DoS attack: ACK Scan ??

[veuxtres]

can anyone tell me whats exactly going on ? because my router show tis log every minute sometimes and non stoping the ip is quite random i think today been showing over 30-50 i cant count exactly, is tat safe actually ?

[jmizoguchi]

if you use torrents, expect to see quite log entry...

[veuxtres]

But I don't use any torrent and I never download anything , normalli I connect 1 laptop for mmorpg and a desktop for buff movie , could it be virus or something , if 1 or 2 log show that I'm fine but showing 1 every minute is abit worry me , Ty for explain to me

[jmizoguchi]

post the log

[veuxtres]

[DoS Attack: RST Scan] from source: 202.1.204.70, port 47501, Monday, February 28,2011 08:51:52
[DoS Attack: ACK Scan] from source: 97.74.215.41, port 443

i reset and turned off my router and modem last night so i lost those log.when i turn on the modem i got these again , but not as many as last night.

are these means dangerous ? or just leave it ?

[KingGrub]

Perfectly normal ramdom internet noise, which is being blocked as it should be.

1 every minute is abit worry me

No need. One port scan a minute is nothing. You could have 100 port scans a minute and it wouldn't be a problem. These port scans aren't personally targetted at you, but bots scanning entire IP ranges randomly, and your IP happens to be part of one being scanned.

[Mars Mug]

Originally Posted by KingGrub

No need. One port scan a minute is nothing. You could have 100 port scans a minute and it wouldn't be a problem.

I agree, several thousands per week never bothered me. I used to use some software to analyse the logs, but eventually got bored and remembered there’s more to life.

[veuxtres]

ok i understand now thnx!

[ta_db]

what is happening when immediately after the recorded DoS, the router shows Internet disconnected.

the ACK scans (in goups of 5-6) then sometimes DoS (one or two) occur dozens of times a day, with loss of internet after each DoS. requires power cycle to recover (admin reconnect does not succeed).

why does router fail after this DoS?

the attacks follow one computer (of many), forced reassignment of IP results in attach resuming on new IP within 10s min. unable to find some piece of a Torrent based application (suspected) that broadcasts the IP. any hint on how do i find what is broadcasting the IP for the torrent to attempt access?