Possible SYN DDOS Attack

RouterOS General
1

Hey,

My router is 750GL and from monday (05/10/2015) , behind him is Thompson router from my ISP provider which should be in bridge mode. Said ‘should’ because on MTR test I see strange IP behind my mikrotik but I will explain it later. Now to the point -I’m struggling with @Net problems. Symptoms are quite strange. Although my network is working somehow but after couple of hours it stops working properly. By saying ‘properly’ I mean first of all:

ping to domains don’t work at all = unknown host - DNS misconfigured
after that ping to IP (e.g 8.8.8.:sunglasses: it’s responding with a lot of breaks most of them are Request time out.
and of course without proper firewall rules my MT CPU utilization is over 90%

Temporary solution is poweroff and poweron the ISP Router (Thompson). But it’s not the permanent solution.

Ok Investigating the logs from my MT. I set on firewall a action=log rule before the drop all rule to log any other activities. This is what I get:

12:46:49 firewall,info Filter: input: in:ether1 out:(none), src-mac cc:35:40:1e:ae:d6, proto TCP (SYN), 74.207.236.49:44675->my_IP:8080, len 60
12:46:50 firewall,info Filter: input: in:ether1 out:(none), src-mac cc:35:40:1e:ae:d6, proto TCP (SYN), 222.253.108.170:29789->my_IP:8080, len 48
12:46:51 firewall,info Filter: input: in:ether1 out:(none), src-mac cc:35:40:1e:ae:d6, proto TCP (SYN), 178.74.70.70:56251->my_IP:8080, len 52
12:46:51 firewall,info Filter: input: in:ether1 out:(none), src-mac cc:35:40:1e:ae:d6, proto TCP (SYN), 5.9.57.103:41797->my_IP:8080, len

From what I understand I’m having a lot of traffic flooding me on port 8080 in ip-protocol=tcp with SYN flag in-interface=ether1.

So I add firewall rule on the top to add all flooding IP address matching rule, in-interface=ether1 ip-protocol=tcp tcp-flag=syn chain=input, to the SYN_DDOS address list (action=add-src-to-address-list) to see how many IP there are.
After that set simple input/drop rule for IP address from SYN_DDOS list.

It works when it comes to blocking that traffic. In /tools torch I see those IP address trying to flood on my_ip:8080 with no tx/rx pacets , only with tx/rx rates amount of hundreds bps.

This stopped the MT CPU utilization and It takes now much more longer for those symptoms to appear (dns misconfigured and request time out) - from few hours to one day. But after one day sometimes couple of hours the same situation. I have to reboot the ISP Router (bridge mode) and I gain access to Internet.

I did MTR test and have strange thing going on. When I…

  1. Make traceroute to my ISP gateway I have 2 jumps (1 my router / 2 my ISP gateway) - and it’s correct)
  2. Make traceroute e.g to Google DNS 8.8.8.8 I have this

1 <1 ms <1 ms <1 ms router [10.0.1.100]
2 <1 ms <1 ms <1 ms 192.168.0.254
3 16 ms 13 ms 16 ms 10.63.0.1
4 8 ms 7 ms 7 ms gw1-cmts1.tesatnet.pl [79.173.37.10]
5 8 ms 7 ms 7 ms c99-25.icpnet.pl [62.21.99.25]
6 8 ms 7 ms 8 ms e123-1.icpnet.pl [46.238.123.1]
7 10 ms 8 ms 8 ms e123-6.icpnet.pl [46.238.123.6]
8 8 ms 6 ms 11 ms e123-22.icpnet.pl [46.238.123.22]
9 14 ms 8 ms 7 ms rt1-przybyszewskiego-vlan503.core.icpnet.pl [62.21.99.162]
10 11 ms 21 ms 11 ms google-gw.pix.net.pl [185.1.4.45]
11 12 ms 13 ms 37 ms 66.249.95.13
12 40 ms 30 ms 39 ms 216.239.50.217
13 30 ms 29 ms 29 ms 216.239.46.15
14 * * * Upłynął limit czasu żądania.
15 31 ms 30 ms 29 ms google-public-dns-a.google.com [8.8.8.8]

Don’t know what is the device on second jump : 192.168.0.254 and where has the ISP gateway dissapear ?

Is there any solution for that attack? Or do I have to request my ISP provider to change my static IP address.

2

No one care.. ok :confused:

3

Do you have a virus on a computer behind your router? Do you have cashing on`? - How about block port 8080? Do you use upnp?

4

Your trace route looked good. As the other person who posted stated, it looks like you have either a virus or maybe are sharing a torrent behind your router. I would suggest torching the LAN side of your router and see if there is a device that is sending a lot of traffic.

5

I Checked with Eset and offline with livecd nothing found. Although I have Server , one of the virtual machine has transmission service started but nothing is seeding there.

I will monitor my LAN , but last time I checked the ether1 those packects coming through ether1 (wan) weren’t addressed anywhere inside the lat. No initiator found.

6

Are you sure you didn’t turn on web proxy and are running an open proxy? That level of traffic is not enough to be considered a DDOS, something else has to explain the high CPU. Check your WAN throughput (in both mbps and PPS).

7

Web proxy is disabled. But still got those traffic coming in. I checked and I see those connections on 8080 with tcp(syn) flag that’s all. Got them blocked on firewall

8

I had that problem when my IP somehow was listed in a list of “proxy servers” on some pastebin file.
(it never was a proxy but those kids make mistakes)
In my case the majority of the requests was coming from some hosting provider, I reported it to their abuse desk and it stopped.

9

Yeah I remember one time ago I was searching for free proxy servers. But I stopped it and didn’t not continue that. I think this is the reason. Hm now how to find which provider should I update about it, to stop it.