0 Replies Latest reply on Sep 2, 2016 12:41 AM by kirie39

    Intermittent Connection maybe due to DoS Attacks

    kirie39

      Upon creating this thread. I'd like to have some assistance with my reoccurring problem in regards to my usage of both my internet service and landline. It has been awhile ever since the start of the first week of May, that my connection and landline usage gets interrupted. Landline, having a busy dial tone and at times having none, The modem/Router's status for the LED Lights are as it follows: Internet light will be red for a few seconds or more and the ADSL Light is a steady Green light. Our connection would often disconnect more than ten times less/or more on a daily basis... With the connection either dying out for just for a few seconds or even as long as an hour or more. We have called countless of times through the hotline to have this issue resolved but up to this day the issue never got resolved nor fixed.

       

      Countless of Job Orders have been issued and such. Every physical component that could be replaced have been already replaced, From the modem/router, the lines from the posts (Back drop cable or etc.), The Jumper wire from the "Cabinet" and the likes. Even so far to have the port for our connection be changed, and even got reset a number of times already. Adding to that, our username for the router itself got changed just a day ago to see if it was authentication issues or not but, the same problem still persists.

       

      Until recently inspecting the our ProLink Router has the feature to log activity that occurs within it. I happen to stumble upon this issue in terms of having "DoS: Port Scan Attack", "DoS: Per-source UDP Flood Attack", and "DoS: Whole System UDP Flood Attack". Though DoS, stands for Denial of Service.. I'd post the complete logs but I do believe that it may have some sensitive information about it since IP Addresses are indicated on it (Will be sending it to PM to any moderator or globe staff that do reply/request for it).
      Example of the log: (x = Numbers)

      Thu Sep 1 18:9:55 201635systemDoS: Port Scan Attack source=x.xx.xx.xxx destination=xx.xxx.xx.xx
      Thu Sep 1 18:9:57 201636systemDoS: Port Scan Attack source=x.xx.xxx.xxx destination=xx.xxx.xx.xxx
      Thu Sep 1 18:10:12 201637systemDoS: Port Scan Attack source=xxx.xx.xxx.x destination=xx.xxx.xx.xxx
      Thu Sep 1 18:10:13 201638systemDoS: Port Scan Attack source=x.xx.xxx.xxx destination=xx.xxx.xx.xxx
      Thu Sep 1 18:14:40 201639systemppp1: link terminated
      Thu Sep 1 18:14:55 201640systemppp1: link established
      Thu Sep 1 18:15:9 201641systemppp1: IP-up localAddr=xx.xxx.xxx.xx Gateway=xx.xxx.xx.xx mask=255.255.255.255
      Thu Sep 1 18:15:9 201642systemppp1: update DDNS

       

       

      Though, My question is, How does Globe handle such attacks if this is likely the cause of my connection and landline being interrupted from time to time?
      I do hope my post will get some attention from the staff itself for this since our issue has been around for already four months and more; To add we don't use any extension for the router nor for the landline.