UDP Flood

[MustISO]

01/21/2006 08:29:53 **UDP flood** 221.234.xxx.xxx, 15668->> 192.168.2.100, 17724 (from WAN Inbound)

I have an SMC router with FW enabled. I also use XP SP2 firewall. My router has tons and tons of UDP Flood entries in the log.

The router has a bunch of settings under: Connection Policy and DoS Detect Criteria.

I'm using the default settings in both places.

 

[nweaver]

as long as it's dropping them, then I wouldn't worry. There is so much crap out there, my Linux router would drop between 200-1200 packets a day when I had a live IP.

 

[MustISO]

The problem is that it's blocking my internet connection. It either totally blocks my connection or my connection gets VERY slow.

 

[spidey07]

if that's the case then call your ISP or report it as abuse.

just don't be one of those guys who reports abuse for every single log entry in their firewall.

ugghh..

🙂

 

[RebateMonger]

Yeah, other than having your router drop connections from that IP address, all you can do is contact your ISP. And, maybe, the ISP of the source. But that's a bit frustrating at times, to say the least....

The GOOD news is that, presumably, all the outgoing traffic is blocking your attacker's connection, too. Unless he has a bigger feed than yours. Feel lucky that you don't have a Distributed Denial of Service. That's a LOT tougher to block.

 

[MustISO]

What a crazy day. Now I have some AOL fool using Smurf attacks.

 

[sumyungai]

Originally posted by: MustISO
What a crazy day. Now I have some AOL fool using Smurf attacks.

You must have enemies in high places. 😉

 

[spidey07]

or a trojan/bot on his machine saying "come get me, I'm open"