D-Link Forums

The Graveyard - Products No Longer Supported => Routers / COVR => DIR-655 => Topic started by: Yanta on March 18, 2010, 06:51:08 PM

Title: Block connects flooding router
Post by: Yanta on March 18, 2010, 06:51:08 PM

I've been watching my syslog server for a couple of days. It is blocking about 4 connections per second, non-stop, over 10,000 per hour, constantly. I did a quick check looking for duplicate addresses and only came across a couple. For the most part they are unique addresses.

Is this normal?
Could it explain my recent degredation of 25% of my download speed (2.0mpbs -> 1.5mbps)
Is there any way to stop it?

thanks
Tanya

Title: Re: Block connects flooding router
Post by: Sammydad1 on March 18, 2010, 07:13:01 PM

sounds like you are seeing an attack (of sorts).  Maybe somebody has been filesahring using your IP and users  are trying to get at whatever files were shared..... As long as the router is blocking properly, its doing its job.

Title: Re: Block connects flooding router
Post by: Yanta on March 19, 2010, 06:18:41 AM

Thanks for your response.

I think, if I had a lot of outgoing data though, my ISP account would show that, and my monthly outbound data is around 4gigs, about what I'd expect for the usage my family and I have.

I thought I had my systems pretty secure with permissions defined only for users on the network here and guest/admin accounts disabled.

But if you're right, then theoretically the connect attempts should decrease as people find they can't connect.

I haven't seen any strange data on any of the systems, or on the server. Though, if my years of IT exposure are flaky then maybe I missed something with my security and they were actually downloading from my server, which is not particularly interesting stuff.