Belkin Router Getting Hammered

[ulstersam]

Hi folks, I'm wondering if anyone can give me some advice. I have a Belkin N1 wireless router hooked up to my Virgin Media modem, I am continuely getting hammered and the security light flashes like its a disco light. Belkin are of NO HELP they are useless and just tell me to change the security settings which I have done several times but within a few minutes the security lock light is flashing like mad again. The strange thing is that it doesn't do it when I'm accessing the web via my laptop as I'm doing now, just when the main PC is connected. Its running Windows XP and the laptop is running Windows 7 Ultimate

Its driving me NUTS!

Any help would be very gratefully excepted.


Many thanks in advance

Sam

[mjpartyboy]

Have you run a spyware and virus scan on the problem machine to see if it has been infected with something that's trying to make calls out?

[MovedGoalPosts]

Do the router logs give any indication of the traffic that it setting off the security light warnings?

[ulstersam]

The spyware and virus scans were the first thing I did, however, it was a fresh install from a genuine Windows XP disc and wasn't connected to the internet when I was doing the install but this has been going on long before the reinstall. As for the router logs that I'm afraid is completely Swedish to me, they were saying about this port and that port and it seemed as if all these attacks were coming from China. Now as it happens I have just reset he router again for the unteenth time and reset the security and the blue padlock security light is not blinking however, I'll bet a biscuit to a Barncake that before long the bloody thing will be flashing like the light on a traffic cops car, oh and just when I'm here, the globe which denotes thew internet is on is flashing as well now - only occassionally but its flashing. I never had these problems when I had a Netgear set up.

[Raistlin]

Did the Netgear have the same 'Security' light that the Belkin has?

[ulstersam]

Originally Posted by Rob M

Did the Netgear have the same 'Security' light that the Belkin has?

Good point actually, no it didn't, I've just had a look at my old router, so maybe the same thing was happening and I just didn't know about it.

[Raistlin]

Bingo.

What you're seeing is what is sometimes referred to as 'backrgound' noise.

The Internet is a fairly hostile place, most IP ranges are scanned regularly by either automated 'bots' or individuals looking to cause trouble - it is not unusual for these scans to appear to originate from places like China.

The 'Security' light on your router is merely telling you that an action has been taken as a result of a security 'schema' that is enabled/configured within it. In layman's terms, it's telling you that it's done something - obviously that doesn't really help you to establish what it has done.

All you can really do is:

1. Ensure that your boundary protection is configured as securely as possible:

• Lock down the router: Ensure that you changed the default passwords on the Admin Control Panel, and set strong passwords for any wireless connections that you're using. Make sure that the router isn't allowing Administration from the Internet (usually an option on its own). Enable the HTTPS option for Administering the router on your local network (if possible);
• Shore Up Your Defences: Set the router to drop/ignore any 'anonymous' requests from the Internet, and make sure that the firewall (or SPI) functionality is switched on;
• Close The Doors: Turn off any unnecessary services that the router might be running (sometimes routers will run SSH, Telnet, FTP, etc - if you're not using them, and you're able, then disable them).

2. The next line of defence is your PC/Laptop:

• Scan/Scan/Scan: Run a fully updated Antivirus program on all your PCs. Scan any files that you download before opening, the same goes for any attachments on emails (even if you're expecting them). Schedule full scans of your systems for convenient times (once every few weeks should be sufficient;
• Block/Block/Block: Run a seperate software firewall on your PCs. Block any unknown applications from accessing the Internet until you know what they are and that the access if legitimate/required. Ensure that the only things running through the firewall are things that you have allowed, or that you know should be going through it;
• Patch/Patch/Patch: Keep your operating system, and all software on it, as up to date as possible. As a minimum make sure that any critical Windows patches are applied - MS release patches marked as 'critical' for a reason

3. The final line of defence is you. Think about what you're doing, what sites you're visiting, what files you're downloading/opening. Keep on top of your patching and security maintenance. Think about what software you're running, and what you're installing, if you don't need it (or if you don't know where it's come from) then don't run it - better safe than sorry.

I know a lot of that sounds preachy, and if I'm teaching you to suck eggs then I apologise - all I guess I'm really trying to say is that you just need to make as sure as you can that you've got everything tied down and secured. Beyond that there's not a lot else you can do, if you're gonna get hacked then you're gonna get hacked - there's always something nasty just around the corner. The thing is that if you spend all your time worrying about it you're never going to get any fun from the Internet.

If the flashing light's bothering you that much then just stick something over it

[tweetiepooh]

Some routers (my Belkin for one) don't handle port 135 like other ports. I had to pass 135 ports to a non-existant internal IP to make it look invisible. Even so you are likely to get hit by scans but provided you drop all external requests they shouldn't see you so easily. You'll still get drops in the firewall log but less likely to be someone directly targeting you.

[ulstersam]

Thanks guys for all your help.