DoS Attacks

Hello..

Following the advice from someone in the ISP section, I thought I would start a thread here.

For the past few months, my dynamically assigned IP address has been the target for numerous DoS attacks and I would like some advice on finding out the cause of them please. The vast majority of the attacks originate in Turkey (Turk Telekom) but I have noticed a couple from the USA today. There's also one or two from Malaysia from time to time. All the ones from Turkey target TCP port 23 and the ones from America today were targeted at TCP port 22. Also, the ones from the States trace back to Lafayette Consolidated Government. WTF is that all about???

Here's a sample from my router logs:
Mon, 2009-12-07 03:06:16 - TCP Packet - Source:85.110.102.206,4564 Destination:X.X.X.X,23 - [DOS]
Mon, 2009-12-07 03:06:17 - TCP Packet - Source:85.96.200.106,2401 Destination:X.X.X.X,23 - [DOS]
Mon, 2009-12-07 03:06:17 - TCP Packet - Source:88.242.4.159,4150 Destination:X.X.X.X,23 - [DOS]
Mon, 2009-12-07 03:06:17 - TCP Packet - Source:88.227.108.21,2402 Destination:X.X.X.X,23 - [DOS]
Mon, 2009-12-07 03:06:17 - TCP Packet - Source:81.213.174.206,3990 Destination:X.X.X.X,23 - [DOS]
Mon, 2009-12-07 03:06:17 - TCP Packet - Source:81.214.24.155,4997 Destination:X.X.X.X,23 - [DOS]
Mon, 2009-12-07 03:06:17 - TCP Packet - Source:88.242.181.71,3692 Destination:X.X.X.X,23 - [DOS]
Mon, 2009-12-07 03:06:17 - TCP Packet - Source:78.185.62.95,4730 Destination:X.X.X.X,23 - [DOS]
Mon, 2009-12-07 03:06:17 - TCP Packet - Source:81.214.121.76,2982 Destination:X.X.X.X,23 - [DOS]
Mon, 2009-12-07 03:06:17 - TCP Packet - Source:81.213.167.174,2976 Destination:X.X.X.X,23 - [DOS]
Mon, 2009-12-07 03:06:17 - TCP Packet - Source:88.254.98.242,3932 Destination:X.X.X.X,23 - [DOS]
Mon, 2009-12-07 03:06:17 - TCP Packet - Source:60.52.68.20,2834 Destination:X.X.X.X,23 - [DOS]
Mon, 2009-12-07 03:06:17 - TCP Packet - Source:88.252.65.112,4292 Destination:X.X.X.X,23 - [DOS]
Mon, 2009-12-07 03:40:35 - TCP Packet - Source:69.1.176.194,43513 Destination:X.X.X.X,22 - [DOS]
Mon, 2009-12-07 03:40:36 - TCP Packet - Source:69.1.176.2,43513 Destination:X.X.X.X,22 - [DOS]
Mon, 2009-12-07 03:40:36 - TCP Packet - Source:69.1.176.132,43513 Destination:X.X.X.X,22 - [DOS]

I've replaced my IP address for obvious reasons. At the time of the attacks, my computer was off and I was tucked up in bed. The attacks will sometimes happen when the computer is off so I think it's unlikely that the traffic is somehow being triggered from my computer. Also, i've checked my firewall logs and none of the IP addresses are present.

When using Google, Project Honeypot and IP check tools, the majority of the Turkish based IP addresses are identified as mail servers and/or dictionary attackers.

I've raised the point to my ISP but they were not helpful at all. It seems my internet safety and privacy is not their concern. I've also reported the attacks to the source ISP a number of times but they have failed to acknowledge the emails or take any action.

I'm just at a loss of what's causing this. Every now and again, I refresh my IP address and within a few days, there's some fresh attacks in my router logs. I suspect that the attackers may be scanning ranges belonging to my ISP (Madasafish) but if that was the case, surely it is in the interests of my ISP to investigate and take action?? It would be interesting to hear from other MAAF customers to see if they have been experiencing the same problems.

My router is set to not respond to WAN ping requests, has decent WPA2 encryption and all devices that connect to my router are filtered by MAC address so I feel my network is safe...i'm just confused as to what is causing the attacks.

Any help of advice would be gratefully accepted.

Many thanks

Bump...anyone able to offer any advice please??

More hits in my router logs:
Wed, 2009-12-09 03:10:09 - TCP Packet - Source:81.213.249.216,2407 Destination:X.X.X.X,23 - [DOS]
Wed, 2009-12-09 03:10:09 - TCP Packet - Source:81.214.190.143,2115 Destination:X.X.X.X,23 - [DOS]
Wed, 2009-12-09 03:10:09 - TCP Packet - Source:81.214.120.21,3972 Destination:X.X.X.X,23 - [DOS]
Wed, 2009-12-09 03:10:09 - TCP Packet - Source:88.252.210.255,4601 Destination:X.X.X.X,23 - [DOS]
Wed, 2009-12-09 03:10:09 - TCP Packet - Source:85.96.194.188,2286 Destination:X.X.X.X,23 - [DOS]
Wed, 2009-12-09 03:10:09 - TCP Packet - Source:88.232.198.87,3195 Destination:X.X.X.X,23 - [DOS]
Wed, 2009-12-09 03:10:09 - TCP Packet - Source:81.213.153.82,2282 Destination:X.X.X.X,23 - [DOS]
Wed, 2009-12-09 03:10:09 - TCP Packet - Source:88.252.254.30,2838 Destination:X.X.X.X,23 - [DOS]
Wed, 2009-12-09 03:10:09 - TCP Packet - Source:88.228.251.123,3403 Destination:X.X.X.X,23 - [DOS]
Thu, 2009-12-10 18:40:46 - TCP Packet - Source:88.232.48.129,3220 Destination:X.X.X.X,23 - [DOS]
Thu, 2009-12-10 18:40:47 - TCP Packet - Source:88.227.153.134,2504 Destination:X.X.X.X,23 - [DOS]
Thu, 2009-12-10 18:40:47 - TCP Packet - Source:88.242.230.161,2262 Destination:X.X.X.X,23 - [DOS]
Thu, 2009-12-10 18:40:47 - TCP Packet - Source:88.236.123.163,4196 Destination:X.X.X.X,23 - [DOS]
Thu, 2009-12-10 18:40:47 - TCP Packet - Source:81.214.68.236,3242 Destination:X.X.X.X,23 - [DOS]
Thu, 2009-12-10 18:40:47 - TCP Packet - Source:78.179.130.179,3049 Destination:X.X.X.X,23 - [DOS]
Thu, 2009-12-10 18:40:47 - TCP Packet - Source:81.213.99.74,2933 Destination:X.X.X.X,23 - [DOS]
Thu, 2009-12-10 18:40:47 - TCP Packet - Source:88.236.175.244,4276 Destination:X.X.X.X,23 - [DOS]
Thu, 2009-12-10 18:40:47 - TCP Packet - Source:88.232.155.105,2368 Destination:X.X.X.X,23 - [DOS]
Thu, 2009-12-10 18:40:47 - TCP Packet - Source:41.243.176.10,4026 Destination:X.X.X.X,23 - [DOS]
Thu, 2009-12-10 18:40:47 - TCP Packet - Source:81.214.85.201,3476 Destination:X.X.X.X,23 - [DOS]

During this period, I rebooted my router to get a new IP address and the attacks continued the next day.

I really would appreciate some help please.

Thank you

It's not a DOS attack, it's someone trying to connect to your TELNET server.

Looks like something may be trying to telenet into your router

your router (or PC) doesn't have any dynamic dns such as dyndns.org setup?

Do these seem to start after you visit a website (where something may record your IP address)?

You don't have any spyware/virus which has called home?

Your router has got remote confiuration disabled and it does have stealth mode on (so doesn't respond to interenet requests)?

In reply to a post by BatBoy:

It's not a DOS attack, it's someone trying to connect to your TELNET server.

Thanks for the reply. Any ideas how someone is trying to repeatedly connect to me via telnet?

In reply to a post by Kenneth:

Looks like something may be trying to telenet into your router

your router (or PC) doesn't have any dynamic dns such as dyndns.org setup?

Do these seem to start after you visit a website (where something may record your IP address)?

You don't have any spyware/virus which has called home?

Your router has got remote confiuration disabled and it does have stealth mode on (so doesn't respond to interenet requests)?

Thank you for the reply Kenneth.

Nope, my router does not have dynamic dns enabled or setup.

Also, I can't pinpoint this activity to anything i'm doing online. Sometimes the connection attempts are logged hours after the computer was switched off which just makes things more difficult to work out. As for the spyware question, AFAIK, my computer is clean. I scan regularly with NOD32 and Malwarebytes and just for good measure, I run an online scan once a week and my HJT log file is clean too.

And yep, my router is set not to respond to ping requests and remote management is off as well.

Thanks again for the reply...really appreciate it

ensure no telnet servers are running on your network. Often routers themselves have telnet servers (for remote management by administrators) inbuilt, so check your router settings also.

try running a shields up (common ports) test to see which of your ports are open to the outside world.

https://grc.com/x/ne.dll?bh0bkyd2

port 23 is telnet
port 22 is ssh (secured telnet)

Edited by Spudster (Thu 10-Dec-09 22:08:05)

In reply to a post by Spudster:

ensure no telnet servers are running on your network. Often routers themselves have telnet servers (for remote management by administrators) inbuilt, so check your router settings also.

try running a shields up (common ports) test to see which of your ports are open to the outside world.

https://grc.com/x/ne.dll?bh0bkyd2

port 23 is telnet
port 22 is ssh (secured telnet)

SheildsUp scan passed with flying colours...ran the file sharing, common ports and all service ports tests and i'm stealthed

Telnet is definitely not running on the network and the remote admin section of my router is disabled.

Thanks for the reply

I note from your router logs that your IP ends in 23. Do you have a fixed IP address or are the 23s just a number you typed in when you Xed out your address?

If it is a fixed address, you may find that it is listed online and people are trying to connect. Try searching for your IP and see if it is listed anywhere.

erm , don't you think that as his post shows 4 Xs - X.X.X.X.23- then the 23 is nothing to do with his IP address? In fact he's complaining about attacks on port 23, and 22