DoS attacks
 

Can anybody assist with DoS attacks? My ip was being hit as below

Mon Jan 17 20:26:30 2005 1 Blocked by DoS protection 10.132.79.254
Mon Jan 17 20:26:30 2005 1 Blocked by DoS protection 10.132.79.254
Mon Jan 17 20:26:31 2005 1 Blocked by DoS protection 10.132.79.254

This occurred every minute of the day 24/7. So I have just managed to change my ip to a new one and guess what, my router log is showing attacks from the same ip again.

This is having a serious effect on my web connection. Is this ip an wholesale attack on all NTL ip addresses?

Setch

Re: DoS attacks
 

Probably nothing to worry about, ntl maybe checking for something, or a random port scan.

If you've got the firewall up that proves it's working and nothing to worry about.

Re: DoS attacks
 

Could be nothing sinister but if it's affecting your connection and or service you can always report it to the aup team to see what they say.

Re: DoS attacks
 

is this any use to you , just did a bit of googling and found it , as for what it means , i am a complete :dunce: :D :D :D :D

Re: DoS attacks
 

Well as far as I can remember the 10. addresses are used by ntl for people who have yet to register/ provision their systems properly and so they end up with private 10. IP addresses until they complete the registration. Last time I saw a 10. IP it was when I was setting my sisters connection up to the STB :shrug:

Re: DoS attacks
 

Another language, but I have just spoken with two mates in my area and they are both being hit by the same IP 10.132.79.254 and have had problems with their connect since before xmas. Some is not right here.

Could this be NTL's own servers going pear shaped?

Setch

Re: DoS attacks
 

You could try PM'ing one of our helpful NTL people to see if they can look into it for you. Usually a cry for help reaps dividends ;)
also are you in this area:
as there has been an ongoing connection issue since December.

Re: DoS attacks
 

Looks like an issue on the ntl network in your area, as already said, but I am always sceptical about how a firewall reports faulty network activity.

Firewalls are too quick to report ping activity as a DoS attack based on poorly created rules in the firewall script. That's not your fault, its the software.

Hope your problem gets sorted though :)

Actually, I've seen that IP address before, it could well be a noisy piece of ntl kit, take a look at this trace route from my ntl cable modem:


Tracing route to www.ntlworld.com [62.253.162.30]
over a maximum of 30 hops:

1 30 ms 10 ms 10 ms 10.226.215.254
2 9 ms 9 ms 9 ms ****-t2cam1-b-ge-wan34-104.inet.ntl.com [80.***.***.***]
3 10 ms 21 ms 9 ms ****-t2core-b-ge-wan61.inet.ntl.com [213.***.***.***]
4 12 ms 21 ms 18 ms win-bb-b-so-220-0.inet.ntl.com [62.253.187.241]

5 13 ms 13 ms 11 ms win-dc-b-v902.inet.ntl.com [62.253.187.226]
6 12 ms 14 ms 22 ms win-dc-a-v901.inet.ntl.com [62.253.160.5]
7 12 ms 14 ms 13 ms www.ntlworld.com [62.253.162.30]

Yup, looks like your uBR may be causing the firewall activity.

Re: DoS attacks
 

In my opinion, this is not a DoS attack at all. Whatever you are getting this message from is misdiagnosing the situation. In the NTL network where you are, the .254 addresses belong to the NTL head end (the CMTS, or UBR), and these attempts are legitimate network traffic (maybe ARPs, maybe DHCP replies). I would suspect your firewall (or whatever) rather than suspect NTL. If you configure your firewall to permit all access from 10.132.79.254, then these messages will go away.

Re: DoS attacks
 

Thanks for the information rdhw, I will continue to pester NTL for answer as to why I have had no service since 24th Dec.

Setch

Re: DoS attacks
 

Might it be because your firewall has been blocking essential traffic from NTL that would enable your connection if it were let through?