Some interesting things on my router log.... (Solved)

[aphex]

Ping of Death Detect

Source: 12.158.33.18:8224
Destination: 192.168.1.102:8307
Note: Packet Dropped

Its all over the logs, sometimes 5-7 times a second, on different ports...

Any ideas?

 

[minendo]

Somebody is ping flooding you.

 

[aphex]

Originally posted by: minendo
Somebody is ping flooding you.

hmmmm.... any ideas how i can stop this?

 

[minendo]

Originally posted by: aphex

Originally posted by: minendo
Somebody is ping flooding you.

hmmmm.... any ideas how i can stop this?

Get a new IP if your cable company is DHCP or (not recommended) ping flood them back.

 

[GigaCluster]

Any ideas about what? Your router is doing its job by dropping packets before letting them enter your LAN. You could call your ISP and ask them to block that IP address or that network at their routers so that your router wouldn't even see this traffic, but what's the use?

You could also engage in cross-fire by attacking that IP address, but I wouldn't bother.

 

[her209]

Why is it addressed to an internal ip address on your router?

 

[aphex]

I remember reading awhile back, that if i unplug my cable modem for a certain amount of time, it will automatically grab a new ip...

 

[aphex]

Originally posted by: her209
Why is it addressed to an internal ip address on your router?

Im going router to router here... Linksys router to D-Link Wireless (with WEP enabled).... This is showing up on the D-Link logs...

 

[minendo]

Originally posted by: her209
Why is it addressed to an internal ip address on your router?

Router logs (at least my linksys) only lists activity heading towards an internal IP. It may be that there already is a port open on .102.

 

[aphex]

Originally posted by: minendo

Originally posted by: her209
Why is it addressed to an internal ip address on your router?

Router logs (at least my linksys) only lists activity heading towards an internal IP. It may be that there already is a port open on .102.

192.168.1.102 is the IP of the D-Link wireless router....

I have it setup like this...

Wall ---> Cable Modem ---> Linksys 4port Wired Router ---> D-Link Wireless Router (192.168.1.102)

 

[aphex]

Ok it seems to be only trying 4 different ports;

8307, 17735, 22064, and 3338

 

[Nocturnal]

So what, someone just types his ip address in IE and keeps pressing enter over and over again making requests to his ip? I don't get it when you people talk about flooding and packeting etc etc, can someone explain to me what it is rather than how to do it.

Again I'm not asking how to do it, but rather what is it all about?

 

[aphex]

Weird... Checking my outgoing logs, it looks like something on my end is talking to 12.158.33.18:1948

 

[Phuz]

Originally posted by: aphex
I remember reading awhile back, that if i unplug my cable modem for a certain amount of time, it will automatically grab a new ip...

If the cable modem is unplugged when the DHCP server goes to renew the lease on your IP address, you'll get a different one.
Generally the lease is requested eery 12 hours but it varies between ISPs.

 

[KingNothing]

Originally posted by: aphex
Weird... Checking my outgoing logs, it looks like something on my end is talking to 12.158.33.18:1948

Running any P2P software? Any direct IM connections?

 

[aphex]

Originally posted by: KingNothing

Originally posted by: aphex
Weird... Checking my outgoing logs, it looks like something on my end is talking to 12.158.33.18:1948

Running any P2P software? Any direct IM connections?

nope....

 

[zsouthboy]

Trojan?

 

[MichaelD]

Originally posted by: zsouthboy
Trojan?

Yup. Have you run Ad Aware lately?

 

[aphex]

Well the mystery is solved... Looks like my laptop was wiggin out from the Kontiki Download Manager that gamespot installed on it the other night.... I knew that thing was a POS...