DOS Attack

[Sa9aX11]

Hi

Is this normal coming from my R7000 router?

"[DoS attack: FIN Scan] attack packets in last 20 sec from ip [52.16.17.159]"

Sal.

[jguerdat]

Hard to say.  Is there a reason you suspect Arlo?

Edit: A whois search shows me this:

http://whois.arin.net/rest/net/NET-52-0-0-0-1/pft?s=52.16.17.159

[Hula_Rock]

52.16.17.159 Netgear does use Amazons' servers,  interesting ......

[TomMac]

Maybe an attack into Amazon's network more than yours

# The following results may also be obtained via:
# http://whois.arin.net/rest/nets;q=52.16.17.159?showDetails=true&showARIN=false&showNonArinTopLevelNet=false&ext=netref2
#

NetRange:       52.0.0.0 - 52.31.255.255
CIDR:           52.0.0.0/11
NetName:        AT-88-Z
NetHandle:      NET-52-0-0-0-1
Parent:         NET52 (NET-52-0-0-0-0)
NetType:        Direct Allocation
OriginAS:       
Organization:   Amazon Technologies Inc. (AT-88-Z)
RegDate:        1991-12-19
Updated:        2015-03-20
Ref:            http://whois.arin.net/rest/net/NET-52-0-0-0-1

[Hula_Rock]

---

Sa9aX11 wrote:

Hi

Is this normal coming from my R7000 router?

"[DoS attack: FIN Scan] attack packets in last 20 sec from ip [52.16.17.159]"

Sal.

---

Turn on Port Scan on the R7000 and post some logs.

[Sa9aX11]

I just placed the IP address 52.16.17.159  to my web browser and I got https://arlo.netgear.com/, Arlo Web Portal is doing a DOS Attack?

Sal

[StuBee]

Didn't netgear just release a new Firmware for your R7000.   I believe it's so the R7000 can be used instead of the Arlo base-station.

So having said that...I bet it's some kind of bug that Arlo Portal is pinging R7000's and your router is thinking it's a DOS attack.

a) Are you using your R7000 as the Arlo base station?

b) What firmware version is on your R7000

You should probably open a case to Netgear.

[Sa9aX11]

---

StuBee wrote:

Didn't netgear just release a new Firmware for your R7000.   I believe it's so the R7000 can be used instead of the Arlo base-station.

So having said that...I bet it's some kind of bug that Arlo Portal is pinging R7000's and your router is thinking it's a DOS attack.

a) Are you using your R7000 as the Arlo base station?

b) What firmware version is on your R7000

You should probably open a case to Netgear.

---

To answer to your question:

a) Yes

b) V1.0.6.28_1.1.83 (Latest one)

Its probably nothing it does it when I reset the router.

Sal

[jguerdat]

I'd agree.  Since the Q is constanly streaming, incoming packets will be required, too.  Maybe whitelist arlo.netgear.com if that's possible?

[Hula_Rock]

After your Router is reset it loses its DHCP Binding.  Sounds like false postives due to high thresholds set on the R7000.  Basically it does not like to wait while setting up DHCP with the Netgear Servers.