Igmp

[thenry]

Hi, do I need IGMP enabled on my router for virgin media? its currently off.

[qasdfdsaq]

No.

[General Maximus]

without going into detail (you can google igmp if you want) I can quite confidently say that you are never going to use igmp

[thenry]

apologies for the late reply, thanks.

what about WAN Ping Blocking - Block ICMP Ping? I'm a VM customer, will me blocking ICMP pings affect the way VM communicates with my modem/router etc.? will it cause a problem?

I'm trying to secure my set up because of the following, and because its become known to me that there has been activity of sort going on before I done my best to stop it which resulted in my router firewall blocking the events below....

ICMP packet magnification (or ICMP Smurf): An attacker sends forged ICMP echo packets to vulnerable networks' broadcast addresses. All the systems on those networks send ICMP echo replies to the victim, consuming the target system's available bandwidth and creating a denial of service (DoS) to legitimate traffic.
http://www.ids-sax2.com/articles/Blo...MPmessages.htm

my router firewall log:

05/26/2011 03:25:24 **Smurf** 0.0.0.0, 4096->> 192.168.2.1, 53 (from LAN1 Inbound)
05/26/2011 03:19:53 **Smurf** 0.0.0.0, 4096->> 192.168.2.1, 53 (from LAN1 Inbound)
05/26/2011 02:34:43 **Smurf** 0.0.0.0, 4096->> 192.168.2.1, 53 (from LAN1 Inbound)
05/26/2011 02:32:04 **Smurf** 0.0.0.0, 4096->> 192.168.2.1, 53 (from LAN1 Inbound)
05/25/2011 18:06:38 **Smurf** 0.0.0.0, 4096->> 192.168.2.1, 53 (from LAN1 Inbound)
05/25/2011 09:52:55 **Smurf** 0.0.0.0, 4096->> 192.168.2.1, 53 (from LAN1 Inbound)
05/24/2011 16:44:23 **Smurf** 0.0.0.0, 4096->> 192.168.2.1, 53 (from LAN1 Inbound)
05/24/2011 08:39:08 **Smurf** 0.0.0.0, 4096->> 192.168.2.1, 53 (from LAN1 Inbound)
05/23/2011 15:28:25 **Smurf** 0.0.0.0, 4096->> 192.168.2.1, 53 (from LAN1 Inbound)
05/23/2011 09:01:22 **Smurf** 0.0.0.0, 4096->> 192.168.2.1, 53 (from LAN1 Inbound)
05/22/2011 15:47:01 **Smurf** 0.0.0.0, 4096->> 192.168.2.1, 53 (from LAN1 Inbound)
05/22/2011 09:47:04 **Smurf** 0.0.0.0, 4096->> 192.168.2.1, 53 (from LAN1 Inbound)
05/21/2011 19:28:09 **Smurf** 0.0.0.0, 4096->> 192.168.2.1, 53 (from LAN1 Inbound)
05/21/2011 10:06:37 **Smurf** 0.0.0.0, 4096->> 192.168.2.1, 53 (from LAN1 Inbound)
05/20/2011 19:35:54 **Smurf** 0.0.0.0, 4096->> 192.168.2.1, 53 (from LAN1 Inbound)

I don't down or up torrents.

[General Maximus]

you can disabled it without it having any adverse affects on your connectivity, I have done it on my router. All it does it stop people from being able to ping you which can prevent DOS attacks. All it will mean though is that if anyone tries to ping you to assess your connectivity it will look like your connection is down. Like if you think you are having problems and ping www.google.com to test your connection, if it comes back as destination unreachable or a timeout, you would think you had problems but it might just mean that google are blocking icmp echo requests. This is what people would get if they tried to ping you.

[AbyssUnderground]

Originally Posted by General Maximus

you can disabled it without it having any adverse affects on your connectivity, I have done it on my router. All it does it stop people from being able to ping you which can prevent DOS attacks. All it will mean though is that if anyone tries to ping you to assess your connectivity it will look like your connection is down. Like if you think you are having problems and ping www.google.com to test your connection, if it comes back as destination unreachable or a timeout, you would think you had problems but it might just mean that google are blocking icmp echo requests. This is what people would get if they tried to ping you.

Wrong. It doesn't prevent DOS attacks. All it does as you say is make your connection appear down.

Don't worry about it. The IP's in your log are local network IP's and probably the router being a bit over sensitive.

[General Maximus]

if you disable icmp echo requests your router with automatically drop the packets which will stop you from being pinged to death

[pip08456]

Rather than being paranoid the question you should be asking is "Why would someone want to ping me to death? Who've I upset?"

If the answer to that is negative there is no real need to worry.

[thenry]

Thanks all.

What am I suppose to do about these smurf attacks? I think I know 99.99% whos doing this and it is all about "consuming the system's available bandwidth".

Heres my log so far today,

05/26/2011 17:12:36 **Smurf** 0.0.0.0, 4096->> 192.168.2.1, 53 (from LAN1 Inbound)
05/26/2011 13:31:29 **Smurf** 0.0.0.0, 4096->> 192.168.2.1, 53 (from LAN1 Inbound)
05/26/2011 09:08:06 **Smurf** 0.0.0.0, 4096->> 192.168.2.1, 53 (from LAN1 Inbound)

I just logged onto my PC at 5.12pm and the firewall blocked something straight away. Is the person I think doing this still able to use my connection?

I've scanned my systems connected with nod32, malwarebytes, super antispyware, systweaks system protector... so many programs, they all find nothing. By the way, all these softwares are not running at the same time, I only have nod32 running for real time and malwarebytes as on-demand.

[thenry]

anyone got anything to offer as in advice? I know theres no clear fix but I've heard that the new superhubs VM supply are hard to clone, any truth in that? Although my modem seems ok'ish, it does seem like someone is trying to clone it would the superhub stop attempts of cloning of my services? if so, which superhub so I go for as many thread suggest some models are not good.

[General Maximus]

Originally Posted by thenry

it does seem like someone is trying to clone it

interesting. So what does someone trying to clone your modem look like then? They either do or they dont, and you either have network access or you dont. It isnt something you can see or feel through degradation or performance.

[thenry]

I understand but the icmp attacks if successful can eat up bandwidth. The statement above confirms that and past experience of my service/broadband was cloned before when I wasn't linked to a router. 1 system was linked to the modem directly, the av installed at the time wasn't the best and the firewall was flawed as it was set to allow all in from set connection instead of being set up correctly along with decent av/spyware monitors. The attempts to clone then were sucessful which did have an impact on my bandwidth/bb performance. My modem was then replaced after VM looked into it, I linked it up to a router and ever since I get constant attempts of these smurfs. I've cleaned all my systems with various scanners, nothing found.

[pip08456]

Originally Posted by thenry

I understand but the icmp attacks if successful can eat up bandwidth. The statement above confirms that and past experience of my service/broadband was cloned before when I wasn't linked to a router. 1 system was linked to the modem directly, the av installed at the time wasn't the best and the firewall was flawed as it was set to allow all in from set connection instead of being set up correctly along with decent av/spyware monitors. The attempts to clone then were sucessful which did have an impact on my bandwidth/bb performance. My modem was then replaced after VM looked into it, I linked it up to a router and ever since I get constant attempts of these smurfs. I've cleaned all my systems with various scanners, nothing found.

I apologise first if what I say offends you.

You are a paranoid idiot who seems to have Gooled without understanding what you have found.

The adage "a little knowledge is dangerous" comes to mind.

Again, sorry if my post offends.

[thenry]

No need to apologise, I admit I'm paranoid and I have little knowledge. I'm speaking from past experience and google search, it might not even be cloning - attempts to get online via my service details. In the case of it not being anything to do with cloning.... I apologise.

[pip08456]

No need to apologise at all. Just stop worrying about nothing.