False Smurf?! Router firewall going nuts!

Discussion in 'other firewalls' started by Koushirou, Jan 4, 2009.

Thread Status:
Not open for further replies.
  1. Koushirou

    Koushirou Registered Member

    Joined:
    Jan 4, 2009
    Posts:
    2
    Good evening everyone!

    Yesterday, after some time at my parents’ home, I went back to my apartment and browsed the net. After some time I tried accessing a website I recently visited from my parents’ home but I got a network timeout error and got somewhat suspicious. I looked up the logs from our router and found the following:

    ( Note: I changed the destination IP address (123.123.123.0) because I don’t really want someone knowing which site I wanted to browse. 192.168.1.4 is my IP address.

    2009.01.03 18:33:16 **Smurf** 123.123.123.0, 80->> 192.168.1.4, 49920 (from PPPoE Inbound)
    2009.01.03 18:28:04 **Smurf** 123.123.123.0, 80->> 192.168.1.4, 49875 (from PPPoE Inbound)
    2009.01.03 18:27:37 **Smurf** 123.123.123.0, 80->> 192.168.1.4, 49872 (from PPPoE Inbound)
    2009.01.03 18:27:35 **Smurf** 123.123.123.0, 80->> 192.168.1.4, 49870 (from PPPoE Inbound)
    2009.01.03 18:27:33 **Smurf** 123.123.123.0, 80->> 192.168.1.4, 49851 (from PPPoE Inbound)
    2009.01.03 18:27:31 **Smurf** 123.123.123.0, 80->> 192.168.1.4, 49865 (from PPPoE Inbound)
    2009.01.03 18:27:28 **Smurf** 123.123.123.0, 80->> 192.168.1.4, 49849 (from PPPoE Inbound)
    2009.01.03 18:27:22 **Smurf** 123.123.123.0, 80->> 192.168.1.4, 49865 (from PPPoE Inbound)
    2009.01.03 18:27:13 **Smurf** 123.123.123.0, 80->> 192.168.1.4, 49850 (from PPPoE Inbound)
    2009.01.03 18:27:12 **Smurf** 123.123.123.0, 80->> 192.168.1.4, 49851 (from PPPoE Inbound)
    2009.01.03 18:32:56 **Smurf** 192.168.1.4->> 123.123.123.0, Type:8, Code:0 (from LAN Inbound)
    2009.01.03 18:32:51 **Smurf** 192.168.1.4->> 123.123.123.0, Type:8, Code:0 (from LAN Inbound)
    2009.01.03 18:32:46 **Smurf** 192.168.1.4->> 123.123.123.0, Type:8, Code:0 (from LAN Inbound)

    I can guarantee the IP 123.123.123.0 is the website I wanted to visit and every time I try accessing the site I get these “Smurf” attacks or whatever. Why does my router protect me from visiting a normal website?

    The router is a 3-com Office Connect 01 V1.10-168 and the settings are somewhat the factory defaults I think. We have around five to six PCs accessing the net over this router so I think the website trying to access ports like ~49850 is just a side effect of the NAT’s masquerading.
     
  2. AKAJohnDoe

    AKAJohnDoe Registered Member

    Joined:
    Sep 26, 2007
    Posts:
    989
    Location:
    127.0.0.1
    A Smurf is essentially an attempt at a DOS attack via ICMP Ping, right? Is your router configured to not respond to Ping?
     
  3. Koushirou

    Koushirou Registered Member

    Joined:
    Jan 4, 2009
    Posts:
    2
    Yes it is. "Discard ping from the Internet / Block ICMP Ping" is enabled.
    I just tried disabling it but I still get the "Smurf" while trying to access my website. So no change at all.
     
Loading...
Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.