Strange Happenings
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Printer Friendly Page
- Plusnet Community
- :
- Forum
- :
- Help with my Plusnet services
- :
- Broadband
- :
- Re: Strange Happenings
Strange Happenings
05-09-2013 12:45 AM
- Mark as New
- Bookmark
- Subscribe
- Subscribe to RSS Feed
- Highlight
- Report to Moderator
09/05/2013 00:24:12 **SYN Flood**
09/05/2013 00:24:12 **SYN Flood**
09/05/2013 00:24:12 **SYN Flood**
09/05/2013 00:24:12 **SYN Flood** (from ATM1 Outbound)
09/05/2013 00:24:12 **SYN Flood** (from ATM1 Outbound)
09/05/2013 00:24:11 **SYN Flood** (from ATM1 Outbound)
09/05/2013 00:24:11 **SYN Flood** (from ATM1 Outbound)
09/05/2013 00:24:11 **SYN Flood** (from ATM1 Outbound)
09/05/2013 00:24:11 **SYN Flood** (from ATM1 Outbound)
09/05/2013 00:24:11 **SYN Flood** (from ATM1 Outbound)
09/05/2013 00:24:11 **SYN Flood** (from ATM1 Outbound)
09/05/2013 00:24:11 **SYN Flood** (from ATM1 Outbound)
09/05/2013 00:24:11 **SYN Flood** (from ATM1 Outbound)
09/05/2013 00:24:11 **SYN Flood** (from ATM1 Outbound)
09/05/2013 00:24:11 **SYN Flood** (from ATM1 Outbound)
09/05/2013 00:24:11 **SYN Flood** (from ATM1 Outbound)
09/05/2013 00:24:11 **SYN Flood** (from ATM1 Outbound)
09/05/2013 00:24:11 **SYN Flood** (from ATM1 Outbound)
09/05/2013 00:24:11 **SYN Flood** (from ATM1 Outbound)
09/05/2013 00:24:11 **SYN Flood** (from ATM1 Outbound)
09/05/2013 00:24:11 **SYN Flood** (from ATM1 Outbound)
09/05/2013 00:24:11 **SYN Flood** (from ATM1 Outbound)
09/05/2013 00:24:11 **SYN Flood** (from ATM1 Outbound)
09/05/2013 00:24:11 **SYN Flood** (from ATM1 Outbound)
09/05/2013 00:24:11 **SYN Flood** (from ATM1 Outbound)
09/05/2013 00:24:11 **SYN Flood** (from ATM1 Outbound)
09/05/2013 00:24:11 **SYN Flood** (from ATM1 Outbound)
09/05/2013 00:24:11 **SYN Flood** (from ATM1 Outbound)
09/05/2013 00:24:11 **SYN Flood** (from ATM1 Outbound)
09/05/2013 00:24:11 **SYN Flood** (from ATM1 Outbound)
09/05/2013 00:24:11 **SYN Flood** (from ATM1 Outbound)
09/05/2013 00:24:11 **SYN Flood** (from ATM1 Outbound)
09/05/2013 00:24:10 **SYN Flood** (from ATM1 Outbound)
09/05/2013 00:23:13 **SYN Flood** (from ATM1 Outbound)
09/05/2013 00:23:04 **SYN Flood** (from ATM1 Outbound)
09/05/2013 00:23:04 **SYN Flood** (from ATM1 Outbound)
09/05/2013 00:23:03 **SYN Flood** (from ATM1 Outbound)
09/05/2013 00:23:02 **SYN Flood** (from ATM1 Outbound)
09/05/2013 00:23:01 **SYN Flood** (from ATM1 Outbound)
09/05/2013 00:22:59 **SYN Flood** (from ATM1 Outbound)
09/05/2013 00:22:59 **SYN Flood** (from ATM1 Outbound)
09/05/2013 00:22:58 **SYN Flood** (from ATM1 Outbound)
09/05/2013 00:22:58 **SYN Flood** (from ATM1 Outbound)
09/05/2013 00:22:58 **SYN Flood** (from ATM1 Inbound)
09/05/2013 00:22:52 **SYN Flood** (from ATM1 Outbound)
09/05/2013 00:22:52 **SYN Flood** (from ATM1 Outbound)
09/05/2013 00:22:52 **SYN Flood** (from ATM1 Outbound)
09/05/2013 00:22:52 **SYN Flood** (from ATM1 Outbound)
09/05/2013 00:22:52 **SYN Flood** (from ATM1 Outbound)
09/05/2013 00:22:52 **SYN Flood** (from ATM1 Outbound)
09/05/2013 00:22:52 **SYN Flood** (from ATM1 Outbound)
09/05/2013 00:22:52 **SYN Flood** (from ATM1 Outbound)
09/05/2013 00:22:52 **SYN Flood** (from ATM1 Outbound)
09/05/2013 00:22:52 **SYN Flood** (from ATM1 Outbound)
09/05/2013 00:22:52 **SYN Flood** (from ATM1 Outbound)
09/05/2013 00:22:52 **SYN Flood** (from ATM1 Outbound)
09/05/2013 00:22:52 **SYN Flood** (from ATM1 Outbound)
09/05/2013 00:22:52 **SYN Flood** (from ATM1 Outbound)
09/05/2013 00:22:52 **SYN Flood** (from ATM1 Outbound)
I also find these in my Event viewer
"Your computer was not able to renew its address from the network (from the DHCP server)"
"A server error occurred. Check that the server is available."
"The IP address lease for the network card with network address has been denied by the DHCP server (The DHCP server sent a DHCPNACK message)"
"Name resolution for the toredo IPV6.microsoft.com timed out after none of the configured DNS servers responded"
and loads of other "timed out after none of the configured DNS servers responded" isatap.lan, dns.msftncsi.com, isatap.Belkin,
I have tried googling them all but I can't find much info, I don't know whether I am getting DDOS attacked, if there is something wrong with my network, or am I just being paranoid ?
Re: Strange Happenings
05-09-2013 10:14 AM
- Mark as New
- Bookmark
- Subscribe
- Subscribe to RSS Feed
- Highlight
- Report to Moderator
I'm not sure if the two things tie together (i.e what you've seen on the router logs and the browsing issues). But the multiple instances of "**SYN Flood**" usually means the router is picking up multiple attempts to open a TCP connection to the router.
AFAIK that could be the router interpreting an issue with a dropping connection (which isn't really reflected on our connection logs) IMHO that's more likely than a DDOS but do your router logs not show an originating IP?
Adam
Re: Strange Happenings
05-09-2013 10:34 AM
- Mark as New
- Bookmark
- Subscribe
- Subscribe to RSS Feed
- Highlight
- Report to Moderator
Removed,
My connection just hangs because of all the traffic. I normally get loads of inbound, but these are nearly all outbound.
Re: Strange Happenings
05-09-2013 10:38 AM
- Mark as New
- Bookmark
- Subscribe
- Subscribe to RSS Feed
- Highlight
- Report to Moderator
I would also check using malwarebytes to see if it had any nasties assuming it is a Win PC
A quick check via VirusTotal indicates a suspected virus
Re: Strange Happenings
05-09-2013 10:42 AM
- Mark as New
- Bookmark
- Subscribe
- Subscribe to RSS Feed
- Highlight
- Report to Moderator
"The traffic is being initiated by a box on your network in this instance 192.168.2.2. So the syn flood is actually coming from your network, not the other way around. How many machines are their on your network. Are you able to provide other ip's that show up on the syn flood attack? Might narrow it down a bit more. It's a pain trying to troubleshoot these things remotely when you don't have access to the machine in question. More ip's might point us in the right direction...."
I will check the malwarebytes OJ, also on my network, I have my computer and a Freesat box, Freesat box is turned off at the mains.
Edit, I have just checked my router DHCP client list and my Mobile was on there too, it was not connected though, anyway I have disabled wifi on my router and the syn floods have slowed down to 2 a minute. So it looks like my mobile phone was the culprit. The only thing I use my mobile for though is checking the weather, and occasionally IMDB and I am not on contract so as soon as I check the weather, I turn the wifi off on my phone.
Thanks for pointing me in the right direction, Oldjim,
I am also thinking that my Mobile is causing the event viewer errors too.
Edit 2,
I am still getting loads of SYN floods, it seems to happen as soon as I open up my web browser homepage, MSN. I have installed Malwarebytes and nothing was found.
Re: Strange Happenings
05-09-2013 12:27 PM
- Mark as New
- Bookmark
- Subscribe
- Subscribe to RSS Feed
- Highlight
- Report to Moderator
If you go away from the homepage or if you change the homepage does it stop
Re: Strange Happenings
05-09-2013 12:38 PM
- Mark as New
- Bookmark
- Subscribe
- Subscribe to RSS Feed
- Highlight
- Report to Moderator
seems strange though that it has only just started happening with having MSN as my homepage, as I have had it as my home page for probably 10 years or longer.
With MSN as my homepage
Re: Strange Happenings
05-09-2013 12:40 PM
- Mark as New
- Bookmark
- Subscribe
- Subscribe to RSS Feed
- Highlight
- Report to Moderator
Re: Strange Happenings
05-09-2013 12:48 PM
- Mark as New
- Bookmark
- Subscribe
- Subscribe to RSS Feed
- Highlight
- Report to Moderator
I guess I will just keep an eye on it and see if it rectifies itself again.
Re: Strange Happenings
05-09-2013 12:52 PM
- Mark as New
- Bookmark
- Subscribe
- Subscribe to RSS Feed
- Highlight
- Report to Moderator
Re: Strange Happenings
05-09-2013 12:58 PM
- Mark as New
- Bookmark
- Subscribe
- Subscribe to RSS Feed
- Highlight
- Report to Moderator
This is what happens when I fire up a game online.
and it just keeps going, I am wondering if all this bandwidth being used is affecting my gaming like it is leaving web pages hanging ?
Edit, Now I am ingame, the floods have stopped, so it has nothing to do with gaming. Maybe you are right ejs, the Belkin has strange security and decides to tell you everything, and really it is no big deal. Maybe it happens to everyone, but only the Belkin routers make note of it. I guess the only thing about it that bothers me is, it stops for a few weeks then comes back with avengeance, and when it comes back, that is when webpages fail to open as though the floods are taking so much bandwidth that it slows my internet to a crawl, but it is only some webpages some of the time, for example I will try and open the creative soundblaster website and it will just hang until an error comes up, yet I can open other pages. When I try and open PN it will just hang, then 5 minutes later it will open as quick as a flash.
Three or four months until I get fibre (fingers crossed) so I will be buying a ASUS router.
Re: Strange Happenings
05-09-2013 6:33 PM
- Mark as New
- Bookmark
- Subscribe
- Subscribe to RSS Feed
- Highlight
- Report to Moderator
Re: Strange Happenings
06-09-2013 1:32 AM
- Mark as New
- Bookmark
- Subscribe
- Subscribe to RSS Feed
- Highlight
- Report to Moderator
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Printer Friendly Page