Afrihost New Network Feedback - Part 2

Status
Not open for further replies.
AfriGuy said:
Pretty cool!
They need some local servers though ;)

160825111953-7917.png


Another cool one is the one run by Netflix - fast.com
I'd love to know how much they paid for that domain name!
Click to expand...

Yea. Its cool, must have cost Netflix a pretty penny.
Here's my test to Netflix. Not bad at all really, considering I get about 3-3.1 Mbps throughput to YT :)


Capture.PNG
 
Been a good past 2 nights of local gaming, has anything been changed that side? :)
 
Rickster said:
Not often, looks like I get it once a day?

Router low level FW and windows FW.
Click to expand...

AfriGuy said:
Thanks for confirming. I'll let you know when our team swings an answer my way :)
Click to expand...

So some clever people got back to me.
We can't get a full answer without a packet dump, but from the logs it seems like the router doesn't like receiving replies from the same source. If your connection is busy and you're doing lots of DNS lookups then the DNS server will reply to those.

Your router seems to think this is a flood.

That's about the best translation I can give, and what makes sense to me :)
 
I'm still getting these - can it be the same issue as what @Rickster is having?

user alert kernel: Intrusion -> IN=ppp0.1 OUT= MAC= SRC=171.81.110.232 DST=169.0.166.37 LEN=40 TOS=0x00 PREC=0x00 TTL=39 ID=64573 PROTO=TCP SPT=60853 DPT=23 WINDOW=4488 RES=0x00 SYN URGP=0 MARK=0x8000000
Aug 25 16:45:23

user alert kernel: Intrusion -> IN=ppp0.1 OUT= MAC= SRC=95.93.239.105 DST=169.0.166.37 LEN=44 TOS=0x00 PREC=0x00 TTL=113 ID=20589 DF PROTO=TCP SPT=30663 DPT=25 WINDOW=65535 RES=0x00 SYN URGP=0 MARK=0x8000000
Aug 25 16:45:25

user alert kernel: Intrusion -> IN=ppp0.1 OUT= MAC= SRC=95.93.239.105 DST=169.0.166.37 LEN=44 TOS=0x00 PREC=0x00 TTL=113 ID=20810 DF PROTO=TCP SPT=30663 DPT=25 WINDOW=65535 RES=0x00 SYN URGP=0 MARK=0x8000000
Aug 25 16:45:27

user alert kernel: Intrusion -> IN=ppp0.1 OUT= MAC= SRC=95.93.239.105 DST=169.0.166.37 LEN=44 TOS=0x00 PREC=0x00 TTL=113 ID=20995 DF PROTO=TCP SPT=30663 DPT=25 WINDOW=65535 RES=0x00 SYN URGP=0 MARK=0x8000000
Aug 25 16:45:28

user alert kernel: Intrusion -> IN=ppp0.1 OUT= MAC= SRC=95.93.239.105 DST=169.0.166.37 LEN=44 TOS=0x00 PREC=0x00 TTL=113 ID=21106 DF PROTO=TCP SPT=30663 DPT=25 WINDOW=65535 RES=0x00 SYN URGP=0 MARK=0x8000000
 
Samildanach said:
I'm still getting these - can it be the same issue as what @Rickster is having?

user alert kernel: Intrusion -> IN=ppp0.1 OUT= MAC= SRC=171.81.110.232 DST=169.0.166.37 LEN=40 TOS=0x00 PREC=0x00 TTL=39 ID=64573 PROTO=TCP SPT=60853 DPT=23 WINDOW=4488 RES=0x00 SYN URGP=0 MARK=0x8000000
Aug 25 16:45:23

user alert kernel: Intrusion -> IN=ppp0.1 OUT= MAC= SRC=95.93.239.105 DST=169.0.166.37 LEN=44 TOS=0x00 PREC=0x00 TTL=113 ID=20589 DF PROTO=TCP SPT=30663 DPT=25 WINDOW=65535 RES=0x00 SYN URGP=0 MARK=0x8000000
Aug 25 16:45:25

user alert kernel: Intrusion -> IN=ppp0.1 OUT= MAC= SRC=95.93.239.105 DST=169.0.166.37 LEN=44 TOS=0x00 PREC=0x00 TTL=113 ID=20810 DF PROTO=TCP SPT=30663 DPT=25 WINDOW=65535 RES=0x00 SYN URGP=0 MARK=0x8000000
Aug 25 16:45:27

user alert kernel: Intrusion -> IN=ppp0.1 OUT= MAC= SRC=95.93.239.105 DST=169.0.166.37 LEN=44 TOS=0x00 PREC=0x00 TTL=113 ID=20995 DF PROTO=TCP SPT=30663 DPT=25 WINDOW=65535 RES=0x00 SYN URGP=0 MARK=0x8000000
Aug 25 16:45:28

user alert kernel: Intrusion -> IN=ppp0.1 OUT= MAC= SRC=95.93.239.105 DST=169.0.166.37 LEN=44 TOS=0x00 PREC=0x00 TTL=113 ID=21106 DF PROTO=TCP SPT=30663 DPT=25 WINDOW=65535 RES=0x00 SYN URGP=0 MARK=0x8000000
Click to expand...

This looks like some form of a bot attack, possibly a virus from that IP.
I'd recommend logging a ticket with our Abuse team so we can look into this.
 
Status
Not open for further replies.
Back
Top
Sign up to the MyBroadband newsletter
X