Getting CLDAP attack in mikrotik

RouterOS General
1

I am getting huge attack on source port 385 called CLDAP port from multiple sources and destination is one of my IP but i am not using that IP anywhere in the network .and only that attack is heating to the Core router WAN interface which is connected to the Telco and no any firewall rules are working ..Huge attack is coming and its just crazy …What can be the problem ..
I shared the captured packet with mikroitk but did not get any response on it..





Any solution of it ??

Waiting for response ..

2

MikroTik is not listening on that port by default. Of course anyone can send traffic to any port optionally in DDoS form, but that is not a MikroTik problem.
Such things are usually retaliations against one of your customers or against yourself.

There really is no solution other than waiting for it to go away.

3

Whats the solution of it ??


how long it will continue ??


Is there any ddos company who can solve it ???

this problem is since 4-5 month on a /22 prefix ..!!!

4

Just drop it in your firewall.
When your link suffers from it, ask your upstream provider to drop it for you.

5

mikrotik firewall not able to control the flooding and even raw firewall is not able to stop it…I asked the upstream but
they cant block it..One more thing is that the attack is coming on my IP which is not connected anywhere in the network.

Cant understand the problem ,..How long this problem will continue…Terrible..

6

Well, that is the internet.
You cannot know how this is caused and how long it will continue.
Your MikroTik router has nothing to do with this.
More likely your behavior or one of your client’s behavior on internet (like cheating in a game, cutting off someone for doing something you did not like, etc).
Some childish people will retaliate for such actions by setting up something like this.
But that does not have to be true, it can also be just a mistake from someone.

7

i understand that..But being an admin how should i check it now ??

even i have removed that ip from the network..even i have unplugged all the LAN cable from it but still its happening ..

Oops..if any basic things i will have to check then suggest me plz..!!

8

You cannot.

Oops..if any basic things i will have to check then suggest me plz..!!

There is nothing you can do except think what could have caused someone to get mad at you or one of your customers.
I had this happen in my network before and it was quite clear what had happened. But still there was nothing I could
do except

  • wait
  • have it blocked upstream
    In this case it sort of stopped after a day or two. Your case is apparently more persistent.