DoS(SYN Flooding) Normal to see in the Event Log?

[mysteh]

Been having some weird internet problems, just curious if that's normal to see

[licquorice]

Perfectly normal, just your firewall doing it's job.

[mysteh]

Weird that you say that because I just gone done chatting with BT, and they said it's not normal.  He tested my line and claimed to have fixed the problem. Maybe it was something else that was affecting my internet but I did specifically ask him if DoS(SYN Flooding) is normal and he said it's not. 

[WSH]

It's not "normal" but sadly, it is routine today.  Don't know why he said he fixed it though.  It's not something he can fix unless BT's own systems are throwing a wobbley.

[mysteh]

Yeah I just tested playing some games, It's for sure not fixed. It's just weird because I had my router replaced the problem was fixed for a month or so, my internet speed is good, it's just sometimes when i'm playing games i have trouble connecting to servers. Driving me crazy lol

[licquorice]

Sadly the BT 'guides' aren't technical and their information cannot be relied upon.

[mysteh]

Ah well, Not sure what I can even do at this point then. 

[Crimliar]

DoS attacks are based on the WAN IP address.  So the easy fix is usually to force the WAN IP to change by rebooting or powering down the router (and possibly ONT) for a few minutes.  Once you no longer have this WAN IP you should see a let up in the DoS attacks, and unfortunately some other poor soul will *probably inherit the problem.

*Probably, because if the issue is caused by a compromised device on your network advertising itself to a would-be attacker, it'll restart pretty sharpish.  It's unlikely to be the case, but is possible, so don't fixate on that possibility!

[WSH]

It might be a flaw in the SH2 itself.

I have two SH2’s.  For no obvious reason, one started doing CWMP sessions once an hour and spoofing, scanning, syn floods etc. dropped to virtually nothing.  The other persists in CWMP once a day and lots of scanning, spoofing etc.

Just coincidence?

[Crimliar]

I use a third-party router.  If I enable a more complex firewall, I can log every attempted attack.  There are far more simple attacks on IP addresses than most people realise.  Until it starts causing problems, it's just something you have to live with!