cancel
Showing results for 
Search instead for 
Did you mean: 

Router reports a FIN scan from a Plusnet IP address. Should I report it?

lorisarvendu
Grafter
Posts: 334
Registered: ‎26-08-2007

Router reports a FIN scan from a Plusnet IP address. Should I report it?

I know sometimes these things are false positives (I have a Netgear router), but IP lookup tells me it's owned by PN. 
A tortoise? What's that?
You know what a turtle is? Same thing.
3 REPLIES
Community Veteran
Posts: 5,176
Thanks: 480
Fixes: 20
Registered: ‎10-06-2010

Re: Router reports a FIN scan from a Plusnet IP address. Should I report it?

What's the IP address? Did it occur around the time you were browsing the plus.net website, these community forums, or accessing some other plusnet server?
lorisarvendu
Grafter
Posts: 334
Registered: ‎26-08-2007

Re: Router reports a FIN scan from a Plusnet IP address. Should I report it?

It probably was, yes.  IP is 84.93.230.178  which resolves to  community04.servers.plus.net.  So when I'm browsing these forums, they kick back and my router identifies it as an attack?
I'll look for one at 11:06 today then...
Ah yes, there it is:
[DoS attack: FIN Scan] attack packets in last 20 sec from ip [84.93.235.226], Wednesday, Oct 09,2013 10:05:56
[DoS attack: FIN Scan] attack packets in last 20 sec from ip [84.93.230.178], Wednesday, Oct 09,2013 10:03:52
(that's GMT of course).
So what gives?
A tortoise? What's that?
You know what a turtle is? Same thing.
Community Veteran
Posts: 5,176
Thanks: 480
Fixes: 20
Registered: ‎10-06-2010

Re: Router reports a FIN scan from a Plusnet IP address. Should I report it?

Probably related to or the same issue as what I reported in https://community.plus.net/forum/index.php/topic,117757.0.html
The strange thing is, I don't actually see any connections from my computer to 84.93.230.178 and the other community0{1,2,3,4}.servers.plus.net IP addresses when browsing these forums. Yet packets arrive from those IP addresses and so are dropped by the router firewall.