Denial of Service Attacks on Virgin GPRS

Since Sunday both my fiance in Joburg and me on business in Durban have been having the same problem connecting to Virgin GPRS. Can connect fine, browse for a bit but then it all comes to halt, pages take forever to load , timeouts, etc.]

I'm running personal firewall on my laptop (Kerio) and the logs are full of alerts for what it describes as a DOS Jolt attack (googled it and it's legitimate).

My questions:
- Can anyone else confirm that they're getting the same problem.
- If Virgin assigns non-routable addresses to their GPRS connections (10.x.x.x) surely they need to block these Dos attacks before they get into the network (or maybe they're orginating from within the network)

Help!

Time to check the firewall logs. are the attacks continuous ?

That is strange, I was under the impression Virgin Mobile were pre-empting denial of service attacks by denying service before you got attacked.

Continuous? 3-4 times a minute and curiously the sources are all websites I was busy browsing....

It seems as though Kerio might be misidentifying legitimate packets as DoS attempts. Is this possible?

Problem solved, sort of.

Kerio uses the snort rules database and was getting a false postive on some packets and dropping them.

If you are using Kerio (or any other firewall that uses the snort rules database) your need to edit the DoS rules file, for Kerio its in \Program Files\Sunbelt Software\Personal Firewall 4\Config\IDSRules\dos.rlk and comment out the rule for 'DOS Jolt Attack.'

Did the above and my connection is fine again.

Although it should be said that this problem only started this weekend after working fine for months, so clearly something has changed on the network, apparently some upgrades have been going on, so maybe that was the cause.