2 replies to this topic

[voyevoda]

ตามนั้นเลย เหมือนจะเกิดขึ้นเมื่อวันเสาร์ช่วงเย็น เน็ตของ ToT-Winet
หลุดทุกๆชัวโมงได้มั้่งแล้วกว่าจะใช้ได้ก็อีกชั่วโมง สลับกันใช้1หลุด1ชม.

ผมเลยลองดูที่ router log
พบตามนี้ [อันี้พอเน็ตหลุดผมเข้าไปดูทันที]

ผมสงสัยว่ามันเป็นที่เราหรือเปล่าเอ่ย ,แต่ attack มาจาก WAN ถ้าผมเข้าใจไม่ผิด ToT Winet เป็น WAN เหมือนกับแชร์ wireless ระยะไกล
มันเลยน่าจะเป็นที่ฝั่ง ToT ที่โดน Attack นี้แล้วทำให้ ลูกค้าใช้งานไม่ได้

หรือเครื่องผมโดนเป็ฯตัวยิง ping ICMP รัวๆจนโดน isp ตัด = =

ระหว่างนี้ผมได้ลองปรับ router เปิด DoS protection ก็ไม่แตกต่าง, แล้วสแกนเครื่องด้วย malwarebyte , avast (boot scan) ก็ไม่พบอะไร



อันนี้คืออันเต็ม ตแ่อาจจะคลละช่วงเวลา

Spoiler

Apr 03 13:49:29 Per-source ICMP Flood Attack Detect Packet Dropped<br>
Apr 03 13:49:29 Whole System ACK Flood Attack from WAN Rule:Default deny<br>
Apr 03 13:49:29 Whole System ICMP Flood Attack from WAN Rule:Default deny<br>
Apr 03 13:48:29 Per-source ACK Flood Attack Detect Packet Dropped<br>
Apr 03 13:48:29 Whole System ACK Flood Attack from WAN Rule:Default deny<br>
Apr 03 13:48:29 Whole System UDP Flood Attack from WAN Rule:Default deny<br>
Apr 03 13:47:29 Per-source ACK Flood Attack Detect Packet Dropped<br>
Apr 03 13:47:29 Whole System ACK Flood Attack from WAN Rule:Default deny<br>
Apr 03 13:47:29 Whole System UDP Flood Attack from WAN Rule:Default deny<br>
Apr 03 13:46:29 Port Scan Attack Detect Packet Dropped<br>
Apr 03 13:46:29 Per-source ACK Flood Attack Detect Packet Dropped<br>
Apr 03 13:46:29 Whole System ACK Flood Attack from WAN Rule:Default deny<br>
Apr 03 13:45:29 Port Scan Attack Detect Packet Dropped<br>
Apr 03 13:45:29 Per-source ACK Flood Attack Detect Packet Dropped<br>
Apr 03 13:45:29 Whole System ACK Flood Attack from WAN Rule:Default deny<br>
Apr 03 13:44:29 Port Scan Attack Detect Packet Dropped<br>
Apr 03 13:44:29 Per-source ACK Flood Attack Detect Packet Dropped<br>
Apr 03 13:44:29 Whole System ACK Flood Attack from WAN Rule:Default deny<br>
Apr 03 13:43:29 Whole System ACK Flood Attack from WAN Rule:Default deny<br>
Apr 03 13:42:46 DHCP lease IP 192.168.0.100 to android-ea1ba7bd13ee51ea 84-11-9e-20-d4-98<br>
Apr 03 13:42:46 Authentication Success 84-11-9e-20-d4-98<br>
Apr 03 13:42:45 Authenticating...... 84-11-9e-20-d4-98<br>
Apr 03 13:42:29 Per-source ACK Flood Attack Detect Packet Dropped<br>
Apr 03 13:42:29 Whole System ACK Flood Attack from WAN Rule:Default deny<br>
Apr 03 13:41:29 Whole System ACK Flood Attack from WAN Rule:Default deny<br>
Apr 03 13:40:29 Per-source ACK Flood Attack Detect Packet Dropped<br>
Apr 03 13:40:29 Whole System ACK Flood Attack from WAN Rule:Default deny<br>
Apr 03 13:39:30 Per-source ACK Flood Attack Detect Packet Dropped<br>
Apr 03 13:39:29 Whole System ACK Flood Attack from WAN Rule:Default deny<br>
Apr 03 13:39:29 Whole System UDP Flood Attack from WAN Rule:Default deny<br>
Apr 03 13:38:29 Whole System ACK Flood Attack from WAN Rule:Default deny<br>
Apr 03 13:37:29 Per-source ACK Flood Attack Detect Packet Dropped<br>
Apr 03 13:37:29 Whole System ACK Flood Attack from WAN Rule:Default deny<br>
Apr 03 13:36:29 Whole System ACK Flood Attack from WAN Rule:Default deny<br>
Apr 03 13:35:29 Whole System ACK Flood Attack from WAN Rule:Default deny<br>
Apr 03 13:34:29 Whole System ACK Flood Attack from WAN Rule:Default deny<br>
Apr 03 13:33:29 Per-source ACK Flood Attack Detect Packet Dropped<br>
Apr 03 13:33:29 Whole System ACK Flood Attack from WAN Rule:Default deny<br>
Apr 03 13:32:29 Per-source ACK Flood Attack Detect Packet Dropped<br>
Apr 03 13:32:29 Whole System ACK Flood Attack from WAN Rule:Default deny<br>
Apr 03 13:31:29 Whole System ACK Flood Attack from WAN Rule:Default deny<br>
Apr 03 13:30:29 Per-source ACK Flood Attack Detect Packet Dropped<br>
Apr 03 13:30:29 Whole System ACK Flood Attack from WAN Rule:Default deny<br>
Apr 03 13:29:29 Per-source ACK Flood Attack Detect Packet Dropped<br>
Apr 03 13:29:29 Whole System ACK Flood Attack from WAN Rule:Default deny<br>
Apr 03 13:28:29 Whole System ACK Flood Attack from WAN Rule:Default deny<br>
Apr 03 13:28:29 Whole System UDP Flood Attack from WAN Rule:Default deny<br>
Apr 03 13:27:29 Per-source ACK Flood Attack Detect Packet Dropped<br>
Apr 03 13:27:29 Whole System ACK Flood Attack from WAN Rule:Default deny<br>
Apr 03 13:27:29 Whole System UDP Flood Attack from WAN Rule:Default deny<br>
Apr 03 13:26:29 Port Scan Attack Detect Packet Dropped<br>
Apr 03 13:26:29 Per-source ACK Flood Attack Detect Packet Dropped<br>
Apr 03 13:26:29 Whole System ACK Flood Attack from WAN Rule:Default deny<br>
Apr 03 13:25:30 Port Scan Attack Detect Packet Dropped<br>
Apr 03 13:25:29 Per-source ACK Flood Attack Detect Packet Dropped<br>
Apr 03 13:25:29 Whole System ACK Flood Attack from WAN Rule:Default deny<br>
Apr 03 13:24:29 Port Scan Attack Detect Packet Dropped<br>
Apr 03 13:24:29 Per-source ACK Flood Attack Detect Packet Dropped<br>
Apr 03 13:24:29 Whole System ACK Flood Attack from WAN Rule:Default deny<br>
Apr 03 13:23:30 Port Scan Attack Detect Packet Dropped<br>
Apr 03 13:23:29 Per-source ACK Flood Attack Detect Packet Dropped<br>
Apr 03 13:23:29 Whole System ACK Flood Attack from WAN Rule:Default deny<br>
Apr 03 13:22:29 Port Scan Attack Detect Packet Dropped<br>
Apr 03 13:22:29 Per-source ACK Flood Attack Detect Packet Dropped<br>
Apr 03 13:22:29 Whole System ACK Flood Attack from WAN Rule:Default deny<br>
Apr 03 13:21:29 Whole System ACK Flood Attack from WAN Rule:Default deny<br>
Apr 03 13:20:29 Per-source ACK Flood Attack Detect Packet Dropped<br>
Apr 03 13:20:29 Whole System ACK Flood Attack from WAN Rule:Default deny<br>
Apr 03 13:19:29 Port Scan Attack Detect Packet Dropped<br>
Apr 03 13:19:29 Per-source ACK Flood Attack Detect Packet Dropped<br>
Apr 03 13:19:29 Whole System ACK Flood Attack from WAN Rule:Default deny<br>
Apr 03 13:18:29 Port Scan Attack Detect Packet Dropped<br>
Apr 03 13:18:29 Per-source ACK Flood Attack Detect Packet Dropped<br>
Apr 03 13:18:29 Whole System ACK Flood Attack from WAN Rule:Default deny<br>
Apr 03 13:17:29 Port Scan Attack Detect Packet Dropped<br>
Apr 03 13:17:29 Per-source ACK Flood Attack Detect Packet Dropped<br>
Apr 03 13:17:29 Whole System ACK Flood Attack from WAN Rule:Default deny<br>
Apr 03 13:16:29 Per-source ACK Flood Attack Detect Packet Dropped<br>
Apr 03 13:16:29 Whole System ACK Flood Attack from WAN Rule:Default deny<br>
Apr 03 13:15:29 Port Scan Attack Detect Packet Dropped<br>
Apr 03 13:15:29 Per-source ACK Flood Attack Detect Packet Dropped<br>
Apr 03 13:15:29 Whole System ACK Flood Attack from WAN Rule:Default deny<br>
Apr 03 13:14:29 Port Scan Attack Detect Packet Dropped<br>
Apr 03 13:14:29 Per-source ACK Flood Attack Detect Packet Dropped<br>
Apr 03 13:14:29 Whole System ACK Flood Attack from WAN Rule:Default deny<br>
Apr 03 13:13:29 Port Scan Attack Detect Packet Dropped<br>
Apr 03 13:13:29 Per-source ACK Flood Attack Detect Packet Dropped<br>
Apr 03 13:13:29 Whole System ACK Flood Attack from WAN Rule:Default deny<br>
Apr 03 13:12:29 Port Scan Attack Detect Packet Dropped<br>
Apr 03 13:12:29 Per-source ACK Flood Attack Detect Packet Dropped<br>
Apr 03 13:12:29 Whole System ACK Flood Attack from WAN Rule:Default deny<br>
Apr 03 13:12:29 Whole System UDP Flood Attack from WAN Rule:Default deny<br>
Apr 03 13:11:30 Port Scan Attack Detect Packet Dropped<br>
Apr 03 13:11:29 Per-source ACK Flood Attack Detect Packet Dropped<br>
Apr 03 13:11:29 Whole System ACK Flood Attack from WAN Rule:Default deny<br>
Apr 03 13:11:29 Whole System UDP Flood Attack from WAN Rule:Default deny<br>
Apr 03 13:10:30 Port Scan Attack Detect Packet Dropped<br>
Apr 03 13:10:29 Per-source ACK Flood Attack Detect Packet Dropped<br>
Apr 03 13:10:29 Whole System ACK Flood Attack from WAN Rule:Default deny<br>
Apr 03 13:10:29 Whole System UDP Flood Attack from WAN Rule:Default deny<br>
Apr 03 13:09:29 Port Scan Attack Detect Packet Dropped<br>
Apr 03 13:09:29 Per-source ACK Flood Attack Detect Packet Dropped<br>
Apr 03 13:09:29 Whole System ACK Flood Attack from WAN Rule:Default deny<br>
Apr 03 13:09:29 Whole System UDP Flood Attack from WAN Rule:Default deny<br>
Apr 03 13:08:29 Per-source ACK Flood Attack Detect Packet Dropped<br>
Apr 03 13:08:29 Whole System ACK Flood Attack from WAN Rule:Default deny<br>
Apr 03 13:07:29 Whole System ACK Flood Attack from WAN Rule:Default deny<br>
Apr 03 13:07:29 Whole System UDP Flood Attack from WAN Rule:Default deny<br>
Apr 03 13:06:29 Per-source UDP Flood Attack Detect Packet Dropped<br>
Apr 03 13:06:29 Per-source ACK Flood Attack Detect Packet Dropped<br>
Apr 03 13:06:29 Whole System ACK Flood Attack from WAN Rule:Default deny<br>
Apr 03 13:06:29 Whole System UDP Flood Attack from WAN Rule:Default deny<br>
Apr 03 13:05:29 Per-source ACK Flood Attack Detect Packet Dropped<br>
Apr 03 13:05:29 Whole System ACK Flood Attack from WAN Rule:Default deny<br>
Apr 03 13:04:29 Per-source ACK Flood Attack Detect Packet Dropped<br>
Apr 03 13:04:29 Whole System ACK Flood Attack from WAN Rule:Default deny<br>
Apr 03 13:03:29 Per-source ACK Flood Attack Detect Packet Dropped<br>
Apr 03 13:03:29 Whole System ACK Flood Attack from WAN Rule:Default deny<br>
Apr 03 13:03:29 Whole System UDP Flood Attack from WAN Rule:Default deny<br>
Apr 03 13:02:29 Per-source UDP Flood Attack Detect Packet Dropped<br>
Apr 03 13:02:29 Whole System UDP Flood Attack from WAN Rule:Default deny<br>
Apr 03 13:01:29 Per-source UDP Flood Attack Detect Packet Dropped<br>
Apr 03 13:00:29 Per-source UDP Flood Attack Detect Packet Dropped<br>
Apr 03 13:00:29 Whole System UDP Flood Attack from WAN Rule:Default deny<br>
Apr 03 12:59:29 Per-source UDP Flood Attack Detect Packet Dropped<br>
Apr 03 12:59:29 Whole System UDP Flood Attack from WAN Rule:Default deny<br>
Apr 03 12:58:29 Per-source UDP Flood Attack Detect Packet Dropped<br>
Apr 03 12:57:29 Per-source ICMP Flood Attack Detect Packet Dropped<br>
Apr 03 12:57:29 Whole System ICMP Flood Attack from WAN Rule:Default deny<br>
Apr 03 12:56:29 Per-source UDP Flood Attack Detect Packet Dropped<br>
Apr 03 12:56:29 Whole System UDP Flood Attack from WAN Rule:Default deny<br>
Apr 03 12:53:29 Per-source ICMP Flood Attack Detect Packet Dropped<br>
Apr 03 12:53:29 Whole System ICMP Flood Attack from WAN Rule:Default deny<br>
Apr 03 12:52:29 Per-source ICMP Flood Attack Detect Packet Dropped<br>
Apr 03 12:52:29 Whole System ICMP Flood Attack from WAN Rule:Default deny<br>
Apr 03 12:51:29 Per-source ICMP Flood Attack Detect Packet Dropped<br>
Apr 03 12:51:29 Whole System ICMP Flood Attack from WAN Rule:Default deny<br>
Apr 03 12:50:29 Per-source ICMP Flood Attack Detect Packet Dropped<br>
Apr 03 12:50:29 Whole System ICMP Flood Attack from WAN Rule:Default deny<br>
Apr 03 12:49:29 Per-source ICMP Flood Attack Detect Packet Dropped<br>
Apr 03 12:49:29 Whole System ICMP Flood Attack from WAN Rule:Default deny<br>
Apr 03 12:48:29 Per-source ICMP Flood Attack Detect Packet Dropped<br>
Apr 03 12:48:29 Whole System ICMP Flood Attack from WAN Rule:Default deny<br>
Apr 03 12:47:29 Per-source ICMP Flood Attack Detect Packet Dropped<br>
Apr 03 12:47:29 Whole System ICMP Flood Attack from WAN Rule:Default deny<br>
Apr 03 12:46:29 Per-source ICMP Flood Attack Detect Packet Dropped<br>
Apr 03 12:46:29 Whole System ICMP Flood Attack from WAN Rule:Default deny<br>
Apr 03 12:45:29 Per-source ICMP Flood Attack Detect Packet Dropped<br>
Apr 03 12:45:29 Whole System ICMP Flood Attack from WAN Rule:Default deny<br>
Apr 03 12:44:29 Per-source ICMP Flood Attack Detect Packet Dropped<br>
Apr 03 12:44:29 Whole System ICMP Flood Attack from WAN Rule:Default deny<br>
Apr 03 12:43:29 Per-source ICMP Flood Attack Detect Packet Dropped<br>
Apr 03 12:43:29 Whole System ICMP Flood Attack from WAN Rule:Default deny<br>
Apr 03 12:42:29 Per-source ICMP Flood Attack Detect Packet Dropped<br>
Apr 03 12:42:29 Whole System ICMP Flood Attack from WAN Rule:Default deny<br>
Apr 03 12:41:29 Per-source ICMP Flood Attack Detect Packet Dropped<br>
Apr 03 12:41:29 Whole System ICMP Flood Attack from WAN Rule:Default deny<br>
Apr 03 12:40:29 Per-source ICMP Flood Attack Detect Packet Dropped<br>
Apr 03 12:40:29 Whole System ICMP Flood Attack from WAN Rule:Default deny<br>
Apr 03 12:40:05 DHCP lease IP 192.168.0.102 to THUNDERNB-PC dc-85-de-3e-7b-54<br>
Apr 03 12:40:03 Authentication Success dc-85-de-3e-7b-54<br>
Apr 03 12:40:03 Authenticating...... dc-85-de-3e-7b-54<br>
Apr 03 12:36:29 Per-source ICMP Flood Attack Detect Packet Dropped<br>
Apr 03 12:36:29 Whole System ICMP Flood Attack from WAN Rule:Default deny<br>
Apr 03 12:35:29 Per-source ICMP Flood Attack Detect Packet Dropped<br>
Apr 03 12:35:29 Whole System ICMP Flood Attack from WAN Rule:Default deny<br>
Apr 03 12:34:29 Per-source ICMP Flood Attack Detect Packet Dropped<br>
Apr 03 12:34:29 Whole System ICMP Flood Attack from WAN Rule:Default deny<br>
Apr 03 12:33:29 Per-source ICMP Flood Attack Detect Packet Dropped<br>
Apr 03 12:33:29 Whole System ICMP Flood Attack from WAN Rule:Default deny<br>
Apr 03 12:32:29 Per-source ICMP Flood Attack Detect Packet Dropped<br>
Apr 03 12:32:29 Whole System ICMP Flood Attack from WAN Rule:Default deny<br>
Apr 03 12:21:29 Per-source ICMP Flood Attack Detect Packet Dropped<br>
Apr 03 12:21:29 Whole System ICMP Flood Attack from WAN Rule:Default deny<br>
Apr 03 12:20:29 Per-source ICMP Flood Attack Detect Packet Dropped<br>
Apr 03 12:20:29 Whole System ICMP Flood Attack from WAN Rule:Default deny<br>
Apr 03 12:19:29 Per-source ICMP Flood Attack Detect Packet Dropped<br>
Apr 03 12:19:29 Whole System ICMP Flood Attack from WAN Rule:Default deny<br>
Apr 03 12:18:29 Per-source ICMP Flood Attack Detect Packet Dropped<br>
Apr 03 12:18:29 Whole System ICMP Flood Attack from WAN Rule:Default deny<br>
Apr 03 12:17:29 Per-source ICMP Flood Attack Detect Packet Dropped<br>
Apr 03 12:17:29 Whole System ICMP Flood Attack from WAN Rule:Default deny<br>
Apr 03 12:16:29 Port Scan Attack Detect Packet Dropped<br>
Apr 03 12:16:29 Per-source ACK Flood Attack Detect Packet Dropped<br>
Apr 03 12:16:29 Whole System ACK Flood Attack from WAN Rule:Default deny<br>
Apr 03 12:15:29 Port Scan Attack Detect Packet Dropped<br>
Apr 03 12:15:29 Per-source ACK Flood Attack Detect Packet Dropped<br>
Apr 03 12:15:29 Whole System ACK Flood Attack from WAN Rule:Default deny<br>
Apr 03 12:14:29 Per-source ACK Flood Attack Detect Packet Dropped<br>
Apr 03 12:14:29 Whole System UDP Flood Attack from WAN Rule:Default deny<br>
Apr 03 12:13:29 Port Scan Attack Detect Packet Dropped<br>
Apr 03 12:13:29 Per-source ACK Flood Attack Detect Packet Dropped<br>
Apr 03 12:13:29 Whole System ACK Flood Attack from WAN Rule:Default deny<br>
Apr 03 12:13:29 Whole System UDP Flood Attack from WAN Rule:Default deny<br>
Apr 03 12:12:29 Port Scan Attack Detect Packet Dropped<br>
Apr 03 12:12:29 Per-source ACK Flood Attack Detect Packet Dropped<br>
Apr 03 12:12:29 Whole System ACK Flood Attack from WAN Rule:Default deny<br>
Apr 03 12:12:29 Whole System UDP Flood Attack from WAN Rule:Default deny<br>
Apr 03 12:11:29 Port Scan Attack Detect Packet Dropped<br>
Apr 03 12:11:29 Per-source ACK Flood Attack Detect Packet Dropped<br>

Edited by voyevoda, 03 April 2016 - 05:58 PM.

[denorest]

เหมือนโดน Scan port หา vulnerable เฉยๆนะครับ
แต่ดูคร่าวๆแล้วมันก็โดนดร็อปไปหมด
แต่ที่ Connection drop นี่ไม่รู้เพราะ Router รับไม่ไหว หรือ ISP ไม่ไหว

[voyevoda]

วันนี้หายละครับ ผมลองกับ router 2 ตัว Dlink ตัวที่เค้าให้มากับ Asus NT 12HP ตัวหลังนี่เปิด DoS pretection ได้ แต่ก็เปิดไว้ เมื่อวานปัญหาก็ยังเกิ

วันนี้ช่างคงแก้ละ น่าจะเป็นจาก isp = =' มั้ง