IP spoofing question

[maravac]

Is this OK (see the part of my WNDR3800 router log below), or should I enhance somehow the security of my router?

[DoS Attack: IP Spoofing] from source: 192.168.1.118, port 2280, Monday, May 07,2012 06:59:47
[DoS Attack: IP Spoofing] from source: 192.168.1.118, port 2279, Monday, May 07,2012 06:59:09
[DoS Attack: IP Spoofing] from source: 192.168.1.118, port 2278, Monday, May 07,2012 06:58:31
[DoS Attack: IP Spoofing] from source: 192.168.1.118, port 2277, Monday, May 07,2012 06:57:53
[DoS Attack: IP Spoofing] from source: 192.168.1.118, port 2276, Monday, May 07,2012 06:57:15
[DoS Attack: IP Spoofing] from source: 192.168.1.118, port 2275, Monday, May 07,2012 06:56:37
[DoS Attack: IP Spoofing] from source: 192.168.1.118, port 2274, Monday, May 07,2012 06:55:59
[DoS Attack: IP Spoofing] from source: 192.168.1.118, port 2273, Monday, May 07,2012 06:55:21
[DoS Attack: IP Spoofing] from source: 192.168.1.118, port 2272, Monday, May 07,2012 06:54:43
[DoS Attack: IP Spoofing] from source: 192.168.1.118, port 2271, Monday, May 07,2012 06:54:05
[DoS Attack: IP Spoofing] from source: 192.168.1.118, port 2270, Monday, May 07,2012 06:53:27
[DoS Attack: IP Spoofing] from source: 192.168.1.118, port 2269, Monday, May 07,2012 06:52:49
[DoS Attack: IP Spoofing] from source: 192.168.1.118, port 2268, Monday, May 07,2012 06:52:11
[DoS Attack: IP Spoofing] from source: 192.168.1.118, port 2267, Monday, May 07,2012 06:51:33
[DoS Attack: IP Spoofing] from source: 192.168.1.118, port 2266, Monday, May 07,2012 06:50:55
[DoS Attack: IP Spoofing] from source: 192.168.1.118, port 2265, Monday, May 07,2012 06:50:17
[DoS Attack: IP Spoofing] from source: 192.168.1.118, port 2264, Monday, May 07,2012 06:49:40
[DoS Attack: IP Spoofing] from source: 192.168.1.118, port 2263, Monday, May 07,2012 06:49:02
[DoS Attack: IP Spoofing] from source: 192.168.1.118, port 2262, Monday, May 07,2012 06:48:24
[DoS Attack: IP Spoofing] from source: 192.168.1.118, port 2261, Monday, May 07,2012 06:47:46
[DoS Attack: IP Spoofing] from source: 192.168.1.118, port 2260, Monday, May 07,2012 06:47:08
[DoS Attack: IP Spoofing] from source: 192.168.1.118, port 2259, Monday, May 07,2012 06:46:30
[DoS Attack: IP Spoofing] from source: 192.168.1.118, port 2258, Monday, May 07,2012 06:45:52
[DoS Attack: IP Spoofing] from source: 192.168.1.118, port 2257, Monday, May 07,2012 06:45:14
[DoS Attack: IP Spoofing] from source: 192.168.1.118, port 2256, Monday, May 07,2012 06:44:36
[DoS Attack: IP Spoofing] from source: 192.168.1.118, port 2255, Monday, May 07,2012 06:43:58
[DoS Attack: IP Spoofing] from source: 192.168.1.118, port 2254, Monday, May 07,2012 06:43:20
[DoS Attack: IP Spoofing] from source: 192.168.1.118, port 2253, Monday, May 07,2012 06:42:42
[DoS Attack: IP Spoofing] from source: 192.168.1.118, port 2252, Monday, May 07,2012 06:42:04
[DoS Attack: IP Spoofing] from source: 192.168.1.118, port 2251, Monday, May 07,2012 06:41:26
[DoS Attack: IP Spoofing] from source: 192.168.1.118, port 2250, Monday, May 07,2012 06:40:48
[DoS Attack: IP Spoofing] from source: 192.168.1.118, port 2249, Monday, May 07,2012 06:40:10
[DoS Attack: IP Spoofing] from source: 192.168.1.118, port 2248, Monday, May 07,2012 06:39:32
[DoS Attack: IP Spoofing] from source: 192.168.1.118, port 2247, Monday, May 07,2012 06:38:55
[DoS Attack: IP Spoofing] from source: 192.168.1.118, port 2246, Monday, May 07,2012 06:38:17
[DoS Attack: IP Spoofing] from source: 192.168.1.118, port 2245, Monday, May 07,2012 06:37:39
[DoS Attack: IP Spoofing] from source: 192.168.1.118, port 2244, Monday, May 07,2012 06:37:01
[DoS Attack: IP Spoofing] from source: 192.168.1.118, port 2243, Monday, May 07,2012 06:36:23
[DoS Attack: IP Spoofing] from source: 192.168.1.118, port 2242, Monday, May 07,2012 06:35:45
[DoS Attack: IP Spoofing] from source: 192.168.1.118, port 2241, Monday, May 07,2012 06:35:07
[DoS Attack: IP Spoofing] from source: 192.168.1.118, port 2240, Monday, May 07,2012 06:34:29
[DoS Attack: IP Spoofing] from source: 192.168.1.118, port 2239, Monday, May 07,2012 06:33:51
[DoS Attack: IP Spoofing] from source: 192.168.1.118, port 2238, Monday, May 07,2012 06:33:13
[DoS Attack: IP Spoofing] from source: 192.168.1.118, port 2237, Monday, May 07,2012 06:32:35
[DoS Attack: IP Spoofing] from source: 192.168.1.118, port 2236, Monday, May 07,2012 06:31:57
[DoS Attack: IP Spoofing] from source: 192.168.1.118, port 2235, Monday, May 07,2012 06:31:19
[DoS Attack: IP Spoofing] from source: 192.168.1.118, port 2234, Monday, May 07,2012 06:30:41
[DoS Attack: IP Spoofing] from source: 192.168.1.118, port 2233, Monday, May 07,2012 06:30:03
[DoS Attack: IP Spoofing] from source: 192.168.1.118, port 2232, Monday, May 07,2012 06:29:25
[DoS Attack: IP Spoofing] from source: 192.168.1.118, port 2231, Monday, May 07,2012 06:28:47
[DoS Attack: IP Spoofing] from source: 192.168.1.118, port 2230, Monday, May 07,2012 06:28:09
[DoS Attack: IP Spoofing] from source: 192.168.1.118, port 2229, Monday, May 07,2012 06:27:32
[DoS Attack: IP Spoofing] from source: 192.168.1.118, port 2228, Monday, May 07,2012 06:26:54
[DoS Attack: IP Spoofing] from source: 192.168.1.118, port 2227, Monday, May 07,2012 06:26:16
[DoS Attack: IP Spoofing] from source: 192.168.1.118, port 2226, Monday, May 07,2012 06:25:38
[DoS Attack: IP Spoofing] from source: 192.168.1.118, port 2225, Monday, May 07,2012 06:25:00
[DoS Attack: IP Spoofing] from source: 192.168.1.118, port 2224, Monday, May 07,2012 06:24:22
[DoS Attack: IP Spoofing] from source: 192.168.1.118, port 2223, Monday, May 07,2012 06:23:44
[DoS Attack: IP Spoofing] from source: 192.168.1.118, port 2222, Monday, May 07,2012 06:23:06
[DoS Attack: IP Spoofing] from source: 192.168.1.118, port 2221, Monday, May 07,2012 06:22:28
[DoS Attack: IP Spoofing] from source: 192.168.1.118, port 2220, Monday, May 07,2012 06:21:50
[DoS Attack: IP Spoofing] from source: 192.168.1.118, port 2219, Monday, May 07,2012 06:21:12
[DoS Attack: IP Spoofing] from source: 192.168.1.118, port 2218, Monday, May 07,2012 06:20:34
[DoS Attack: IP Spoofing] from source: 192.168.1.118, port 2217, Monday, May 07,2012 06:19:56
[DoS Attack: IP Spoofing] from source: 192.168.1.118, port 2216, Monday, May 07,2012 06:19:18
[DoS Attack: IP Spoofing] from source: 192.168.1.118, port 2215, Monday, May 07,2012 06:18:40
[DoS Attack: IP Spoofing] from source: 192.168.1.118, port 2214, Monday, May 07,2012 06:18:02
[DoS Attack: IP Spoofing] from source: 192.168.1.118, port 2213, Monday, May 07,2012 06:17:24
[DoS Attack: IP Spoofing] from source: 192.168.1.118, port 2212, Monday, May 07,2012 06:16:47
[DoS Attack: IP Spoofing] from source: 192.168.1.118, port 2211, Monday, May 07,2012 06:16:09
[DoS Attack: IP Spoofing] from source: 192.168.1.118, port 2210, Monday, May 07,2012 06:15:31
[DoS Attack: IP Spoofing] from source: 192.168.1.118, port 2209, Monday, May 07,2012 06:14:53
[DoS Attack: IP Spoofing] from source: 192.168.1.118, port 2208, Monday, May 07,2012 06:14:15
[DoS Attack: IP Spoofing] from source: 192.168.1.118, port 2207, Monday, May 07,2012 06:13:37
[DoS Attack: IP Spoofing] from source: 192.168.1.118, port 2206, Monday, May 07,2012 06:12:59
...

[jmizoguchi]

It's coming from 118 ip, check any malware and/remove its device and log should be cleared up

[fordem]

What you're logging there are inbound connection attempts to the WAN port showing 192.168.1.118 as the source address.

The router detects (and blocks) this traffic as a Denial of Service attack because it should never see traffic from an address within it's internal (LAN) address range on it's WAN port - you can report it to your ISP and see if they will do anything about it, some ISP support staff don't know how to deal with this type of thing, other do.

You may (or may not) also be experiencing a drop in throughput - based on the frequency in the log, the connection attempts seem to be one or two a minute, not really enough to be called a DoS attack - if you are, draw that to the attention of the ISP, they will probably pay more attention to that, than a report of a DoS attack.