How can one prevent UDP floods in a modem?

acidrain

acidrain

Executive Member
Joined
Jan 7, 2007
Messages
7,005
Reaction score
1,799
Location
At a computer
Hope someone can help. Been recently getting alot of UDP and Smurf floods hitting my modem which is causing it to bomb out and in turn disrupting me, especially my gaming.

I got the IP range of the source through doing a WHOIS but have no idea what to do with this? Anyone got any advice?

Thanks
 
gregmcc said:
Or run a decent firewall which will block the common DoS attacks.
Click to expand...

The attacks are on the modem, not the pc so using anything other than the std router firewall is pretty tricky unless there are ways of installing firewalls on routers ( which i doubt )
 
Okay, you said modem, a modem isn't a router, there's a difference. Most if not all routers have built in hardware firewalls, make sure you have it enabled.

Make sure you aren't giving out your IP address on any public places, maybe it's a website you are browsing, or something you're downloading?

Switch the router off completely for at least 30 minutes, do something else and come back and switch it back on, this will make sure that you get a new IP address and this = no attack.
 
teraside said:
Switch the router off completely for at least 30 minutes, do something else and come back and switch it back on, this will make sure that you get a new IP address and this = no attack.
Click to expand...

Can be that the previous bugger who've had the same IP as you did just now dissed somebody somewhere, with the end result of getting a lot of UDP packets as punishment.

So, yes, switch off the router, leave it for 30 minutes or so, then try again.
 
The_Librarian said:
Can be that the previous bugger who've had the same IP as you did just now dissed somebody somewhere, with the end result of getting a lot of UDP packets as punishment.

So, yes, switch off the router, leave it for 30 minutes or so, then try again.
Click to expand...

Agreed what Uncle Libz said. Most decent hardened dedicated Linux firewalls would stop those packets to an extent, some modems/routers wouldn't cope if its from botnetS" or similar.. :)
 
I presume you mean router and not modem. A modem is used for dialup and attacks are addressed to an IP address and not to a device.

If your router doesnt have any decent firewall software built into it you could put it in bridge mode and then connect it to a linux firewall. The firewall NIC will then get the IP address and will filter out all the rubbish and put a stop to all the attacks. You also have lots more control using this method, but it requires a extra PC and some linux/firewall/ip tables knowledge.
 
gregmcc said:
I presume you mean router and not modem. A modem is used for dialup and attacks are addressed to an IP address and not to a device.

If your router doesnt have any decent firewall software built into it you could put it in bridge mode and then connect it to a linux firewall. The firewall NIC will then get the IP address and will filter out all the rubbish and put a stop to all the attacks. You also have lots more control using this method, but it requires a extra PC and some linux/firewall/ip tables knowledge.
Click to expand...

None of which i have at this point, but will take the 30min off time advice and see if it sorts things.

Thanks all :D
 
teraside said:
Make sure you aren't giving out your IP address on any public places, maybe it's a website you are browsing, or something you're downloading?

Switch the router off completely for at least 30 minutes, do something else and come back and switch it back on, this will make sure that you get a new IP address and this = no attack.
Click to expand...

Did the switch off - left for an hour - switched back on and still coming back. Seems as you stated above that someone or something on someones computer on our network is giving the IP address out, is there a way to find what/where/when and how it is giving the Ip address.

Unfortunately im not clued up on linux enough to install it as a firewall, so those ideas aint gonna help me out.

EDIT: there is a known pc on the network that seems to be flooded with viruses which is getting formatted over this weekend, but in future is there ne way as i asked above to know who or what is giving the ip's out just incase we dont know who has an infected pc for the future?
 
Last edited:
I'm not sure really. I think uncle Libs or someone else might be more clued up.

I'd say however, check all pc's for viruses and or spyware. Make sure each pc has got a firewall active and spread the word that browsing or downloading illegal content leads to security issues.

A lot of the warez sites out there install rootkits and keyloggers and dialers and this causes what's happening here with you.

A virus normally messes up the system, ie. breaks it, but the spyware and other nasties make your life really hard.

Anyone else got a tip?
 
you can try run a sniffer to see if your IP is being given out by another machine but to interpret a dump is pretty technical as well. If you want to give it bash try wireshark - its freeware.

Dont think a virus infected machine would cause it but if something is infected with malware its possible. Maybe its infected with a bot and someone if trying to connect back in.

How many machines are there on your network connecting out via the router? You could try switch them all off. Leave one on and see if the problem still occurs.
 
gregmcc said:
How many machines are there on your network connecting out via the router? You could try switch them all off. Leave one on and see if the problem still occurs.
Click to expand...

Well there is roughly 20+ users ( not 100% about the number though ) so having all of them on one router won't make any one happy since it will cause alot of "clogging" and maybe cause some downtime.

Im really trying to find a way to find the problem while preventing any disturbances on the network. Ill google that sniffer program and see what is happening ( if it work of course )

Thanks in the meantime :)

Edit: Some of the people are teenages and im sure you can guess how safety conscious they are.... very frustrating
 
Last edited:
gregmcc said:
you can try run a sniffer to see if your IP is being given out by another machine but to interpret a dump is pretty technical as well. If you want to give it bash try wireshark - its freeware.
Click to expand...

OK ive been running wireshark, but what exactly would i be looking for. I notice activity is colour coded and some have popped up red, which im assuming is not good... one of the ones that have been highlighted red can be seen below.

No.: 805
Time : 58.394233
Source : 192.168.1.150
Destination : 239.255.255.250
Protocol : SSDP
Info: NOTIFY * HTTP/1.1

EDIT: Ok so ive been doing some research on this SSDP ( have not yet found whether the red highlighted activities are infact bad ). What ive found it the SSDP ( aka Simple Service Discovery Protocol ) is apparently used by devices to inform any computers on the network that is exists, such as all uPnP devices. The destination IP for this is also always 239.255.255.250 ( dont know why )

What id like to know is will it cause problems if I disable uPnP on the routers or must it stay enabled for people to access the internet?
 
Last edited:
Its going to be difficult to pin point the problem without disrupting the other machines. The source of the problem could be from any of them. Wireshark will produce heaps of data. If a machine is initially connecting out and sending data it could be in a HTTP packet and you will probably never see it.

The best bet is to do it via trial and error. When the floods begin start wireshark.

Are the computers all MS? I presume they're all fully patched and have AV installed and you've tried running a full AV/malware scan.
 
Regarding AV/Firewall programs, im not sure if all of them have it. Maybe they do but then the next question is, which AV/Firewall and is it fully up-to-date. Finding this out is also going to be tricky since all of us are fairly far apart ( some as much as 10km's )

I'll try the idea of running wireshark when the attacks happen, but deciphering the data is the part im not sure about since you said it gives alot of it when its running.
 
Nessus is a open source good program for finding vulnerabilities. It scans a IP looking for open ports and then looks for common vulnerabilities for those ports, or recommends things you can do to protect yourself against a hacker penetrating your system via those open ports. Nessus and nmap are excellent tools for finding weaknesses.

You can pretty much use any AV software - they are all fairly run of the mill. The most important thing is to run a autoupdate and check if they are on the latest pattern files. Without your patten files being up to date you might as not run any AV software.

For malware you could also download spybot, the new version is pretty nifty, again make sure you download all the latest updates.

Also run windows update, if your system is vulnerable to a certain exploit then no AV in the world will stop malware/trojan/worms from infecting your machine that make use of the vulnerability. Sure they will detect it after you are infected but then it might already be too late.
 
gregmcc said:
If your router doesnt have any decent firewall software built into it you could put it in bridge mode and then connect it to a linux firewall. The firewall NIC will then get the IP address and will filter out all the rubbish and put a stop to all the attacks. You also have lots more control using this method, but it requires a extra PC and some linux/firewall/ip tables knowledge.
Click to expand...

Ok, so ive been speaking to the guys on the network and it seems we going to make a move to make the internet more secure for us behind the adsl. We thinking of using your idea of having a cheap pc with linux on it, and using it as the firewall for the adsl modem... similar to this setup:

Internet ---- ADSL ---- Linux Machine ( 2x NIC's bridged ) ----- switch ----- Internal Network.

Now the problem is none of us are susficiently experienced with Linux to actually know what we doing. Is there a link that can give us some insight into how to configure the machine or is there a good windows based firewall ( since there are plenty ) that can almost achieve the same affect as running a linux one.
 
You must log in or register to reply here.
Back
Top
Sign up to the MyBroadband newsletter
X