Hello all,

• 2013/02/26 11:19:13 -- [DOS][Block][trace_route][81.145.150.253:60217->217.155.64.19:33434][UDP][HLen=20, TLen=71]2013/02/26 11:19:14 -- [DOS][Block][trace_route][81.145.150.253:60217->217.155.64.19:33434][UDP][HLen=20, TLen=72]2013/02/26 11:19:15 -- [DOS][Block][trace_route][81.145.150.253:60217->217.155.64.19:33434][UDP][HLen=20, TLen=73]2013/02/26 11:19:16 -- [DOS][Block][trace_route][81.145.150.253:60217->217.155.64.19:33434][UDP][HLen=20, TLen=74]2013/02/26 11:19:17 -- [DOS][Block][trace_route][81.145.150.253:60217->217.155.64.19:33434][UDP][HLen=20, TLen=75]2013/02/26 11:22:03 -- [DOS][Block][trace_route][178.78.121.130:51760->217.155.64.19:33434][UDP][HLen=20, TLen=71]2013/02/26 11:22:04 -- [DOS][Block][trace_route][178.78.121.130:51760->217.155.64.19:33434][UDP][HLen=20, TLen=72]2013/02/26 11:22:05 -- [DOS][Block][trace_route][178.78.121.130:51760->217.155.64.19:33434][UDP][HLen=20, TLen=73]

I have been getting emails from my router every 10 to 15 minutes that look like the log above
sorry about the formatting

I only enabled DoS Defense yesterday, I used the Select All Option.

I have been getting these all day and night, always to 217.155.64.19, from differing addresses.

Any help greatly appreciated
Alan.

Some ISPs run a constant Trace route to your external IP, have you checked where that IP address is?

No, but to be fair, these are not the only addresses.

I will have a check, I wasnt sure if a traceroute would show up as a DoS attack?

Alan.

Yup, any trace route will show up. Under DOS there is a tick box for it.

OK, I will definately check,thank you.

Just a quick question if I may, I have a small subnet from my ISP, and at least 3 are in permanent use, would they not scan all of them?

Alan.

So here is the activity from the last hour:

195.188.217.194 213-48-75-26-bra.dial.cable.virginmedia.com [213.48.75.26]


178.78.121.130 ftip003170588.vhsaccess1.birmingham.fixed-nte.btnet [81.134.229.94]


81.145.150.252 ftip003269664.acc2.kingston.21cn-nte.bt.net [81.147.48.77]


83.100.145.205 ge-3-0-2.er10.the.ipc.kcom.com [195.66.236.119]


81.145.150.250 ftip003269664.acc2.kingston.21cn-nte.bt.net [81.147.48.77]


83.100.145.195 ge-3-0-2.er10.the.ipc.kcom.com [195.66.236.119]


83.100.145.194 ge-3-0-2.er10.the.ipc.kcom.com [195.66.236.119]

Should I start ringing ISPs and asking them WTF? or will they just say its not down to them what their users are doing?

Alan.