DoS Advice

[Paul Smith]

Good Afternoon All,

After a bit of advice. When gaming on the Xbox this afternoon my daughter joined a chat party and another user was able to get her details and then proceeded to boot her from the online game via a DoS attack.

Is there anyway of me stopping this? I am running a Netgear R7800 on Voxels latest software.

Here is a quick cut of my current logs:

[DHCP IP: 192.168.0.11] to MAC address f0:6e:0b:22:4c:d3, Sunday, May 03, 2020 16:47:56
[DoS Attack: Teardrop] from source: 69.19.14.13, Sunday, May 03, 2020 16:46:41
[DoS Attack: Jolt2] from source: 69.19.14.13, Sunday, May 03, 2020 16:46:41
[DoS Attack: UDP Port Scan] from source: 94.62.61.250, port 389, Sunday, May 03, 2020 16:46:36
[DoS Attack: Jolt2] from source: 103.79.182.217, Sunday, May 03, 2020 16:46:29
[DoS Attack: Jolt2] from source: 124.158.161.178, Sunday, May 03, 2020 16:46:22
[DoS Attack: Ascend Kill] from source: 94.42.81.10, port 53, Sunday, May 03, 2020 16:46:14
[DoS Attack: Jolt2] from source: 212.126.114.142, Sunday, May 03, 2020 16:46:12
[DoS Attack: Jolt2] from source: 91.143.58.10, Sunday, May 03, 2020 16:46:00

Not really sure what to do?

Many thanks in advance

Paul

 

[coxhaus]

Is your internet pipe saturating? If not then it is a router issue or bad game code would be my guess.

 

[ColinTaylor]

Report the other user to Microsoft and they will ban their account.

 

[Paul Smith]

Report the other user to Microsoft and they will ban their account.

Yes done this thank you

 

[Paul Smith]

Is your internet pipe saturating? If not then it is a router issue or bad game code would be my guess.

I think the perpetrator was able to get my IP when she added herself to the party chat within Xbox. I have told her to avoid this from now on unless she can trust the people in the chat. My assumption is that the in game chat will not allow details to be leaked.

Less setting up a permanent VPN (I do have NordVPN) via Kamos's add on I will try and get the Public IP from Virgin to change. It keeps giving me the same IP at the moment

 

[ColinTaylor]

Less setting up a permanent VPN (I do have NordVPN) via Kamos's add on I will try and get the Public IP from Virgin to change. It keeps giving me the same IP at the moment

If that's Virgin Media in the UK then their IPs are very "sticky". If you turn off the hub and leave it overnight you might get a different IP address, but probably not. Their DHCP leases are normally 7 days. Does your router have an option to clone (or otherwise change) the MAC address of its WAN interface? If you can do this you will immediately get a different IP address.

 

[Paul Smith]

If that's Virgin Media in the UK then their IPs are very "sticky". If you turn off the hub and leave it overnight you might get a different IP address, but probably not. Their DHCP leases are normally 7 days. Does your router have an option to clone (or otherwise change) the MAC address of its WAN interface? If you can do this you will immediately get a different IP address.

I can't see anything like that in the settings. I'll contact Virgin and see if they will do it

 

[coxhaus]

If they maxed out your internet speed then everything should have gotten slow. Is it possible they could have attacked through the game code chat? If it is through the game, IP will probably not matter.

 

[ColinTaylor]

If they maxed out your internet speed then everything should have gotten slow. Is it possible they could have attacked through the game code chat? If it is through the game, IP will probably not matter.

This kind of DoS attack is common on the XBox.

 

[Paul Smith]

If they maxed out your internet speed then everything should have gotten slow. Is it possible they could have attacked through the game code chat? If it is through the game, IP will probably not matter.

Sorry I probably wasn't clear. I now know when you sent up an Xbox Party chat, it is done separate to the game and you can gain the IP addresses of all participants. My daughter now knows only to party chat with trusted people and stick to the game chat for everything else.

I have put a request into Virgin to change my public IP in the meantime as setting up the VPN will be a nause (and I am sure that will effect the gaming performance too)

 

[HELLO_wORLD]

You can use my firewall-blocklist script and put those IPs in the custom blocklist and they will be totally blocked (INBOUND and OUTBOUND) from your entire LAN

Good Afternoon All,

After a bit of advice. When gaming on the Xbox this afternoon my daughter joined a chat party and another user was able to get her details and then proceeded to boot her from the online game via a DoS attack.

Is there anyway of me stopping this? I am running a Netgear R7800 on Voxels latest software.

Here is a quick cut of my current logs:

[DHCP IP: 192.168.0.11] to MAC address f0:6e:0b:22:4c:d3, Sunday, May 03, 2020 16:47:56
[DoS Attack: Teardrop] from source: 69.19.14.13, Sunday, May 03, 2020 16:46:41
[DoS Attack: Jolt2] from source: 69.19.14.13, Sunday, May 03, 2020 16:46:41
[DoS Attack: UDP Port Scan] from source: 94.62.61.250, port 389, Sunday, May 03, 2020 16:46:36
[DoS Attack: Jolt2] from source: 103.79.182.217, Sunday, May 03, 2020 16:46:29
[DoS Attack: Jolt2] from source: 124.158.161.178, Sunday, May 03, 2020 16:46:22
[DoS Attack: Ascend Kill] from source: 94.42.81.10, port 53, Sunday, May 03, 2020 16:46:14
[DoS Attack: Jolt2] from source: 212.126.114.142, Sunday, May 03, 2020 16:46:12
[DoS Attack: Jolt2] from source: 91.143.58.10, Sunday, May 03, 2020 16:46:00

Not really sure what to do?

Many thanks in advance

Paul

 

[coxhaus]

This kind of DoS attack is common on the XBox.

I don't have an Xbox. When my kids were young we had Atari.

So how does the DDOS attack work. Can you explain it. Are they attacking the game code or the internet pipe?

 

[ColinTaylor]

So how does the DDOS attack work. Can you explain it. Are they attacking the game code or the internet pipe?

Typically it's just a simple flood attack. The individual "rents" a botnet and floods the target address with traffic. That increases the latency between the client and the game server sufficiently for the game server to kick the user out of the game.

 

[Paul Smith]

Typically it's just a simple flood attack. The individual "rents" a botnet and floods the target address with traffic. That increases the latency between the client and the game server sufficiently for the game server to kick the user out of the game.

Or in our case it actually dropped the whole internet connection

 

[coxhaus]

Typically it's just a simple flood attack. The individual "rents" a botnet and floods the target address with traffic. That increases the latency between the client and the game server sufficiently for the game server to kick the user out of the game.

OK typical DDOS attack. Years ago you could do stuff in Steam so the game knew your IP address.

You might get your ISP involved since you have the exact times. I assume you time sync to NTP time.