Computer Hope
Internet & Networking => Networking => Topic started by: Bluewave on February 25, 2015, 04:07:08 AM
-
I currently use chrome as my internet browser, however once in a while whenever I load a webpage I am unable to connect and chrome tells me to check my connection.
While the webpage is attempting to connect/load in chrome, the bottom left of the window says "resolving host" rather than "connecting/waiting for [website]...".
I have checked the logs from the router and it appears that at the exact time my browser loses connection, a "LAN-side UDP Flood" appears coming from my local ip address/device. The count ranges from 1-10.
Can someone advise what the problem is?
Thanks in advance
-
"LAN-side UDP Flood" is not an accident nor an error in the hardware. It is almost always a deliberate attempt to ruin your Internet experience.
A UDP flood attack is a denial-of-service (DoS) attack using the User Datagram Protocol (UDP), a sessionless/connectionless computer networking protocol. Using UDP for denial-of-service attacks is not as straightforward as with the Transmission Control Protocol (TCP).
Here is a link that helps one to understand how they do it.
http://www.juniper.net/techpubs/software/junos-security/junos-security96/junos-security-swconfig-security/id-60351.html
Sorry I do not have a easy solution to the problem. If it only happens on a few web sites, you need to contact the sire owners and tell them.
-
"LAN-side UDP Flood" is not an accident nor an error in the hardware. It is almost always a deliberate attempt to ruin your Internet experience.
I doubt it's the websites that's causing it, since at those times I mainly browse through common sites (hotmail, news, youtube, etc.) and assume they're safe.
If there is indeed an attacker, does that indicate that my computer has been comprimised/infected or is it a network issue?
My computer has no signs of infection and my antivirus is always on (I have adblock on and disabled java and to some extent flash). I also monitor my bandwidth usage and don't see anything suspicious.
On a second note, I have a lot of logs that fill the page including: "TCP- or UDP-based Port Scan", "SYN Flood", "IP packet w/MC or BC SRC addr", "Illegal TCP header".
The targets and sources include ip adresses within my home network (other devices) that begin with 192.168... and the others I don't recognise and assume are from outside sources. It also shows my ip address being a target of "IP packet w/MC or BC SRC addr".
I have no idea what this means, could someone help?
-
No, the web site does not swat to ruin hour pleasure. Rather, the competition is trying to block that web site for some wrong reason. It does not mean the source is within your stem. (But that could be.)
Personally I have had the experience of being blocked from some sites for no good reason. I suspect that it was an attempt to make be pay for something I did not want or need. The Internet is very poorly regulated and criminals are doing all kinds of things. The DOS, Denial Of Service, is a common practice world wide.
There are many tutorial about this subject. Most of these will indicate the DOS is against web sites, not individuals.
This link may help explain it better than I could. It shows the source of the problem is most from a remote place, not your own PC.
https://www.owasp.org/index.php/Denial_of_Service
It gives examples of how a remoter server is corrupted or sabotaged to make things hard for the administrator.
But if you suspect your PC has been infected by a virus, you need to go to the virus removal section of Computer Hope.
http://www.computerhope.com/forum/index.php/board,7.0.html
Now if your PC is under the control of a remote source, you have a Zombie PC.
Here is an explanation.
http://en.wikipedia.org/wiki/Zombie_%28computer_science%29
Zombies have been used extensively to send e-mail spam; as of 2005, an estimated 50–80% of all spam worldwide was sent by zombie computers.[1] This allows spammers to avoid detection and presumably reduces their bandwidth costs, since the owners of zombies pay for their own bandwidth. This spam also greatly furthers the spread of Trojan horses, as Trojans are not self-replicating. They rely on the movement of e-mails or spam to grow, whereas worms can spread by other means.[2]
But I doubt that is what you have. :)
-
Alright thanks for the insight. Though do you know what those logs I've mentioned before mean, are they normal/common logs that can be ignored or do they indicate something wrong, like DoS or worse.