27,2013 01:00:06
[DoS attack: ACK Scan] from source: 173.252.103.16:443, Friday, September 27,2013 00:59:03
[DoS attack: ACK Scan] from source: 173.252.103.16:443, Friday, September 27,2013 00:57:48
[DoS attack: ACK Scan] from source: 173.252.103.16:443, Friday, September 27,2013 00:56:33
[DoS attack: ACK Scan] from source: 15.240.233.250:5222, Friday, September 27,2013 00:55:55
[DoS attack: ACK Scan] from source: 15.240.233.250:5222, Friday, September 27,2013 00:55:34
[DoS attack: ACK Scan] from source: 173.252.103.16:443, Friday, September 27,2013 00:54:02
[DoS attack: ACK Scan] from source: 173.252.103.16:443, Friday, September 27,2013 00:52:47
[DoS attack: ACK Scan] from source: 173.252.103.16:443, Friday, September 27,2013 00:51:32
[DoS attack: ACK Scan] from source: 173.252.103.16:443, Friday, September 27,2013 00:50:17
[DoS attack: ACK Scan] from source: 17.172.232.149:5223, Friday, September 27,2013 00:49:07
[DoS attack: ACK Scan] from source: 17.172.232.149:5223, Friday, September 27,2013 00:48:23
[DoS attack: ACK Scan] from source: 17.172.232.149:5223, Friday, September 27,2013 00:47:42
[DoS attack: ACK Scan] from source: 82.192.97.25:80, Friday, September 27,2013 00:42:05
[DoS attack: ACK Scan] from source: 17.172.232.147:443, Friday, September 27,2013 00:36:11
[DoS attack: ACK Scan] from source: 17.172.232.147:443, Friday, September 27,2013 00:35:23
[UPnP set event:AddPortMapping] from source 192.168.0.2, Friday, September 27,2013 00:29:16
[UPnP set event:AddPortMapping] from source 192.168.0.2, Friday, September 27,2013 00:29:15
[UPnP set event: DeletePortMapping] from source 192.168.0.2, Friday, September 27,2013 00:29:14
[UPnP set event: DeletePortMapping] from source 192.168.0.2, Friday, September 27,2013 00:29:13
[DoS attack: ACK Scan] from source: 17.172.232.64:443, Friday, September 27,2013 00:29:11
[DoS attack: ACK Scan] from source: 17.172.232.64:443, Friday, September 27,2013 00:28:43
[DoS attack: ACK Scan] from source: 17.172.232.64:443, Friday, September 27,2013 00:28:15
[Internet connected] IP address: ***.***.***.***, Friday, September 27,2013 00:28:04
[DSL: Up] Friday, September 27,2013 00:27:58
[Internet disconnected] Friday, September 27,2013 00:27:14
[DSL: Down] Friday, September 27,2013 00:27:09
[DoS attack: ACK Scan] from source: 173.194.67.188:5228, Thursday, September 26,2013 23:42:20
[DoS attack: ACK Scan] from source: 173.194.67.188:5228, Thursday, September 26,2013 23:42:00
[DoS attack: ACK Scan] from source: 202.57.165.7:80, Thursday, September 26,2013 22:46:30
[DoS attack: ACK Scan] from source: 173.194.66.188:5228, Thursday, September 26,2013 22:40:51
[DoS attack: ACK Scan] from source: 173.194.66.188:5228, Thursday, September 26,2013 22:40:31
[DoS attack: RST Scan] from source: 80.215.32.129:25795, Thursday, September 26,2013 22:27:32
[DoS attack: ACK Scan] from source: 5.39.70.27:2320, Thursday, September 26,2013 21:34:37
[DoS attack: ACK Scan] from source: 176.31.90.155:80, Thursday, September 26,2013 21:31:22
[DoS attack: ACK Scan] from source: 98.137.201.232:80, Thursday, September 26,2013 21:30:15
[DoS attack: ACK Scan] from source: 98.137.201.232:80, Thursday, September 26,2013 21:29:27
[DoS attack: ACK Scan] from source: 98.137.201.232:80, Thursday, September 26,2013 21:29:03
[DoS attack: ACK Scan] from source: 98.137.201.232:80, Thursday, September 26,2013 21:26:27
[DoS attack: ACK Scan] from source: 98.137.201.232:80, Thursday, September 26,2013 21:25:39
[DoS attack: ACK Scan] from source: 98.137.201.232:80, Thursday, September 26,2013 21:25:15
[DoS attack: ACK Scan] from source: 199.127.101.236:443, Thursday, September 26,2013 21:11:15
[DoS attack: ACK Scan] from source: 23.35.213.163:80, Thursday, September 26,2013 21:03:21
[DoS attack: ACK Scan] from source: 176.31.90.155:80, Thursday, September 26,2013 20:50:55
[DoS attack: RST Scan] from source: 173.194.66.188:5228, Thursday, September 26,2013 20:36:42
[DoS attack: ACK Scan] from source: 37.59.28.189:29001, Thursday, September 26,2013 20:14:26
[UPnP set event:AddPortMapping] from source 192.168.0.4, Thursday, September 26,2013 20:03:11
[UPnP set event:AddPortMapping] from source 192.168.0.2, Thursday, September 26,2013 20:03:05
[UPnP set event:AddPortMapping] from source 192.168.0.2, Thursday, September 26,2013 20:03:04
[Internet connected] IP address: ***.***.***.***, Thursday, September 26,2013 20:02:55
[DSL: Up] Thursday, September 26,2013 20:02:49

[john46]

Hi welcome

First filters must be fitted at all times as to speed loss that is minimal normally only a few Kbps

Could you please post the ADSL stats from your home hub also restarting your hub constantly will wreck your broadband connection

Once we see your hubstats then we can start to try and help you

[SgtAMYNTAS]

Simple Solution Buy a D/ DOS Prevention Router "BT Home Hub 4" Works Well Against these attacks even those random From China!