K-12 Forums

Talk with other K-12 network administrators in your state.

Or see all states.

Categories

Vanilla 1.1.4 is a product of Lussumo. More Information: Documentation, Community Support.

This discussion has been inactive for longer than 30 days, and is thus closed.
  1.  permalink
    I have looked at my negear wireless router log today, and I have several entries which the router has blocked as suspected DOS attacks:
    UDP Packet - Source:208.67.220.220,53 Destination:xx.xx.xx.xx,62960 - [DOS]
    UDP Packet - Source:208.67.220.220,53 Destination:xx.xx.xx.xx,51457 - [DOS]
    etc (about 6 or 7 more)

    So I am wondering-
    1) Why does my router think this is a DOS attack?
    2) Should I open some ports or something to allow this activity without blocking it?
    Thanks
    • CommentAuthorrotblitz
    • CommentTimeAug 6th 2009 edited
     permalink
    If you only have a dozen messages for hundreds of DNS lookups (see your OpenDNS stats), then I would think that this is a firmware bug. Under rare circumstances the router is not able to associate the OpenDNS response with the original request. If this is the case: Look at related Netgear or router support forums, if you find similar instances, or open an own thread there.

    But also, it could be a kind of bug (or feature) at OpenDNS, that they send DNS lookup responses twice in cases where they think the response could not reach its target - your network. Your router already has finished the transaction then and cannot handle the second response, but reports them as unwanted packet and drops them. If this is the case, you have probably nothing to do. You could put a sniffer between the router and your ISP to monitor the conditions under what this message appears.
    Thankful People: voodoofarrelly
  2.  permalink
    Okay, thanks. I will do nothing, I guess it is not something that I have to consider or worry about. THanks!

This discussion has been inactive for longer than 30 days, and is thus closed.