He doesnt have any kids. I suspect a trojan or malware. I notice that his CPE LAN port is receiving a lot more traffic outbound than his WAN port is transmitting. I'm guessing the packets are hitting the CPE (in router mode) from his inside network and have no where to go?
On Fri, Oct 3, 2014 at 10:45 PM, Terri Kelley <net...@farm-market.net> wrote: > Have had some similar either file sharing or virus. Showed them a graph of > their use. Can't really argue with that. Sometimes turns out to be one of > the kids doing something. > > Terri Kelley > Network Engineer > Farm to Market Broadband > > -----Original Message----- > From: RickG <rgunder...@gmail.com> > To: Mikrotik discussions <mikrotik@mail.butchevans.com> > Sent: Fri, 03 Oct 2014 9:39 PM > Subject: [Mikrotik] DoS attack: Smurf attack from customer's CPE address > > I've got a customer complaining about intermittent speed issues and short > cut off's on his connection. My MT box shows he has a high connection rate. > I also noticed in the logs on my Netgear router that his IP shows with the > following message: [DoS attack: Smurf] attack packets in last 20 sec from > ip [10.10.45.103], Friday, Oct 03,2014 16:05:51 > I assume he has a virus but he says he has run virus scans on all his > computers and devices. I'm not sure what to tell him next. Any ideas? > -------------- next part -------------- > An HTML attachment was scrubbed... > URL: < > http://mail.butchevans.com/pipermail/mikrotik/attachments/20141003/74df16e8/attachment.html > > > _______________________________________________ > Mikrotik mailing list > Mikrotik@mail.butchevans.com > http://mail.butchevans.com/mailman/listinfo/mikrotik > > Visit http://blog.butchevans.com/ for tutorials related to Mikrotik > RouterOS > -------------- next part -------------- > An HTML attachment was scrubbed... > URL: < > http://mail.butchevans.com/pipermail/mikrotik/attachments/20141003/90cef9da/attachment.html > > > _______________________________________________ > Mikrotik mailing list > Mikrotik@mail.butchevans.com > http://mail.butchevans.com/mailman/listinfo/mikrotik > > Visit http://blog.butchevans.com/ for tutorials related to Mikrotik > RouterOS > -- -RickG KyWiFi -------------- next part -------------- An HTML attachment was scrubbed... URL: <http://mail.butchevans.com/pipermail/mikrotik/attachments/20141003/59fa1172/attachment.html> _______________________________________________ Mikrotik mailing list Mikrotik@mail.butchevans.com http://mail.butchevans.com/mailman/listinfo/mikrotik Visit http://blog.butchevans.com/ for tutorials related to Mikrotik RouterOS
