DoS attacks

setch · 17-01-2005, 20:30

Can anybody assist with DoS attacks? My ip was being hit as below

Mon Jan 17 20:26:30 2005 1 Blocked by DoS protection 10.132.79.254
Mon Jan 17 20:26:30 2005 1 Blocked by DoS protection 10.132.79.254
Mon Jan 17 20:26:31 2005 1 Blocked by DoS protection 10.132.79.254

This occurred every minute of the day 24/7. So I have just managed to change my ip to a new one and guess what, my router log is showing attacks from the same ip again.

This is having a serious effect on my web connection. Is this ip an wholesale attack on all NTL ip addresses?

Setch

nffc · 17-01-2005, 21:02

Probably nothing to worry about, ntl maybe checking for something, or a random port scan.

If you've got the firewall up that proves it's working and nothing to worry about.

Paul K · 17-01-2005, 21:07

Quote:

Originally Posted by setch

Can anybody assist with DoS attacks? My ip was being hit as below

Mon Jan 17 20:26:30 2005 1 Blocked by DoS protection 10.132.79.254
Mon Jan 17 20:26:30 2005 1 Blocked by DoS protection 10.132.79.254
Mon Jan 17 20:26:31 2005 1 Blocked by DoS protection 10.132.79.254

This occurred every minute of the day 24/7. So I have just managed to change my ip to a new one and guess what, my router log is showing attacks from the same ip again.

This is having a serious effect on my web connection. Is this ip an wholesale attack on all NTL ip addresses?

Setch

Could be nothing sinister but if it's affecting your connection and or service you can always report it to the aup team to see what they say.

paulyoung666 · 17-01-2005, 21:09

is this any use to you , just did a bit of googling and found it , as for what it means , i am a complete

Paul K · 17-01-2005, 21:14

Quote:

Originally Posted by paulyoung666

is this any use to you , just did a bit of googling and found it , as for what it means , i am a complete

Well as far as I can remember the 10. addresses are used by ntl for people who have yet to register/ provision their systems properly and so they end up with private 10. IP addresses until they complete the registration. Last time I saw a 10. IP it was when I was setting my sisters connection up to the STB

setch · 17-01-2005, 21:20

Quote:

Originally Posted by paulyoung666

is this any use to you , just did a bit of googling and found it , as for what it means , i am a complete

Another language, but I have just spoken with two mates in my area and they are both being hit by the same IP 10.132.79.254 and have had problems with their connect since before xmas. Some is not right here.

Could this be NTL's own servers going pear shaped?

Setch

Paul K · 17-01-2005, 21:23

Quote:

Originally Posted by setch

Quote:

Originally Posted by paulyoung666

is this any use to you , just did a bit of googling and found it , as for what it means , i am a complete

Another language, but I have just spoken with two mates in my area and they are both being hit by the same IP 10.132.79.254 and have had problems with their connect since before xmas. Some is not right here.

Could this be NTL's own servers going pear shaped?

Setch

You could try PM'ing one of our helpful NTL people to see if they can look into it for you. Usually a cry for help reaps dividends

also are you in this area:

Quote:

Broadband customers in the following areas may currently be experiencing a degraded service such as slow browsing or intermittent access to email. In some cases service may also be lost completely.

Our engineers are working to resolve the issues as soon as possible.

Areas affected: Bishop Stortford, Brighton, Leicester, Harrogate, Poole.

Please accept our apologies for any inconvenience caused.

as there has been an ongoing connection issue since December.

Toto · 17-01-2005, 21:37

Quote:

Originally Posted by setch

Can anybody assist with DoS attacks? My ip was being hit as below

Mon Jan 17 20:26:30 2005 1 Blocked by DoS protection 10.132.79.254
Mon Jan 17 20:26:30 2005 1 Blocked by DoS protection 10.132.79.254
Mon Jan 17 20:26:31 2005 1 Blocked by DoS protection 10.132.79.254

This occurred every minute of the day 24/7. So I have just managed to change my ip to a new one and guess what, my router log is showing attacks from the same ip again.

This is having a serious effect on my web connection. Is this ip an wholesale attack on all NTL ip addresses?

Setch

Looks like an issue on the ntl network in your area, as already said, but I am always sceptical about how a firewall reports faulty network activity.

Firewalls are too quick to report ping activity as a DoS attack based on poorly created rules in the firewall script. That's not your fault, its the software.

Hope your problem gets sorted though

Actually, I've seen that IP address before, it could well be a noisy piece of ntl kit, take a look at this trace route from my ntl cable modem:

Tracing route to www.ntlworld.com [62.253.162.30]
over a maximum of 30 hops:

1 30 ms 10 ms 10 ms 10.226.215.254
2 9 ms 9 ms 9 ms ****-t2cam1-b-ge-wan34-104.inet.ntl.com [80.***.***.***]
3 10 ms 21 ms 9 ms ****-t2core-b-ge-wan61.inet.ntl.com [213.***.***.***]
4 12 ms 21 ms 18 ms win-bb-b-so-220-0.inet.ntl.com [62.253.187.241]

5 13 ms 13 ms 11 ms win-dc-b-v902.inet.ntl.com [62.253.187.226]
6 12 ms 14 ms 22 ms win-dc-a-v901.inet.ntl.com [62.253.160.5]
7 12 ms 14 ms 13 ms www.ntlworld.com [62.253.162.30]

Yup, looks like your uBR may be causing the firewall activity.

rdhw · 18-01-2005, 18:17

Quote:

Originally Posted by setch

Can anybody assist with DoS attacks? My ip was being hit as below

Mon Jan 17 20:26:30 2005 1 Blocked by DoS protection 10.132.79.254
Mon Jan 17 20:26:30 2005 1 Blocked by DoS protection 10.132.79.254
Mon Jan 17 20:26:31 2005 1 Blocked by DoS protection 10.132.79.254

In my opinion, this is not a DoS attack at all. Whatever you are getting this message from is misdiagnosing the situation. In the NTL network where you are, the .254 addresses belong to the NTL head end (the CMTS, or UBR), and these attempts are legitimate network traffic (maybe ARPs, maybe DHCP replies). I would suspect your firewall (or whatever) rather than suspect NTL. If you configure your firewall to permit all access from 10.132.79.254, then these messages will go away.

setch · 18-01-2005, 18:21

Quote:

Originally Posted by rdhw

In my opinion, this is not a DoS attack at all. Whatever you are getting this message from is misdiagnosing the situation. In the NTL network where you are, the .254 addresses belong to the NTL head end (the CMTS, or UBR), and these attempts are legitimate network traffic (maybe ARPs, maybe DHCP replies). I would suspect your firewall (or whatever) rather than suspect NTL. If you configure your firewall to permit all access from 10.132.79.254, then these messages will go away.

Thanks for the information rdhw, I will continue to pester NTL for answer as to why I have had no service since 24th Dec.

Setch

rdhw · 18-01-2005, 18:45

Quote:

Originally Posted by setch

I will continue to pester NTL for answer as to why I have had no service since 24th Dec.

Might it be because your firewall has been blocking essential traffic from NTL that would enable your connection if it were let through?