cancel
Showing results for 
Search instead for 
Did you mean: 

Is plusnet ATTACKING my router???

Vip3r
Grafter
Posts: 142
Registered: 22-10-2009

Is plusnet ATTACKING my router???

Hi Plusnet why are you attacking me?
Looking at my router logs, I can see the 2 following entries

[DoS attack: FIN Scan] attack packets in last 20 sec from ip [212.159.15.8], Thursday, Jul 07,2011 23:58:09
[DoS attack: ACK Scan] attack packets in last 20 sec from ip [212.159.15.8], Tuesday, Jul 05,2011 09:30:58

Looking up 212.159.15.8 points me to pih-portal08.servers.plus.net
I'm not that bothered about the attack itself, but why is it happening?
And is anybody else seeing it or am I being singled out?  Angry
Cheers
Dave.
2 REPLIES
MJN
Aspiring Pro
Posts: 1,103
Thanks: 54
Fixes: 2
Registered: 26-08-2010

Re: Is plusnet ATTACKING my router???

It is probably just your router being over-zealous with regards to its interpretation of some packets it has seen.
Mathew
wisty
Pro
Posts: 465
Thanks: 63
Fixes: 6
Registered: 30-07-2007

Re: Is plusnet ATTACKING my router???

This is frequently caused by orphan packets. If you open a web page your browser sends requests to a variety of servers for the content ( including the embedded ads, pictures etc.). If you close the browser window before all the responses get back, the router will/may delete the outgoing  record from its NAT database. When the requested packets then arrive, the router has no idea why they are arriving and treats them as unsolicited packets - and reports them as a potential attack.