Advertisement
If you have a new account but are having problems posting or verifying your account, please email us on hello@boards.ie for help. Thanks :)
Hello all! Please ensure that you are posting a new thread or question in the appropriate forum. The Feedback forum is overwhelmed with questions that are having to be moved elsewhere. If you need help to verify your account contact hello@boards.ie
Hi there,
There is an issue with role permissions that is being worked on at the moment.
If you are having trouble with access or permissions on regional forums please post here to get access: https://www.boards.ie/discussion/2058365403/you-do-not-have-permission-for-that#latest

Smurf Attacks?????

  • 19-09-2009 12:10am
    #1
    Prisoner6409
    Registered Users, Registered Users 2 Posts: 666 ✭✭✭


    I have been having some issues with my Internet connection lately, slow downloads and some dropped lines, as I'm with Eircom and others here have reported similar issues from time to time I was not that concerned and other than a call to Eircom support I was going to do just that. In the meantime I checked the logs on my router/modem and I came across this in the Security Log on my Router/Modem:


    ==================================================
    09/18/2009 22:39:56 sending ACK to 192.168.2.2
    09/18/2009 22:39:55 **Smurf** 169.254.255.255->> 169.254.242.22, Type:3, Code:3 (from PPPoE1 Outbound)
    09/18/2009 22:39:54 sending OFFER to 192.168.2.2
    09/18/2009 22:26:21 sending ACK to 192.168.2.2
    09/18/2009 22:26:21 sending OFFER to 192.168.2.2
    09/18/2009 22:19:13 sending ACK to 192.168.2.2
    09/18/2009 22:19:12 **Smurf** 169.254.255.255->> 169.254.242.22, Type:3, Code:3 (from PPPoE1 Outbound)
    09/18/2009 22:19:11 sending OFFER to 192.168.2.2
    ====================================================

    When I googled it(smurf) I saw a lot about a smurf attack. Does the log indicate an attack on my system. I have seen it a few times in the last week since I began checking the log. The only other strange thing(to me) is sometimes the log will display 2 mac address entries for my PC, and another mac address with no description, like this:

    ip=192.168.2.2 mac=00-04-4B-15-AB-A4 name=Gerrys-PC
    ip=192.168.2.3 mac=00-04-4B-15-AB-A4 name=Gerrys-PC
    ip=192.168.2.4 mac=00-1F-5B-6A-1C-E5

    I'm not sure if anything is related here but am a bit concerned about the smurf issue as all I could find when I googled it was articles about attacks. Anyone know if the above is normal or is there something I should be doing about it. I have KIS 2010 installed and up to date and am using Kasperskys firewall not the windows one.


Comments

  • #2
    roryq
    Registered Users, Registered Users 2 Posts: 164 ✭✭roryq


    That is def a DOS attack.. I personally would be running malwarebytes and then a full AV scan..


  • #3
    John1000
    Closed Accounts Posts: 41 ✭John1000


    It's a false alarm. 169.254.x.x is used by windows when it cant get an IP address. My guess is that you have a dodgy network cable or maybe
    interference on your wireless network.

    BTW. 00-1F-5B-6A-1C-E5 is from MAC address from an Apple device maybe an iphone.


  • #4
    Prisoner6409
    Registered Users, Registered Users 2 Posts: 666 ✭✭✭Prisoner6409


    Thanks guys. I'm leaning toward a dodgy line. I've noticed my SN Ratio which was never great(6db) is sometimes reading 0.5 db or even 0.0db. Time to ring Eircom I guess.


Advertisement