Xfin_user's profile

Contributor

 • 

29 Messages

Sat, Jan 9, 2021 6:00 PM

DoS Attack ???

I was experiencing random dropoffs on some websites only. The connection would be up and fine and I can browse and everything but some websites woudl just stop working. I started looking into it and noticed that exact at that time these DoS Attack messages were there in the router log.

Its a NG C7000 V2. and the dos attack prevention option is On. 

Is this something to be concerned about ? Is that 75.75.75..... ip the comcast dns ? whats goin on here ? Please advise.

 

[DoS attack: TCP- or UDP-based Port Scan] from 75.75.75.75, port 53

DoS attack: TCP- or UDP-based Port Scan] from 75.75.76.76, port 53

[DoS attack: TCP- or UDP-based Port Scan] from 75.75.75.75, port 53

[DoS attack: SYN Flood] from 13.68.247.210, port 443

[DoS attack: SYN Flood] from 35.166.131.228, port 443

[DoS attack: SYN Flood] from 44.233.3.2, port 443

[DoS attack: SYN Flood] from 151.101.42.49, port 443

[DoS attack: SYN Flood] from 104.214.58.194, port 443

 

Responses

EG

Expert

 • 

87.2K Messages

5 m ago

No. That is regular Comcast DNS server queries / traffic on DNS port 53. Your firewall is being a hypochondriac in its announcements. It is doing its job.

Xfin_user

Contributor

 • 

29 Messages

5 m ago

Ok. Couple of questions -

Would the router/firewall then disable or halt any traffic ? because thats what seems to be happening, although not all traffic.

Has anything changed recently with comcast dns ? Never had this problem before, except in the last 3-4 weeks.

EG

Expert

 • 

87.2K Messages

5 m ago

Not any traffic that is allowed by your firewall rules or any traffic that is first initiated from inside your LAN. Only unsolicited traffic from the WAN / internet. This is a basic description.

Xfin_user

Contributor

 • 

29 Messages

5 m ago

Why is there incoming traffic from dns ? Shouldn't it be just outgoing ?

New to the Community?

Start Here