Connection disconnects periodically, found DoS attack logs that correlate

LadyA

Honorable
Dec 8, 2012
69
0
10,630
Here's the info I read that I should share first:

-Router: Netgear WNDR4300
-Modem: Arris TM722G/CT
-Computer: Dell Studio XPS 8100
-Motherboard: Dell Inc. 0T568R, A00
-Power Supply: unknown; didn't want to open up the tower. I don't think the problem has to do with that anyways.
-Network Adapter: Broadcom NetLink Gigabit Ethernet, firmware V1.0.2.80
-OS: Windows 10 Home 64bit
-ISP: Comcast
-Number of connections: if everyone is using all their devices at the same time, there's a total of 6 devices (2 PCs, 2 laptops, 2 phones). But this problem happens even when ONLY the affected computer is online and, the rest of the time, we typically only have 3 devices going at the same time on a given day.
-No error messages from Windows or the ISP, simply being disconnected
-I don't know what the question about "switches" and "ports" means? We just have a modem and the router, and her computer is connected to the router via LAN. But yes, the router does have WiFi and four of the other devices (when they are on) use WiFi. The remaining device out of the total 6 is on LAN (wired under the house to a different room).

Periodically, ever since the Windows 10 upgrade, while my mom is using the internet, it will just disconnect. It seems to always happen while trying to connect to a new page (i.e. you click to view a new link and you get the "loading" symbol for a few seconds and then it just disconnects - a yellow triangle shows up on the connection icon in the system tray, and you can no longer get online).

In case it is helpful for the experts, the last website that knocked it off the internet was while we tried to go from www.cnn.com to www.cnn.com/2015/10/05/style/gallery/world-beard-championship/index.html. (If you need more examples of URLs that cause the disconnect, let me know, it shouldn't be too hard to write down some more. I just have to surf around and it happens eventually.)

The network connections troubleshooting report always says the issue found was "The default Gateway is not available" (and it's marked as fixed and the connection gets reestablished). During the troubleshooting action it says that it reset the local area connection and stuff. But it always ends up successfully getting the connection back on.

During one example, after that website I shared above kicked it off, we got the connection back and then I tried to reload that same webpage and it kicked us off again. So there is something specific with something that gets transferred between that site/URL and the network or computer or whatnot (I'm a total amateur, so not completely sure what I'm talking about).

Also, I logged into her RouterLogin.net to watch the log during this and there were lots of scattered "DoS Attacks" shown but once I had it open and was watching the log, I could tell that the last two times, the disconnect was *directly* correlated to the following two entries in the log:

[DoS Attack: SYN/ACK Scan] from source: 203.66.120.63, port 80, Monday, October 05, 2015 23:30:57

[DoS Attack: SYN/ACK Scan] from source: 175.99.86.27, port 80, Tuesday, October 06, 2015 00:23:08

I could probably get more entries for direct correlation if you need them, by just using the computer some more and checking each time it disconnects. This disconnect issue has been happening for a couple months, but it wasn't until tonight that I checked my mom's router logs, so so far I've only gotten those two entries from direct observation in real time of it disconnecting.

There are tons of other "DoS Attack" entries though, from all different IP addresses and to a variety of ports, though the two I watched tonight were both to port 80.

Her computer is on wired LAN with wifi disabled. Oddly, the periodic disconnect has been happening all the time with Chrome and IE, but only maybe once when I used the new "Edge" browser. When it kept happening in Chrome and IE, I tried Edge and was able to stay online for a lot longer. Sometimes it would never go off the whole night using that browser actually. But then as soon as we switch to Chrome or IE, it would decide to disconnect at some point fairly soon after. It did at one point disconnect even while using Edge though, so I'm not sure what that means. Maybe it stayed on for so long one night because we just didn't happen to visit one of the URLs that potentially could have kicked it off? No sure.

Oh, also, my computer in a separate room is on LAN, wired under the house, and it never gets disconnected at all. Neither does my Chromebook on WiFi. The only computer that disconnects is my mom's.

Thanks in advance for any advice about this! I did read that "DoS Attacks" aren't necessarily dangerous and they are pretty common, but when they happen and disconnect the internet every time, shouldn't that be worrisome? Oh, and her Kaspersky scans always come back clean.

Keep in mind that I'm just an amateur; I'm good at snooping around and learning on my own, but really don't know what these "DoS Attacks" things actually are, so you might have to explain things to me if you offer solutions. I read a little bit online and it said that random single person consumers aren't usually victims of such attacks? Not sure what that means, since my mom's computer is getting a lot of them... but I could add then, that there is at least one person that might have had my IP address in the past. Does that mean they could be doing something like this on purpose? They aren't crazy or anything, but I could see them trying to hack my house just out of curiosity to see what I was up to. They're actually a friend and co-worker but they used to (maybe still do) do a lot of hacking. I doubt he would do this (and what does he get out of it anyways?), but just mentioning it in case that is a possibility here.
 

NerdyComputerGuy

Distinguished
Hi,

So, your internet router is randomly restarting? or are specific devices (your moms) for example being cut off the internet but all the devices connected are fine?

I have done some research on the two IP addresses of which you linked in your post, these two IP addresses are linked to a location in Taiwan, China. China is a large DDOS provider and so it is likely that someone is DDoS'ing your network.

DDOS

Distributed Denial of Service Attack

Explanation:

What this means is that someone / multiple peoples or an organization is sending multiple packets to your router (in this case) to overwhelm your network causing your router to restart since it cannot cope with the influx of data.

The first thing I would recommend that you do is go onto your mom's computer and change the DNS settings (she is using Windows 10) right?

A note about Windows 10, it currently has issues with systems because of drivers and such (it's completely destroyed one of my older computers giving it blue screens and eventually frying the motherboard!) Yeah, I won't be using Windows 10 again for a long time... Until they patch everything!

Here: https://www.youtube.com/watch?v=oeyzO09U9no

Check out this video, it will show you how to change the DNS server's on Windows 10, use their ones

8.8.8.8
and
8.8.4.4

(These are Google's Public DNS Servers)

If I have mis-interpreted some of the information you have given me and am babbling on about stuff that doesn't even concern you then please tell me! :)

Hope to hear back soon!

Thanks,
 

LadyA

Honorable
Dec 8, 2012
69
0
10,630
Thanks for your reply!

So, your internet router is randomly restarting? or are specific devices (your moms) for example being cut off the internet but all the devices connected are fine?

None of the other devices on the network go off. It's just my mom's computer that gets disconnected when the "Dos Attack" things happen. (I'm replying right now from my wifi Chromebook, while my mom's computer is currently disconnected. My main PC is on LAN/wired, like my mom's, and it doesn't even get disconnected either.)

If someone's DDoS'ing the network, does that mean they're doing this to my ISP, or to our house/network specifically? Sorry if that's a dumb question, not experienced with this stuff at all. Just curious if we're specifically targeted or if it's random? If it happens because someone got her IP address or something, should we call the ISP and ask them to just reissue a new IP or something?

Would that make any sense that these "attacks" would only knock my mom's computer off the internet, but not the other devices? Could that be a drivers issue or something like you mentioned? Or are those completely unrelated to something like this? I did go through Device Manager when this first started happening and made sure everything was updated but it all already was.

I'm going to change the DNS servers like you suggested and see if that helps! Will report back...