Netgear security log shows normal traffic for most of the day but on occasion it will show a burst of activity like this (I have changed the destination address to xxx.xxx.xxx.xxx for privacy purposes)
Fri, 2008-02-01 10:29:07 - ICMP Packet - Source:205.234.160.30 Destination:xxx.xxx.xxx - [DOS]
Fri, 2008-02-01 10:29:07 - ICMP Packet - Source:77.67.121.84 Destination:xxx.xxx.xxx - [DOS]
Fri, 2008-02-01 10:29:07 - ICMP Packet - Source:4.79.66.195 Destination:xxx.xxx.xxx - [DOS]
Fri, 2008-02-01 10:29:07 - ICMP Packet - Source:4.78.240.103 Destination:xxx.xxx.xxx - [DOS]
Fri, 2008-02-01 10:29:07 - ICMP Packet - Source:216.218.219.38 Destination:xxx.xxx.xxx - [DOS]
Fri, 2008-02-01 10:29:07 - ICMP Packet - Source:64.152.34.33 Destination:xxx.xxx.xxx - [DOS]
Fri, 2008-02-01 10:29:08 - ICMP Packet - Source:216.112.33.75 Destination:xxx.xxx.xxx - [DOS]
Fri, 2008-02-01 10:29:08 - ICMP Packet - Source:77.67.121.84 Destination:xxx.xxx.xxx - [DOS]
Fri, 2008-02-01 10:29:08 - ICMP Packet - Source:4.79.66.195 Destination:xxx.xxx.xxx - [DOS]
Fri, 2008-02-01 10:29:08 - ICMP Packet - Source:38.99.9.25 Destination:xxx.xxx.xxx - [DOS]
This normally lasts for 10-15 seconds during which we may receive hundreds of ICMP packets in that time. It's not something that happens every day although it can happen up to a dozen times a day at random times. The source IP addresses appear to be located all over the world, certainly not places that we have any dealing with.
Is this actually a DOS attack or could it be something else? The Netgear router appears to be stopping the traffic so should we be worried? Is there anything we can do to prevent this?
Sorry about the multiple questions in one, they are all closely related though :)
Start Free Trial