求助坛友，路由DOS攻击

显示全部楼层 · 发表于 2015-9-20 23:30:15

本帖最后由小7seven 于 2015-9-20 23:33 编辑

今天闲着无聊就去路由界面看了看，发现日志里面有DOS ATTACK。我不太懂这啥意思，百度了下说可能自己的设备中毒什么的，仔细一想不对，因为我上午根本不在家，自己的所有设备都没联网，但是上午七点多以及十点多还有dos攻击，麻烦坛友给简单解释下这是啥意思以及咋处理呢。随便看了几个ip有深圳的美国的俄罗斯的。以下是日志内容。
[DoS Attack: SYN/ACK Scan] from source: 62.152.58.103, port 80, Sunday, September 20, 2015 21:01:03
[DoS Attack: FIN Scan] from source: 219.134.43.45, port 54582, Sunday, September 20, 2015 20:49:20
[DoS Attack: FIN Scan] from source: 219.134.43.45, port 54539, Sunday, September 20, 2015 20:48:10
[DoS Attack: FIN Scan] from source: 113.81.216.113, port 6884, Sunday, September 20, 2015 20:47:29
[DoS Attack: FIN Scan] from source: 61.141.147.9, port 36431, Sunday, September 20, 2015 20:47:21
[DoS Attack: FIN Scan] from source: 113.87.235.91, port 26104, Sunday, September 20, 2015 20:47:07
[DoS Attack: FIN Scan] from source: 116.30.249.4, port 27501, Sunday, September 20, 2015 20:46:54
[DoS Attack: FIN Scan] from source: 183.11.243.242, port 51836, Sunday, September 20, 2015 20:46:37
[DoS Attack: FIN Scan] from source: 27.38.17.108, port 54065, Sunday, September 20, 2015 20:46:29
[DoS Attack: FIN Scan] from source: 183.11.255.163, port 51962, Sunday, September 20, 2015 20:46:19
[DoS Attack: FIN Scan] from source: 113.87.235.91, port 26056, Sunday, September 20, 2015 20:46:06
[DoS Attack: FIN Scan] from source: 219.133.65.205, port 27855, Sunday, September 20, 2015 20:45:57
[DoS Attack: FIN Scan] from source: 183.12.130.46, port 60731, Sunday, September 20, 2015 20:45:47
[DoS Attack: FIN Scan] from source: 183.11.255.163, port 51914, Sunday, September 20, 2015 20:45:44
[DoS Attack: FIN Scan] from source: 183.11.243.242, port 51799, Sunday, September 20, 2015 20:45:37
[DoS Attack: FIN Scan] from source: 219.134.43.45, port 54437, Sunday, September 20, 2015 20:45:35
[DoS Attack: FIN Scan] from source: 113.81.216.113, port 3136, Sunday, September 20, 2015 20:45:19
[DoS Attack: FIN Scan] from source: 116.30.249.4, port 27410, Sunday, September 20, 2015 20:45:05
[DoS Attack: FIN Scan] from source: 183.13.169.90, port 62200, Sunday, September 20, 2015 20:45:02
[DoS Attack: FIN Scan] from source: 218.18.73.232, port 58629, Sunday, September 20, 2015 20:45:02
[DoS Attack: FIN Scan] from source: 14.124.14.231, port 26049, Sunday, September 20, 2015 20:44:58
[DoS Attack: FIN Scan] from source: 119.139.84.93, port 29793, Sunday, September 20, 2015 20:44:52
[DoS Attack: FIN Scan] from source: 113.87.235.91, port 26000, Sunday, September 20, 2015 20:44:51
[DoS Attack: FIN Scan] from source: 61.141.147.9, port 36252, Sunday, September 20, 2015 20:44:51
[DoS Attack: TCP/UDP Chargen] from source: 199.168.138.154, port 49382, Sunday, September 20, 2015 20:44:45
[DoS Attack: FIN Scan] from source: 219.133.65.205, port 27780, Sunday, September 20, 2015 20:44:43
[DoS Attack: FIN Scan] from source: 183.11.243.242, port 51736, Sunday, September 20, 2015 20:44:22
[DoS Attack: FIN Scan] from source: 119.123.221.52, port 50417, Sunday, September 20, 2015 20:44:11
[DoS Attack: FIN Scan] from source: 113.81.216.113, port 1080, Sunday, September 20, 2015 20:44:09
[DoS Attack: ACK Scan] from source: 116.24.133.147, port 1443, Sunday, September 20, 2015 20:41:18
[DoS Attack: ACK Scan] from source: 116.24.133.147, port 1443, Sunday, September 20, 2015 20:40:06
[DoS Attack: SYN/ACK Scan] from source: 52.6.178.220, port 6018, Sunday, September 20, 2015 20:39:54
[DoS Attack: RST Scan] from source: 52.6.178.220, port 6018, Sunday, September 20, 2015 20:39:54
[DoS Attack: SYN/ACK Scan] from source: 52.6.178.220, port 6018, Sunday, September 20, 2015 20:39:52
[DoS Attack: RST Scan] from source: 52.6.178.220, port 6018, Sunday, September 20, 2015 20:39:49
[DoS Attack: SYN/ACK Scan] from source: 52.6.178.220, port 6018, Sunday, September 20, 2015 20:39:43
[DoS Attack: RST Scan] from source: 52.6.178.220, port 6018, Sunday, September 20, 2015 20:39:37
[DoS Attack: SYN/ACK Scan] from source: 52.6.178.220, port 6018, Sunday, September 20, 2015 20:39:30
[DoS Attack: ACK Scan] from source: 116.24.133.147, port 1443, Sunday, September 20, 2015 20:37:45
[DoS Attack: ACK Scan] from source: 116.24.133.147, port 1443, Sunday, September 20, 2015 20:36:34
[DoS Attack: ACK Scan] from source: 116.24.133.147, port 1443, Sunday, September 20, 2015 20:35:22
[DoS Attack: ACK Scan] from source: 116.24.133.147, port 1443, Sunday, September 20, 2015 20:34:10
[DoS Attack: ACK Scan] from source: 116.24.133.147, port 1443, Sunday, September 20, 2015 20:32:59
[DoS Attack: ACK Scan] from source: 116.24.133.147, port 1443, Sunday, September 20, 2015 20:30:37
[DoS Attack: ACK Scan] from source: 58.62.101.166, port 6676, Sunday, September 20, 2015 20:12:50
[DoS Attack: SYN/ACK Scan] from source: 125.95.27.43, port 1443, Sunday, September 20, 2015 19:41:35
[DoS Attack: RST Scan] from source: 14.18.142.9, port 80, Sunday, September 20, 2015 16:07:44
[DoS Attack: RST Scan] from source: 183.61.10.244, port 80, Sunday, September 20, 2015 15:58:55
[DoS Attack: TCP/UDP Chargen] from source: 74.82.47.29, port 42426, Sunday, September 20, 2015 15:45:14
[DoS Attack: SYN/ACK Scan] from source: 8.7.198.45, port 20480, Sunday, September 20, 2015 15:38:29
[DoS Attack: SYN/ACK Scan] from source: 8.7.198.45, port 20480, Sunday, September 20, 2015 15:38:23
[DoS Attack: SYN/ACK Scan] from source: 8.7.198.45, port 20480, Sunday, September 20, 2015 15:38:20
[DoS Attack: SYN/ACK Scan] from source: 90.156.201.42, port 80, Sunday, September 20, 2015 14:54:26
[DoS Attack: ACK Scan] from source: 14.17.41.151, port 443, Sunday, September 20, 2015 13:41:42
[DoS Attack: ACK Scan] from source: 14.17.41.151, port 443, Sunday, September 20, 2015 13:40:27
[DoS Attack: ACK Scan] from source: 103.10.86.215, port 8421, Sunday, September 20, 2015 13:40:07
[DoS Attack: ACK Scan] from source: 14.17.41.151, port 443, Sunday, September 20, 2015 13:39:12
[DoS Attack: ACK Scan] from source: 103.10.86.215, port 8421, Sunday, September 20, 2015 13:38:52
[DoS Attack: ACK Scan] from source: 58.56.65.204, port 7534, Sunday, September 20, 2015 13:38:24
[DoS Attack: ACK Scan] from source: 14.17.41.151, port 443, Sunday, September 20, 2015 13:37:57
[DoS Attack: ACK Scan] from source: 14.17.41.152, port 443, Sunday, September 20, 2015 13:37:56
[DoS Attack: ACK Scan] from source: 103.10.86.215, port 8421, Sunday, September 20, 2015 13:37:37
[DoS Attack: ACK Scan] from source: 58.56.65.204, port 7534, Sunday, September 20, 2015 13:37:09
[DoS Attack: ACK Scan] from source: 183.61.116.81, port 8080, Sunday, September 20, 2015 13:36:54
[DoS Attack: ACK Scan] from source: 183.61.116.83, port 8080, Sunday, September 20, 2015 13:36:48
[DoS Attack: ACK Scan] from source: 14.17.41.151, port 443, Sunday, September 20, 2015 13:36:42
[DoS Attack: ACK Scan] from source: 14.17.41.152, port 443, Sunday, September 20, 2015 13:36:41
[DoS Attack: ACK Scan] from source: 183.61.116.81, port 8080, Sunday, September 20, 2015 13:36:39
[DoS Attack: ACK Scan] from source: 183.61.116.83, port 8080, Sunday, September 20, 2015 13:36:33
[DoS Attack: SYN/ACK Scan] from source: 61.160.224.158, port 80, Sunday, September 20, 2015 10:39:06
[DoS Attack: SYN/ACK Scan] from source: 140.205.180.13, port 80, Sunday, September 20, 2015 10:30:29
[DoS Attack: SYN/ACK Scan] from source: 140.205.180.13, port 80, Sunday, September 20, 2015 10:30:25
[DoS Attack: SYN/ACK Scan] from source: 218.60.16.69, port 8446, Sunday, September 20, 2015 07:37:31

显示全部楼层 · 发表于 2015-9-20 23:55:56

本帖最后由伊川书院于 2015-9-21 00:00 编辑

[DoS Attack: TCP/UDP Chargen] from source: 199.168.138.154, port 49382, Sunday, September 20, 2015 20:44:45

你看一下：199.168.138.154这台电脑是谁的

另外，对于你的问题，建议：更换ISP分配的地址，关闭路由器几分钟之后，再PPPOE拨号就可以动态更新。

然后，再观察几天看看情况怎么样

这种问题很难说，有些是对方随机IP段扫描，有些的针对应的攻击，后者必须知道你的IP是多少
获得IP的方式常见的方式有：网内某机子自己暴露，按装一些不干净的软件，或有恶意文件主动发送你的IP地址给对方等

另外，日志的大至意思是：对方更换不同的IP地址，采用不同的方式偿试扫描的端口，偿试从扫描的返馈信息中，获得自己需要的答案，例如：漏洞
或者说，纯粹的以这种扫描的方式拖垮你的路由器

显示全部楼层 · 发表于 2015-9-20 23:59:07

伊川书院发表于 2015-9-20 23:55
[DoS Attack: TCP/UDP Chargen] from source: 199.168.138.154, port 49382, Sunday, September 20, 2015 2 ...

家里只有一台电脑两个手机，你说的ip我也不知道是谁的，反正不是我自己的，我自己的电脑获取的ip是192.168.8.3

显示全部楼层 · 发表于 2015-9-21 00:01:28

本帖最后由伊川书院于 2015-9-21 00:02 编辑

小7seven 发表于 2015-9-20 23:59
家里只有一台电脑两个手机，你说的ip我也不知道是谁的，反正不是我自己的，我自己的电脑获取的ip是192.16 ...

你看一下你的路由器中的DHCP，分配的154的地址的MAC是多少，然后按照这个MAC查找设备，

如果确定没有，那么，重置路由器后，
更换你的路由器密码和无线密码,内网用户不要采用“wifi共享、万能wifi“等功能的软件

显示全部楼层 · 发表于 2015-9-21 00:02:40

伊川书院发表于 2015-9-20 23:55
[DoS Attack: TCP/UDP Chargen] from source: 199.168.138.154, port 49382, Sunday, September 20, 2015 2 ...

对了我经常连一两个免费的V-P-N看点新闻，每次也都是连半小时左右

显示全部楼层 · 发表于 2015-9-21 00:04:41

小7seven 发表于 2015-9-21 00:02
对了我经常连一两个免费的V-P-N看点新闻，每次也都是连半小时左右

这个不清楚是不是V P N的问题，
你自己先排查一下吧，

重要的是：先更换你外网的IP地址，如果对方还能找到你，那么，再排查本机有没有不良的，不可靠的软件

显示全部楼层 · 发表于 2015-9-21 00:05:59

伊川书院发表于 2015-9-21 00:01
你看一下你的路由器中的DHCP，分配的154的地址的MAC是多少，然后按照这个MAC查找设备，

如果确定没 ...

我不太懂您的意思，内网分配的ip段一般不都是192.168.x.x吗，我看了一下我dhcp里面都是192.168.8.2-5

显示全部楼层 · 发表于 2015-9-21 00:07:07

伊川书院发表于 2015-9-21 00:04
这个不清楚是不是V P N的问题，
你自己先排查一下吧，

好的我查看一下目前的ip
然后断开十分钟再连试试是否更改了ip
谢谢您啦这么晚了还回复

显示全部楼层 · 发表于 2015-9-21 00:07:32

小7seven 发表于 2015-9-21 00:05
我不太懂您的意思，内网分配的ip段一般不都是192.168.x.x吗，我看了一下我dhcp里面都是192.168.8.2-5

对，我看错了，199看成192了，不好意思

你先更换你的外网IP地址，再观察一段时间吧

显示全部楼层 · 发表于 2015-9-21 00:09:31

伊川书院发表于 2015-9-21 00:07
对，我看错了，199看成192了，不好意思

嗯是的我看了一下日志攻击方都是外网ip 倒是我也没感到什么影响就是无意中看到了这个日志谢谢您啦我断网一会儿再观察下

[其他] 求助坛友，路由DOS攻击