4

I have been having network issues. The users report to me problems with the internet, but actually the problem is on my network. I have a sonicwall firewall and the device logs indicate posible tcp attacks like tcp flood, tcp syn and others. I have many APs and the users (Teachers and students) use their own devices, the I don't have control like a good antivirus in those pcs because I work for a college.

log

The second image with the ping output is the outcome of to do ping to my LAN interface. When the problem happens on my network I have seen that the times they are very high, sometime there is too packet loss and in this case the time is like a loop. For example, It start at 200ms and decreases, but again the time become to be high. The time must be just 2 ms because is between 2 devices in my LAN network, my pc and the LAN interface on the firewall

I have been reading about attacks. Smurf attack symptoms in certain aspects match with the problems in my network. Also some persons have said me could be a broadcast storm and this generate many traffic and this cause saturation.

I'll be grateful for your opinion

ping output

Improve this question
0

3 Answers 3

Reset to default
2

I agree with Ricky Beam. You'll have to get a packet capture of the Firewall to see if you are receiving responses for a spoofed broadcast request not made by the SonicWall. Only then would we see if a Smurf / Fraggle attack is happening.

I would check performance statistics and logs on the AP's (wireless) and the SonicWall Firewll. I'd get SNMP setup to look at bandwidth utilization. Start ruling things out.

  1. What does your bandwidth utilization look like on the SonicWall when users report the time they experienced this issue? What's the SonicWall's bandwidth capability? Does the utilization supersede the capability?
  2. If you suspect a Smurf/Fraggle DDoS attack, configure the SonicWall to not respond to ICMP requests or broadcasts. Look in logs and packet captures to find the bogus broadcast replies.
  3. Configure SonicWall to not forward packets directed to a broadcast addresses.
  4. SNMP of SonicWall, look at CPU/RAM utilization. When it is high, is traffic being dropped?
  5. Setup Splunk free version to start capturing logs and have a look at what is happening.
Improve this answer
1
  • Good Morning. This answer helped me much. I get a solution for my issue. In spite of the usage memory is again at 80%. We troubleshoot it beacuse quit the routing function to the firewall. Now my Core Switch is the router for the vlans in my network. I recommend monitor always the equipments and analyze it. It Is very important when thoses issues happens. Thank you everybody that answered and gave me advices
    – dfdomin
    Commented Dec 21, 2015 at 16:36
2

It is all to common (sadly) for firewalls to flag things a little aggressively. You'll need to use something like wireshark and/or netflow to watch and monitor what's actively flowing through the network.

Problems with WiFi can be as simple as too many clients associated generating too much traffic for the available bandwidth.

Improve this answer
1
  • Ok @Ricky Beam. It could be because the students generally get the passwords and they do a inapropiate use of the internet channel. Thanks for you answer
    – dfdomin
    Commented Jul 9, 2015 at 18:03
1

If this was an attack, your network was used as one of many launching pads. The port 80 is http and 443 is https. Your private network was going out to:

173.252.103.15:443 FACEBOOK-INC

190.248.95.111:443 EPM Telecomunicaciones

31.13.73.3:443 Facebook, Inc.

65.55.68.119:443 Microsoft

65.55.223.47:80 Microsoft

151.227.234.156:6419 Sky Broadband

132.245.3.210:443 Microsoft

203.104.160.11:443 Naver Business Platform

74.125.21.94:443 Google

158.85.58.10:5222 SoftLayer Technologies Inc

201.232.123.21:80 lacnic.net

54.191.205.188:80 Amazon.com, Inc

64.236.122.15:80 AOL Transit Data Network

65.55.68.119:443 MICROSOFT

Improve this answer
2
  • I've been thinking the same because my ISP said me that my channel overdrive. When yhat happen users report internet fall out and there is loss packet, but according to @Joseph it could be too my firewall. I checked my PRTG monitor and I found the usage of the ram memory over 80% like average in the last days
    – dfdomin
    Commented Jul 9, 2015 at 19:10
  • What tool utilized to identify the owner of the IP?
    – dfdomin
    Commented Oct 1, 2015 at 21:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.