Feels like a DoS? - Page 1
Forum section: electronics / general

author: T3sl4co1l
author_rank: Super Contributor
timestamp: September 22, 2016, 04:30:03 am
content: My web server is getting a huge amount of data (more or less saturating the connection) and it doesn't seem to be going anywhere on the network. It dead-ends at the router.On the router, I can get a list of internet sessions, but no clue about rate. Anyway, none of the connections are to the router itself (which makes sense, as it isn't forwarded to the outside world).It persists even if I turn off all computers and reset the modem and router.The wired network is fixed (only two computers are connected, one of which is off), and the wireless network does not broadcast (among other settings). MAC filtering is turned on, so it's highly unlikely there are invisible, unauthorized connections (at least, on the face of it).Router is DIR-601 with 1.04NA firmware.Ideas?Tim

author: rstofer
author_rank: Super Contributor
timestamp: September 22, 2016, 04:40:17 am
content: I always thought the reporting capabilities of the Smoothwall firewall were worth having around. It is amazing how many probes you get per hour.There are two varieties, one is commercial and the other is community Open Source. I never tried the commercial variant.

author: Muxr
author_rank: Super Contributor
timestamp: September 22, 2016, 04:51:20 am
content: How many sessions/connections are we talking. Also which protocol and destination port? Is your router being overloaded? What's the CPU/memory utilization at the router?Any way you can do a netstat and determine the state of those connections? Are they being established or are they just syn or reset?

author: System Error Message
author_rank: Frequent Contributor
timestamp: September 22, 2016, 04:59:20 am
content: Firstly did you check the LAN interface as well? Does data rates on WAN and LAN interface match?What router do you have? If you have a configurable router odds are there will be an option called tarpit. Tarpit can be used to reduce DoS attacks that use TCP packets.Are you hosting behind the router? There is a dynamic firewall logic that can be used to detect a scan/intrusion attempt and than automatically blacklist which you can go further to use tarpit on the blacklist for tcp packets and dropping the rest.

author: ivaylo
author_rank: Frequent Contributor
timestamp: September 22, 2016, 06:41:48 am
content: What OS and web server? Like others said, if Unix of sorts use netstat to see originating IP addres then block at the router or firewall. If really an attack and somewhat sophisticated they may be jumping IPs. But it could be just your ISP messing with your connection...

author: T3sl4co1l
author_rank: Super Contributor
timestamp: September 22, 2016, 07:14:36 pm
content: Quote from: Muxr on September 22, 2016, 04:51:20 am1. Unsure. There's typically a few dozen connections shown, but they all connect to a computer. None dead-end at the router or cable modem.2. Don't know.3. The router, no. Local traffic is unaffected.4. Don't know.5. Don't know. Is there a port to ssh into a DIR-601?I suppose at this point I should install DD-WRT...Tim

author: T3sl4co1l
author_rank: Super Contributor
timestamp: September 22, 2016, 07:17:51 pm
content: Quote from: ivaylo on September 22, 2016, 06:41:48 amWin7 x64, IIS7. Netstat doesn't show anything weird. But like I said, the router itself doesn't show anything unreasonable connecting to the server itself. The server's network meter doesn't show any activity, while the cable modem is screaming like a banshee.I've tested physically unplugging all computers from the router, and the internet traffic persists.QuoteI suppose I should call them and see...Anticipating unhelpful responses...Tim

author: System Error Message
author_rank: Frequent Contributor
timestamp: September 22, 2016, 07:32:41 pm
content: I've had this sort of issue before. An ad based botnet detects you have a web server running, it than tries to run code to get your server/router to browse as many sites as possible. If you were to check the IPs they link back to amazon aws.The best way to defeat this is simply change the port and use a DNS redirection, added with a rule to blacklist IPs that attempt to communicate on a closed port. This will effectively defeat port scans as well.

author: matseng
author_rank: Frequent Contributor
timestamp: September 23, 2016, 05:59:10 am
content: You said cable modem... It is not that uncommon that older installations are not segmented per customer, so you will at the WAN side see all your neighbors traffic as well. This will make your wan-light flash hysterically but it's filtered out before hitting your lan/wifi.Cable modems share the same wire with all your neighbors unlike a dsl pipe where you have your own wire all the way the the dslam/router of your isp.

author: Berni
author_rank: Super Contributor
timestamp: September 23, 2016, 07:37:10 am
content: Its normal to have a random ping or connection request come in every so often due to people portscaning the internet. But i have never seen so much traffic to saturate a internet connection.I would first give the ISP a call in case they misconfigured a piece of network gear somewhere and sent a whole lot of other peoples traffic your way (If your ISP is a giant company have fun explaining something this technical to the work experience student on the other side of the phone that has no idea how the internet works).There is not a whole lot you can do if you have tons of traffic barfing out the modem since by the time it makes it to your modem it already went trough all the internet pipes.Oh and yes DSL modems share one giant fat downlink signal for the entire street where each modem only picks out the traffic meant for it. I don't know if a modem can be accidentally configured to pick all of it out, but i do know that modern cable DSL systems use lots of encryption to make sure other peoples modems can't understand the traffic that is destined for you. Also for modern docsys 3 standard DSL that aggregated downstream pipe can be huge at over 1GBit/s as well as they use multiple downstream frequencies to fit multiple of those in for some mind blowing bandwidth over the poor old coax cables.

author: nessatse
author_rank: Regular Contributor
timestamp: September 23, 2016, 08:23:50 am
content: Quote from: Berni onTodayat 08:37:10No, that is not how DSL worksRegarding DoS attacks, one I have frequently seen is the using DSL routers as 'bots' for distributed DNS amplification. (https://en.wikipedia.org/wiki/Denial-of-service_attack#Amplification) Some DSL modems, usually older models, allow DNS recursive queries on their WAN ports, allowing attackers to use these devices to launch attacks Users are usually completely unaware of this happening, only perhaps complaining of slow downloads. Being UDP, you would of course not see any connections in netstat. In fact, the traffic is only on the WAN side of the modem/router, so it is unlikely that you would have any easy way of seeing it.

author: T3sl4co1l
author_rank: Super Contributor
timestamp: September 23, 2016, 05:24:00 pm
content: What's really strange to me is, while this is happening, the router is sending many more packets than it receives. Which is the worst part, because the connection is asymmetrical (no, not the best choice for a server).Tim

author: Twoflower
author_rank: Frequent Contributor
timestamp: September 23, 2016, 05:58:21 pm
content: Hmm, could it be the other way around? You're part of a botnet to DDos someone else? Having this one in mind:http://www.theinquirer.net/inquirer/news/2471749/brian-krebs-blog-banged-in-bloody-massive-ddosEven Akamai gave up to the load of >660Gbps peaks! Especially since you say it's more outgoing than incoming traffic. And yes sending traffic to the limit has an impact on incoming traffic if the handshake is not coming through.First thing would be to identify the source/destination.Maybe you can try to check this by unplug the PC while this happens and check the traffic on the router. Any tools on an infected PC might show invalid data but you can give it a try: In the command window use netstat -a -b (assuming you're using Windows). As there usually lots of open connections it make sense to shut down as many programs as possible to minimize the list. Maybe this can give you some indication. **EDIT: Just noticed that I oversaw the part "If I turn off..."**Or your router obeys to a different owner. That wouldn't be the first time that routers are overtaken by others. They're nice targets as they usually run 24/7 and can hardly controlled by the user.

author: rrinker
author_rank: Super Contributor
timestamp: September 23, 2016, 06:04:36 pm
content: That could be simply something on the inside generating traffic. Perhaps the server is already compromised and sending out stuff. Or, as I once found at work, years ago, a hidden ftp site on one of the servers generating tons of traffic, almost all of it outbound as the files (several popular movies) were loaded in a hidden directory and the FTP service itself was running as a service with a vastly different name (that looked legitimate).

author: T3sl4co1l
author_rank: Super Contributor
timestamp: September 23, 2016, 06:08:40 pm
content: Quote from: rrinker on September 23, 2016, 06:04:36 pmI repeat: the traffic is present even with all computers physically unplugged from the router.Tim

author: Twoflower
author_rank: Frequent Contributor
timestamp: September 23, 2016, 06:39:59 pm
content: You might get in contact with your ISP. They might be able to help as they don't like DoS traffic in the own network. Or at least give you some hints.If this is not an option or they can't help check if you can borrow a DSL router to see if the router causes the traffic. I think I've seen some news about D-Link routers in relation to backdoors. By the way you have the A-Version of the DIR-601, don't you?All other ideas that come to my mind needs some special setup. And it comes with some downtime and risk. Something like this comes to my mind: Using the DSL-Router as DSL-Modem (this disables the NAT and feeds through all traffic). Using a PC* with Wireshark to get a look into the incoming packets to get some understanding if they're somewhat expected or if it's just junk. How many sources; a Single IP address could indicate a misconfigured script on the far end, many IPs might indicate a DDos.* Preferred a live-linux e.g. Grml as it has the lools and don't mount the harddrives writeable as this is somewhat risky to catch some malware as the PC is under such network configuration fully exposed to the Internet.

author: SeanB
author_rank: Super Contributor
timestamp: September 24, 2016, 09:26:39 am
content: Restart the router ( power cycle, not via the UI interface) and then force download the latest version of the router/cable modem firmware.That will at least ensure you are not running a Botnet server on there, and if it persists turn it off for around 6 hours and hope the IP address changes to another not being DDOSed by the guys who are after the neighbour's IP address to keep them off a game.

author: System Error Message
author_rank: Frequent Contributor
timestamp: September 24, 2016, 06:35:24 pm
content: You still havent mentioned what router/modem you use. If you do it would help as i know quite well the type of routers that are vulnerable to this sort of stuff.

author: Galaxyrise
author_rank: Frequent Contributor
timestamp: September 24, 2016, 07:43:43 pm
content: Since it gets to your web server when the web server is running, but still persists even when the web server is disconnected, I presume your router has a public IP and is port forwarding to your web server. And so the large volume of traffic is presumably something targeting that port. Does the bandwidth pattern change when the web server is disconnected? I would probably use Wireshark to determine the nature of the traffic, but if it's a DoS, you'll probably need your ISPs help to block it.

author: System Error Message
author_rank: Frequent Contributor
timestamp: September 26, 2016, 06:54:45 am
content: as the post above said but the router can actually defend you against it. It would help however if you mention what router you have as you need ACLs or a configurable router for this. Mikrotik has their own format, ubiquiti has their own format and some routers/linux use IPtables that also have their own format.First you will need to get yourself a new public IP. What you need to do is to block port scans so create a rule to whitelist the ports/services needed. In my case if i use PPTP on my router i create a rule to allow traffic on input to that port and also to allow the GRE protocol. Than i accept input from a dynamic output whitelist. Than add attempted inputs onto a blacklist and use tarpit for tcp and drop for everything else. Add a rule on output that temporary adds the IP address to the dynamic output whitelist.This is the simplest firewall setup that will prevent a DoS or DDoS attack unless however you host a very famous website. http uses TCP and tarpit is a resource efficient way of blocking. What it does is slow down the host to the point where the connection stays opened but no data comes through. I've used this and was very effective dealing with this sort of attack you deal with. From the full line being used to a few pps (packets per second).

author: T3sl4co1l
author_rank: Super Contributor
timestamp: September 26, 2016, 03:17:44 pm
content: Quote from: System Error Message on September 26, 2016, 06:54:45 amQuote from: System Error Message on September 22, 2016, 04:59:20 amQuote from: System Error Message on September 24, 2016, 06:35:24 pmSorry but can't anyone read anymore these days? Is everyone addicted to 140 character catchphrases and everything else ignored?Quote from: T3sl4co1l on September 22, 2016, 07:14:36 pmQuote from: T3sl4co1l on September 22, 2016, 04:30:03 amQuote from: Twoflower on September 23, 2016, 06:39:59 pmOh and to respond to this one that I missed earlier, yes, it's the A version.QuoteThat makes sense, and sounds good. Guessing I'd need at least DD-WRT to implement that, if not something fancier altogether?Tim

author: madires
author_rank: Super Contributor
timestamp: September 26, 2016, 03:40:02 pm
content: Possibly a hacked router running some bot. D-Link had tons of security issues in their SOHO routers the last few years and fixed some of them only after media took notice and published several articles. BTW, you can't defend yourself against a DDoS at the end of a tiny pipe. A proper DDoS attack creates up to around 1Tbit/s traffic nowadays. Brian Krebs' web site (security researcher) was hit by a DDoS with roughly 600GBit/s a few days ago. And he was lucky having a sponsored DDoS protection service.

author: T3sl4co1l
author_rank: Super Contributor
timestamp: September 26, 2016, 03:54:15 pm
content: Oh, definitely. That's why I said DoS. It only takes a couple connections to saturate the poor thing. Hardly any distribution necessary!Tim

author: Twoflower
author_rank: Frequent Contributor
timestamp: September 26, 2016, 05:01:56 pm
content: Have you the chance to rule out that the router itself causes the traffic? Eventually a factory reset might do the trick. But if you think to use DD-WRT (I think that might be a good idea) that would most likley also wipe out any bot on the box.Quote from: madiresErm to my understanding: He had (past) because of the traffic he got kicked out from Akamai. One of the biggest load-balancer companies. But to be fair: As you mentioned he didn't paid for the service. By the way the traffic was generated from all kind of machines, including webcams androuters.

author: madires
author_rank: Super Contributor
timestamp: September 26, 2016, 05:27:59 pm
content: Quote from: Twoflower on September 26, 2016, 05:01:56 pmHe mentioned that the traffic persists when nothing is attached to the LAN.Quote from: Twoflower on September 26, 2016, 05:01:56 pmI think, Akamai would prefer the term 'CDN'The costs of the DDoS were going to exceed Akamai's sponsoring budget for Brian. But he found a new one, Google. I'd assume they can take a harder hit

author: Twoflower
author_rank: Frequent Contributor
timestamp: September 26, 2016, 05:41:54 pm
content: Quote from: madires on September 26, 2016, 05:27:59 pmYes this indicates that the router could be trigger the traffic if a bot is installed on the router. At least if you not count the Cable-Modem<-->Router connection as LAN. And Tim says:Quote from: T3sl4co1l on September 23, 2016, 05:24:00 pmBy the way MAC filter don't help much if you really want to come in. At least if something is connected to the WLAN. Someone can sniff the MAC address of that client and disguise yourself byborrowthat MAC address. The same applies to hiding the SSID. Which actually can led to a security problem.

author: System Error Message
author_rank: Frequent Contributor
timestamp: September 26, 2016, 05:57:34 pm
content: d-link is terrible in terms of security and firmware, sometimes hardware too.I suggest installing openwrt and applying the ACL logic i mentioned. See the firewall section on openwrt for more info. I know openwrt is configurable, not sure how much it is with dd-wrt. Basically you need to be able to use ACLs and address lists together for this to work. You may want to adjust the blacklist to have a limited time such as 1 hour or even a day.I guess i must've missed the post where you mentioned the router you had.port 80 is usually always checked so my suggestion is to use another port and use domains (DDNS has a feature like this). unless your site is famous scans and attacks are always ip based, they never really look at the domain associated with the ip.