cancel
Showing results for 
Search instead for 
Did you mean: 
everon
Contributor
2,203 Views
Message 1 of 7

DoS UDP Loopback query

Go to solution

Hi guys,

 

I have a query about some logs I keep seeing in my Hub 5 event log that have only just started to appear since I upgraded from a hub 4 to the Hub 5.

 

Specifically (just a couple of samples as i wont post them all):

 

08:54:09, 17 Jul.DoS(UDP Loopback): IN=ppp0 OUT= MAC= src=74.82.47.13 DST=86.185.203.94 LEN=29 TOS=0x18 PREC=0x60 TTL=49 ID=64176 DF PROTO=UDP SPT=57512 DPT=19 LEN=9 MARK=0x8000000
19:14:44, 16 Jul.DoS(UDP Loopback): IN=ppp0 OUT= MAC= src=185.94.111.1 DST=86.185.203.94 LEN=28 TOS=0x18 PREC=0x60 TTL=233 ID=54321 PROTO=UDP SPT=46473 DPT=19 LEN=8 MARK=0x8000000

 

My hub is working fine and im getting all my speeds as I normally would but i was curious as to what these entries mean. They happen roughly 4 times a day randomly. Is this an indication of an attempted hack or ddos attack? If anyone can help and put my mind at rest id be grateful.

 

Cheers, Jay.

0 Ratings
Reply
6 REPLIES 6
Distinguished Guru
2,193 Views
Message 2 of 7

Re: DoS UDP Loopback query

Go to solution

It probably is an attempted attack.  You may just be getting them now because swapping one Hub for another will have given you a new IP address.

 

If you connect anything directly to the internet, then expect it to be attacked 24 hours a day.  All Home Hubs have a built-in firewall and simply block all unexpected incoming messages.  This firewall has the added advantage of protecting not just the Hub itself but everything on your home network.

everon
Contributor
2,189 Views
Message 3 of 7

Re: DoS UDP Loopback query

Go to solution

I have tried turning off the modem and the hub for a bit in an attempt to get a new IP address but it wont release. 

 

Anything else i can do apart from ignore it?

0 Ratings
Reply
Distinguished Sage
Distinguished Sage
2,181 Views
Message 4 of 7

Re: DoS UDP Loopback query

Go to solution

Just ignore it, if you get a new address it probably won't make any difference any way.

Highlighted
MikeZ
Contributor
2,169 Views
Message 5 of 7

Re: DoS UDP Loopback query

Go to solution

It's just port scanning - your router is doing its job and blocking them, so just ignore. The first IP address belongs to shadowserver.org - see their website for details about their port scanning.

MikeZ
Contributor
2,168 Views
Message 6 of 7

Re: DoS UDP Loopback query

Go to solution

@licquorice wrote:

Just ignore it, if you get a new address it probably won't make any difference any way.


Correct - they are scanning whole ranges. Both of those IP addresses are in my firewall logs.

everon
Contributor
2,146 Views
Message 7 of 7

Re: DoS UDP Loopback query

Go to solution

Thanks for the help guys. I will do as you suggest and just ignore it.

 

Cheers, Jay.

0 Ratings
Reply