DOS ATTACK Again...

February 1, 2010 at 01:55:42
Specs: Macintosh
Hi

I have problems with my home wifi. I keep losing the internet connexion from mac book pro .
To get it back , I have to renew my DHCP lease and everything gets back , but pretty boring doing that 12 times a day..( is that the right thing to do,? i dunno but it works..)

I have a router netgear wireless wpn824 , a mac book pro connected wifi and a xbox wired to the router.everything was always woring fine before.

I checked the logs of the router and noticed i got some dos attack from the same ip .
Is there a link between that and my disconnection?
should i be worried?
here is my log.

[DoS Attack: RST Scan] from source: 212.27.48.3, port 110, Sunday, January 31,2010 10:00:33
[DHCP IP: 192.168.1.19] to MAC address 00:21:e9:9c:bd:3d, Sunday, January 31,2010 09:59:48
[DoS Attack: RST Scan] from source: 212.27.48.3, port 110, Sunday, January 31,2010 09:50:04
[LAN access from remote] from 92.84.66.227:11065 to 192.168.1.104:10748, Sunday, January 31,2010 09:49:54
[DoS Attack: RST Scan] from source: 212.27.48.3, port 110, Sunday, January 31,2010 09:46:21
[DoS Attack: RST Scan] from source: 212.27.48.3, port 110, Sunday, January 31,2010 09:21:07
[DoS Attack: RST Scan] from source: 212.27.48.3, port 110, Sunday, January 31,2010 08:49:46
[DoS Attack: RST Scan] from source: 212.27.48.3, port 110, Sunday, January 31,2010 08:47:46
[DoS Attack: RST Scan] from source: 212.27.48.3, port 110, Sunday, January 31,2010 08:29:39
[LAN access from remote] from 92.84.66.227:11065 to 192.168.1.104:10748, Sunday, January 31,2010 08:10:16
[LAN access from remote] from 76.171.182.106:45059 to 192.168.1.104:10748, Sunday, January 31,2010 07:59:27
[DoS Attack: RST Scan] from source: 212.27.48.3, port 110, Sunday, January 31,2010 07:56:25
[DoS Attack: RST Scan] from source: 212.27.48.3, port 110, Sunday, January 31,2010 07:38:18
[LAN access from remote] from 92.84.66.227:11065 to 192.168.1.104:10748, Sunday, January 31,2010 07:09:44
[DoS Attack: RST Scan] from source: 212.27.48.3, port 110, Sunday, January 31,2010 07:05:06
[DoS Attack: RST Scan] from source: 212.27.48.3, port 110, Sunday, January 31,2010 06:47:00
[LAN access from remote] from 92.84.103.45:10535 to 192.168.1.104:10748, Sunday, January 31,2010 06:29:06
[DoS Attack: RST Scan] from source: 212.27.48.3, port 110, Sunday, January 31,2010 06:13:16
[LAN access from remote] from 92.84.103.45:10535 to 192.168.1.104:10748, Sunday, January 31,2010 06:09:20
[DoS Attack: RST Scan] from source: 212.27.48.3, port 110, Sunday, January 31,2010 05:40:01
[LAN access from remote] from 86.27.15.151:51892 to 192.168.1.104:10748, Sunday, January 31,2010 05:34:17
[DoS Attack: RST Scan] from source: 212.27.48.3, port 110, Sunday, January 31,2010 05:21:57
[LAN access from remote] from 86.29.127.199:63525 to 192.168.1.104:10748, Sunday, January 31,2010 04:53:23
[DoS Attack: RST Scan] from source: 212.27.48.3, port 110, Sunday, January 31,2010 02:02:23
[DoS Attack: ACK Scan] from source: 212.27.48.3, port 110, Saturday, January 30,2010 21:31:39

As you can see , the ip is always 212.27.48.3

The thing as well is , ( advance excuses if i sound like a totally dumb , I'm still learning...thanks you..)
I turn ON the router block for any tcp/udp connexions from port 1 to 450 .
I obviously get still '' attacked'' through theses ports..
Why?

I would really appreciate some answers , anything to out me on the right way.
Thank YOU and sorry if I posted in the wrong spot , im new in here...


See More: DOS ATTACK Again...

Report •


#1
February 1, 2010 at 08:19:03
no link between the mac book/dhcp issue and this log. The log results are normal [I see these all the time and more].

If you were subject to a DoS [denial of service] attack you would lose all internet connectivity not just on the mac.

If you do a tracert on that ip you will find its coming from France. My last tracert was coming from Hong Kong.

Now this error:
[LAN access from remote] from 86.27.15.151:51892 to 192.168.1.104:10748,

is a bit more important. What is at 192.168.1.104?


Report •

#2
February 1, 2010 at 10:18:48
Thank you ..
I'm playing xbox live .I think 192.168.1.104 is the xbox .. ( I'll check right now..)

Concerning the ports I Blocked. What did I do wrong?
If the ports are blocked , am I still suposed to get attacked on theses?


Report •

#3
February 1, 2010 at 11:03:17
You did nothing wrong. This is normal. It is the router informing you of the attempted attacks.

Just think how lucky you are. You know what is going on whereas most never have a clue. Depending you will see port trojan attacks, syn attacts, etc. These happen all the time.


Report •

Related Solutions

#4
February 1, 2010 at 11:47:47
ok thanks...
Theres something new:

I think i got hacked, this morning while i was checking my logs and trying to reduce the ip range of my network , i got all of a sudden on my router page :

SORRY (198.168.1.9) is managing the device , Youre not authorized. and the adress bar was :

http://192.168.1.1/cb blabla/ check_hijack.htlm

I just turn the router off , get connected directly to the modem and ran asking for your help!

what the fxxck?


Report •


Ask Question