D-Link Forums

The Graveyard - Products No Longer Supported => Routers / COVR => DIR-605L => Topic started by: buzzlightyear22 on December 26, 2013, 05:53:21 PM

Title: Log shows continuous attack
Post by: buzzlightyear22 on December 26, 2013, 05:53:21 PM

I bought this about a month ago and noticed that internet is getting slower significantly and seeing the strangest log I've ever seen.
I upgraded the firmware to latest version for B1 h/w version that is 2.0.2, hide the ssid, turned it off for a night.

This morning, the log is some thing like this:

Dec 27 08:54:26Per-source ACK Flood Attack Detect (ip=74.125.200.101) Packet Dropped
Dec 27 08:54:26Whole System ACK Flood Attack from WAN Rule:Default deny
Dec 27 08:53:26Per-source ACK Flood Attack Detect (ip=173.194.117.30) Packet Dropped
Dec 27 08:53:26Whole System ACK Flood Attack from WAN Rule:Default deny
Dec 27 08:52:26Per-source ACK Flood Attack Detect (ip=173.194.117.30) Packet Dropped
Dec 27 08:52:26Whole System ACK Flood Attack from WAN Rule:Default deny
Dec 27 08:51:26Per-source ACK Flood Attack Detect (ip=173.194.117.30) Packet Dropped
Dec 27 08:51:26Whole System ACK Flood Attack from WAN Rule:Default deny
Dec 27 08:50:26Per-source ACK Flood Attack Detect (ip=173.194.117.30) Packet Dropped
Dec 27 08:50:26Whole System ACK Flood Attack from WAN Rule:Default deny

Anyone can advise what is wrong?
Thanks in advance

Title: Re: Log shows continuous attack
Post by: FurryNutz on December 26, 2013, 05:58:24 PM

Link>Welcome! (http://forums.dlink.com/index.php?topic=41537.0)

• What region are you located?
• Are you wired or wireless connected to the router?
• Has a Factory Reset been performed?
• Was a Factory Reset performed before and after any firmware updates then set up from scratch?
• Was the router working before any firmware updates?

Internet Service Provider and Modem Configurations

• What ISP Service do you have? Cable or DSL?
• What ISP Modem Mfr. and model # do you have?
• What ISP Modem service link speeds UP and Down do you have?
• Check ISP MTU requirements, Cable is usually 1500, DSL is around 1492 down to 1472. Call the ISP and ask. Link>Checking MTU Values (http://forums.dlink.com/index.php?topic=53008.0)
• For DSL/PPPoE connections on the router, ensure that "Always ON" option is enabled.

Router and Wired Configurations
Some things to try: - Log into the routers web page at 192.168.0.1. Use IE, Opera or FF to manage the router.

• Turn off ALL QoS (http://vonage.nmhoy.net/qos.html) or Disable Traffic Shaping (DIR only) GameFuel (DGL only and if ON.) options, Advanced/QoS (http://en.wikipedia.org/wiki/Quality_of_service) or Gamefuel.
• Turn off Advanced DNS Services if you have this option under Setup/Internet/Manual or under Setup/PARENTAL CONTROL/Set to>None: Static IP or Obtain Automatically From ISP.
• Enable Use Unicasting (compatibility for some ISP DHCP Servers) under Setup/Internet/Manual.
• Turn on DNS Relay under Setup/Networking. Link>Finding Faster DNS Addresses using Name Bench (http://forums.dlink.com/index.php?topic=53222.0)
• Setup DHCP reserved IP addresses for all devices ON the router. Setup/Networking. This ensures each devices gets its own IP address when turned on and connected, eliminates IP address conflicts and helps in troubleshooting.
• Ensure devices are set to auto obtain an IP address.
• If IPv6 (http://en.wikipedia.org/wiki/Ipv6) is an option on the router, select Local Connection Only or Disable IPv6 options under Setup/IPv6.
• Set Firewall settings to Endpoint Independent for TCP and UDP under Advanced/Firewall. Enable or Disable SPI (http://en.wikipedia.org/wiki/SPI) to test.
• Enable uPnP (http://en.wikipedia.org/wiki/Upnp) and Multi-cast Streaming (http://en.wikipedia.org/wiki/Multicast) under Advanced/Networking. Disable uPnP for testing Port Forwarding rules. Enable IPv6 Multi-cast Streaming for routers that have a Media Server option. Disable IPv6 Multi-cast Streaming if IPv6 or Media Server is not being used.
• Turn off WISH, and WPS under Advanced.
• WAN Port Speed set to Auto or specific speed? Some newer ISP modems support 1000Mb so manually setting to Gb speeds can be supported by the router. Advanced/Advanced Networking/WAN Port Speed
• Set current Time Zone, Date and Time. Use an NTP Server (http://forums.dlink.com/index.php?topic=48695.0) feature. Tools/Time.

Title: Re: Log shows continuous attack
Post by: buzzlightyear22 on December 26, 2013, 06:07:45 PM

Was a Factory Reset performed before and after any firmware updates then set up from scratch? Never performed Factory reset before. I checked the purchase date is 1 Dec 2013.

What region are you located? Singapore.

What ISP Service do you have? Cable or DSL? I am in apartment, I just pulled a network cable from the wall and plug it into router. Internet just works like that.

Thanks FurryNutz

Title: Re: Log shows continuous attack
Post by: FurryNutz on December 26, 2013, 08:42:32 PM

You might contact your ISP and ask about this. The log feature is reporting what it's finding and the router is doing it's job to block these. The ISP might be able to help. Give them this information and see.