Getting Hammered with DoS Attacks

a reply to: Gothmog

Thanks again for the tips. I have two laptops (one for work and the other for DJing) and a desktop. The LAND attack messages happen regardless of which one is connected. Not all are connected at the same time.

Also, I didn't see these until I updated the firmware on my router. I've been finding a lot of complaints that Netgear generates a lot of false positives. Maybe that's what these are? I haven't seen a different type of DoS in a few days.

One suggestion I've heard was to disconnect the cable feed from the modem for a while and see if I still log these messages. This could tell if they're really coming from the inside or out. If they are from within I can try disconnecting devices?

One other note, I did have an older Synology NAS that had a known CVE. This was attached to my old router and since I never took advantage of the NAS functionality I simply replaced it with a external hard drive. I wonder if at one time someone did find that vulnerability and that's why I'm getting hammered.

a reply to: RomaSempre

Synology NAS that had a known CVE.

That is a possibility .
Since the NAS was attached to the router , and your ISP only provides static (which doesn't change) with routers....

And it is very refreshing to see someone posting about NAS and CVE .
A rarity .

Generally, comcast /xfinity DHCP servers assign IP addresses to MAC ID's (the router) with a lease time. The duration of that lease can be modified by the ISP.  Rebooting doesn't necessarily get a new IP address if your MAC ID doesn't change. The exception is to power down your router long enough to expire the lease which will force the lease of a new WAN ip to the router.

Regarding comcast / xfinity, a static ip is only available to business customers at this time : www.reddit.com...


a reply to: Gothmog

There is what is referred to as a sticky dynamic ip address. This type of address although not static is more durable than a traditional dynamic ip.

a reply to: SirBobkat

Generally, comcast /xfinity DHCP servers assign IP addresses to MAC ID's

Yes , and if you change routers , they assign the same IP address to that MAC.
The only way to change that is to contact Comcast Level 2 support . (with a good reason)

with a lease time.

The lease is set for 2 days , but will renew with the same IP due to the associated MAC.

The exception is to power down your router long enough to expire the lease which will force the lease of a new WAN ip to the router.

One can even unlug the modem , and then do a hard reset .
Guess what IP address you will come back with ?
Change routers ?
No problem .
They have to register the new MAC with , guess what ?
The same IP address .

Regarding comcast / xfinity, a static ip is only available to business customers at this time

ALL Comcast IPs are static .
In the case of businesses , they are assigned a scope of IPs.

Comcast customer for about 20 years now .
And , due to my occupation , not unlearned of networking .