1

I have recently been getting Internet dropouts and in my logs, I see that there is SPI and Xmas attacks going on. What are these attacks? I assume I get these drop outs because my router is not able to reject all of these requests?

Syslog from Router

P.S. Can a moderator move this question if this is in the wrong area?

P.S 2 The IP shown in the picture is not the only IP that is "attacking" me

1
  • What are we looking at?
    – Teun Vink
    Feb 16, 2016 at 14:38

4 Answers 4

3

SPI and Xmas attacks are two techniques to identify vulnerabilities in your router.

The SPI attack is basically a port scan, it will tell to the attacker which ports are opened, for example HTTP / HTTPS / SSH / RDP...

The Xmas attack sent packets with all IP / TCP / UDP (or other protocols) option sets. Different operating systems or router firmware (Linux / Cisco / Windows / Juniper...) will respond differently to those options.

So the response will likely tell the attacker what kind of router you have.

When the attacker has identified the Operating Systems and the ports open, it can try to exploit known vulnerabilities in this specific system / application.

2

Xmas "attack" is a XMas Tree Packet, aka a TCP packet with every flag set. It makes no sense to set all flags, and systems back in the '90s used to crash when they see one. That's what it's called an "attacK". These days they are used for OS fingerprinting as different operating systems respond differently to nonsense packets.

1

Your WAN IP address is being port-scanned systematically looking for a vulnerability.

The router should block all this incoming traffic from reaching your LAN, however it imposes a high toll in router's performance because its processor does not have enough capacity to process and dump the packets fast enough.

There is nothing you can do to stop the attacks from hitting your router, except reboot the router in hope that the ISP assigns your connection another IP address.

4
  • Yeah I rebooted my router multiple times, meaning that I acquired a new IP address after this process, but it happens immediately after it connects. I've done a WHOIS check on the IP, and it turns out to be TalkTalk's load balancer and its IP range as well. What do you suggest? Feb 16, 2016 at 14:21
  • 1
    @SergeantSerk The packets will keep coming to your router no matter what you do, a suggestion is to change the router for a more capable one. Your router is visibly affected by the port scanning but there are other ones that resist better.
    – jcbermu
    Feb 16, 2016 at 14:47
  • There's nothing wrong with the router. It simply say 'i have detected an attack and dropped the packets -I.E. I'm not replying to it. It's a good behavior.
    – JFL
    Feb 16, 2016 at 16:02
  • I was meaning that some routers are less prone to dropouts under those conditions. @SergeantSerk says that his connection is dropping frequently.
    – jcbermu
    Feb 16, 2016 at 18:58
1

This is normal router behavior as part of logging. You can try to specify a rule to drop all traffic from that particular host and not log the events.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.