Port sniffing attacks

Bump!

The WAN port scans are not likely a wireless issue (though it may have started originally from it, its not what would continue it now if a virus came in on the LAN) the fact the computer pulling a different IP address when it connects to the modem has the same problems with port scans would tell us something is infecting the machine and requesting or opeing it up to the security breach. If was the IP address or connection that was being attacked it would stop once a different IP address was issued.

I would first run a full scan on the computer you connected directly and still get the problem on to see if anything comes up detected, and if it was a local virus that has attached itself to the router, reset the factory defaults/firmware for the router to clear any changes that may continue the problem.

This problem never, never, never, never, never happened on DSL. An account that was several years old. The attacks started on the second day of service with Cox and have gotten worse over time. I am almost certain they have not gotten into any pc's my network. Its the FACT that even without the router my traffic slows to a crawl while these attacks happen. WIth the router connected I sometimes will have to reset the router because of the Syn attacks lock it up.

You truly dont know how frustrating it is to hear you say that these attacks could have started via the Wifi of this home network.

I have reset both routers to the factory state. The main pc has been scanned multiple times and no virus or mallware or anything has been found.

The only other pc's that are connected are both fresh installs with only microsoft products installed.

I have managed to change my ip several times by doing hard resets on the modem. After the last two hard

resets. I left only 1 PC connected. (I left one PC turned off completely) and each time after the new IP was assigned the attacks started with one or two then became more frequent and the day went on.

Here is the latest batch of attacks:

With the attacks coming from Romania, Netherlands and Brazil. That is if the IP's are not being spoofed which they probably are.

The only thing that has seemed to help is that in my router I created an IP filter list to restrict access. I have to constantly monitor it and update my list as the day goes by. It seemed to keep the wolves at bay for the time being.

Is there a way to monitor the traffic going in and out of the modem? I have been looking for a network monitoring solution but I have not found one yet. It seems I Might have to turn one of my machines back into a Linux box and use it just to monitor the traffic.

This was not a problem for this house until we switched to Cox.

When you switched from AT&T to Cox, did you also switch firewalls?  I feel your computer was always infected but the AT&T firewall was blocking malware from initiating the port scans.

Are you using the same antivirus program to scan your computer every time?  If so, that program is not detecting the malware.  If you're using Windows, run the built-in Microsoft Malicious Software Removal Tool:  Start-->Run-->Enter MRT.

If MRT doesn't detect anything, download free anti-malware security software from Avast, Avira and/or AVG.

Are there any unusual start-up programs in Windows Defender?

What ports are open on your computer?  Start-->Run-->Enter netstat -ao

You seem to be doing everything you can.  The problem the Internet service providers is they have call centers and people trained how to reset your modem (my sister was one and she can basically turn on her computer) .  They are by no means network engineers and have absolutely no idea what you are talking about.  If resetting a modem does not fix the problem, they "Roll a Truck".  You need a network engineer, chances are cox will never actually let you talk to one of their engineers.  No path tho resolve.  Your best option is to protect yourself.

Thank you for wasting my time Bruce. Its service like your that gives Cox a bad name.

@Rat Yeah, my son has installed Network monitoring software so he can monitor the throughput communication in real time on each device we have installed. Paessler PRTG i s supposed to monitor all active communications and connections. He says its not a security tool but if there are any active connections it will show up on it.

I really cant believe cox is this bad. I would be curious if other people have the same issue? I wonder if people go into their router setting and look at their log files.

This is from after this mornings reset:

"Jul 30 08:38:36 ","Xmas port scan attack from WAN (ip:207.200.27.85) detected."
"Jul 30 08:38:12 ","Xmas port scan attack from WAN (ip:207.200.27.85) detected."
"Jul 30 08:30:54 ","SYN-ACK port scan attack from WAN (ip:112.124.39.186) detected."
"Jul 30 08:10:31 ","SYN-ACK port scan attack from WAN (ip:176.9.55.99) detected."
"Jul 30 07:58:15 ","Xmas port scan attack from WAN (ip:74.125.227.165) detected."
"Jul 30 07:58:08 ","Xmas port scan attack from WAN (ip:74.125.227.177) detected."
"Jul 30 07:58:03 ","Xmas port scan attack from WAN (ip:74.125.227.177) detected."
"Jul 30 07:57:55 ","Xmas port scan attack from WAN (ip:74.125.140.125) detected."
"Jul 30 07:57:52 ","Xmas port scan attack from WAN (ip:74.125.140.125) detected."
"Jul 30 07:57:52 ","Xmas port scan attack from WAN (ip:74.125.140.125) detected."
"Jul 30 07:57:39 ","Xmas port scan attack from WAN (ip:74.125.225.228) detected."
"Jul 30 07:57:28 ","Xmas port scan attack from WAN (ip:74.125.227.175) detected."
"Jul 30 07:57:23 ","Xmas port scan attack from WAN (ip:74.125.227.175) detected."
"Jul 30 07:57:23 ","Xmas port scan attack from WAN (ip:74.125.227.175) detected."
"Jul 30 07:57:08 ","Xmas port scan attack from WAN (ip:173.194.77.95) detected."
"Jul 30 07:56:58 ","Xmas port scan attack from WAN (ip:173.194.77.95) detected."
"Jul 30 07:56:48 ","Xmas port scan attack from WAN (ip:173.194.77.95) detected."
"Jul 30 07:56:37 ","Xmas port scan attack from WAN (ip:74.125.227.132) detected."
"Jul 30 07:56:32 ","Xmas port scan attack from WAN (ip:74.125.227.96) detected."
"Jul 30 07:56:32 ","Xmas port scan attack from WAN (ip:74.125.227.132) detected."
"Jul 30 07:56:31 ","Xmas port scan attack from WAN (ip:74.125.227.132) detected."
"Jan 1 00:00:54 ","Xmas port scan attack from WAN (ip:74.125.227.163) detected."
"Jan 1 00:00:53 ","Xmas port scan attack from WAN (ip:74.125.227.163) detected."
"Jan 1 00:00:53 ","Xmas port scan attack from WAN (ip:74.125.227.135) detected."
"Jan 1 00:00:53 ","Xmas port scan attack from WAN (ip:74.125.227.135) detected."
"Jan 1 00:00:53 ","Xmas port scan attack from WAN (ip:74.125.227.135) detected."

When the date and time change in the log is where I set the time.

Maybe we can get the Blaze Network to do a story on this problem. Since apparently the are the "only" truthful non-biased news group around.

Cox please forward my problem to your Network security group. I like your speed over AT&T but you are not reimbersing me or my son for all the trouble we have to go through to keep my internet connection up!

Regards,

A very dissatisfied internet customer of Cox Communications.

I suspect there is a good chance this was happening when you had your DSL connection and you may not have been seeing the activity.  DSL modems are usually also routers and that being the case such activity would have been logged at that router and not yours if you also had your own router setup.  Since the cable modem is a passive bridge this activity would now reach the router you have installed.

What you're seeing is actually not that uncommon.  When I choose to look at my router logs for example I'll usually see somewhere upwards of 300,000 or so entries comparable to yours from various checking the locks on my doors so to speak.  If you see reports of this coming from other Cox subscribers that evidence can be sent to abuse@cox.net for processing by our network security team.  For activity coming from other Internet providers the same evidence would need to be sent to their abuse contact.  We aren't able to block stop that traffic on yoru behalf without censoring your access to the Internet.

open your command prompt ( start menu ---> type in cmd ---> open cmd.exe ---> type in the command prompt netstat -n) This should tell you all of the current IP address connections and on what ports. I suspect most of these are coming from port 80. Which is actually a blocked port for UDP packets on Cox. You can change your firewall settings in your router and choose not to accept fragmented packets. I had a similar issue. Not saying this is the same but it at least made my internet useable and no more false flags.

First of all. The service we had with DSL only included their modem.

WE had our own routers. 

The problem is that the frequency of these attacks sometimes can be heavy. Heavy enough to flood the routers with enough "sniffs" Especially when they do a SYN-ACK port scan attack. Both of my routers will lock up and require a reset.

You are correct that there were entries like this in the log files back when we had DSL but instead of getting somewhere in the neighbor hood of 100 to 500 a day we might have had 10 all year long.

As far as I can tell my router is doing its job and blocking the un wanted traffic. ANd according to my firewall reports there has been no intrusion on any of the PC;s here.

The problem is that during these attacks my internet service slows to a crawl or stop all together because my routers need to be reset.

I understand. Like I said. I was having the same issues. But you need to change your settings on your router or it will continue to try and reconnect over and over and over which is why you are having 500-1000+ connections. Check your SPI firewall settings. SPI stands for, stateful packet inspection, which keeps track of the state of network connections. If disable or the values are set too low this will cause your you to continually duplicate these requests until you get timed out effectively flooding your own connection.

SPI is on and active. I can not set a value or level for this is either on or off. Having it on probably could create false hits when running applications on your pc's like games for example.Never was an issue before.

ALL antivirus and malware detecting software reports back zero hits.

From AVG to Microsoft, Spybot and Hijack This was run on each PC to look for little nasties.

I heard back from the abuse.cox team.

Basically telling us that they disregard any report from non Cox equipment.

I read my logs again on one of cox's modems/routers and it actually was showing quite a few hits for syn attacks / ip flooding / and packet loss. I don't know whats going on right now. I apologize for giving you potentially bad info the other day gatormom. The solution I suggested was only a temporary bandaid for a bigger problem I guess. I'm not very happy with cox right now. If it weren't for the fact that they were technically the "fastest" in my area then they probably wouldn't have my business. The tech support individuals are great and they really try. But getting whoever they are under to get something in motion is what poses a problem. I raised a legitimate question as to why I would get timeouts when running tracerts to cox's dns servers. Well only one in particular. But the technician seemed truly concerned and they brought a bucket truck to my house 2 days later. But that has nothing to do with why the main line to atlanta is **.

Am guessing there is a huge difference between the fastest and the best (at least for customer service).

Early this morning (around 4am) my modem would not stay connected at all for about an hour. I watched the network status in Win 7 and it showed the modem continuously trying to connect. I wish I could read the log files from my modem.

Cox abuse line still tells me that since it is non Cox equipment that they will not accept the log files as a sign of abuse going on.

Am thinking they want me to pay them 10 bucks a month for home networking support.

You know where thay can stick that idea..

This will be my last week with Cox if they can not work out why this is happening on their end.

If you require home networking assistance that option is available from us for about $10 a month.  Not everybody needs this level of support however it is available if you can't or prefer not to work with the router vendor directly.  As for reporting abuse it doens't matter what equipment generated the logs.  The logs you posted earlier are fine as long as they are submitted as part of the email body and not an attachment.

Please note however our abuse team cannot stop any Internet abuse originating from a non-Cox subscriber.  Any abuse must be reported to the Internet provider from which it is originating.  If you're not sure who the Internet provider is for a particular IP address you can start your search by visiting a site like http://www.arin.net for example.  There are other sites which are authorative for other regions around the globe for which they will have the links.

I'm getting a lot of port scans over a short time, too. I understand that it's normal but the amount that you and I are seeing seems to be dramatically greater than is normal.

Aug 4 11:46:12                Xmas port scan attack from WAN (ip:184.169.135.192) detected.