False Smurf?! Router firewall going nuts!

Discussion in 'other firewalls' started by Koushirou, Jan 4, 2009.

Thread Status:
Not open for further replies.
  1. Koushirou

    Koushirou Registered Member

    Joined:
    Jan 4, 2009
    Posts:
    2
    Good evening everyone!

    Yesterday, after some time at my parents’ home, I went back to my apartment and browsed the net. After some time I tried accessing a website I recently visited from my parents’ home but I got a network timeout error and got somewhat suspicious. I looked up the logs from our router and found the following:

    ( Note: I changed the destination IP address (123.123.123.0) because I don’t really want someone knowing which site I wanted to browse. 192.168.1.4 is my IP address.

    2009.01.03 18:33:16 **Smurf** 123.123.123.0, 80->> 192.168.1.4, 49920 (from PPPoE Inbound)
    2009.01.03 18:28:04 **Smurf** 123.123.123.0, 80->> 192.168.1.4, 49875 (from PPPoE Inbound)
    2009.01.03 18:27:37 **Smurf** 123.123.123.0, 80->> 192.168.1.4, 49872 (from PPPoE Inbound)
    2009.01.03 18:27:35 **Smurf** 123.123.123.0, 80->> 192.168.1.4, 49870 (from PPPoE Inbound)
    2009.01.03 18:27:33 **Smurf** 123.123.123.0, 80->> 192.168.1.4, 49851 (from PPPoE Inbound)
    2009.01.03 18:27:31 **Smurf** 123.123.123.0, 80->> 192.168.1.4, 49865 (from PPPoE Inbound)
    2009.01.03 18:27:28 **Smurf** 123.123.123.0, 80->> 192.168.1.4, 49849 (from PPPoE Inbound)
    2009.01.03 18:27:22 **Smurf** 123.123.123.0, 80->> 192.168.1.4, 49865 (from PPPoE Inbound)
    2009.01.03 18:27:13 **Smurf** 123.123.123.0, 80->> 192.168.1.4, 49850 (from PPPoE Inbound)
    2009.01.03 18:27:12 **Smurf** 123.123.123.0, 80->> 192.168.1.4, 49851 (from PPPoE Inbound)
    2009.01.03 18:32:56 **Smurf** 192.168.1.4->> 123.123.123.0, Type:8, Code:0 (from LAN Inbound)
    2009.01.03 18:32:51 **Smurf** 192.168.1.4->> 123.123.123.0, Type:8, Code:0 (from LAN Inbound)
    2009.01.03 18:32:46 **Smurf** 192.168.1.4->> 123.123.123.0, Type:8, Code:0 (from LAN Inbound)

    I can guarantee the IP 123.123.123.0 is the website I wanted to visit and every time I try accessing the site I get these “Smurf” attacks or whatever. Why does my router protect me from visiting a normal website?

    The router is a 3-com Office Connect 01 V1.10-168 and the settings are somewhat the factory defaults I think. We have around five to six PCs accessing the net over this router so I think the website trying to access ports like ~49850 is just a side effect of the NAT’s masquerading.
     
  2. AKAJohnDoe

    AKAJohnDoe Registered Member

    Joined:
    Sep 26, 2007
    Posts:
    989
    Location:
    127.0.0.1
    A Smurf is essentially an attempt at a DOS attack via ICMP Ping, right? Is your router configured to not respond to Ping?
     
  3. Koushirou

    Koushirou Registered Member

    Joined:
    Jan 4, 2009
    Posts:
    2
    Yes it is. "Discard ping from the Internet / Block ICMP Ping" is enabled.
    I just tried disabling it but I still get the "Smurf" while trying to access my website. So no change at all.
     
Loading...
Thread Status:
Not open for further replies.