Two-Way IPS Attack

[win465]

Since using the new Trend Micro protection, I have noticed I have been hit 4 times so far. Can someone tell me if I should be considered about these attacks?

 

[OMNI619]

Since using the new Trend Micro protection, I have noticed I have been hit 4 times so far. Can someone tell me if I should be considered about these attacks?

What kind of Asus router your using?

Sent from my SAMSUNG-SM-G920AZ using Tapatalk

 

[win465]

What kind of Asus router your using?

Sent from my SAMSUNG-SM-G920AZ using Tapatalk

Asus 87u

 

[OMNI619]

Asus 87u

What your getting is DDS ATTACK try to setup static ip address on your router and maybe change your DNS

Sent from my SAMSUNG-SM-G920AZ using Tapatalk

 

[win465]

What your getting is DDS ATTACK try to setup static ip address on your router and maybe change your DNS

Sent from my SAMSUNG-SM-G920AZ using Tapatalk

Do you think trend micro blocked the attack?

 

[OMNI619]

Do you think trend micro blocked the attack?

Yes it did but if your hosting something like plex or anything else you always will get hit

Sent from my SAMSUNG-SM-G920AZ using Tapatalk

 

[win465]

Yes it did but if your hosting something like plex or anything else you always will get hit

Sent from my SAMSUNG-SM-G920AZ using Tapatalk

Thank you for the help.

 

[OMNI619]

No problem I was always getting hit but I set up my modem to a static ip addres and changed my DNS on modem and router I was tracing back the ip that ATTACKED my service I found out that my own ISP was attacking me now once a weeks I look through my connections list and issues very rare that I get hit

Sent from my SAMSUNG-SM-G920AZ using Tapatalk

 

[yk101]

I noticed those immediately after switching to FIOS. My old provider had no such issues... that makes me think that maybe it is Verizon trying to manage their G1100 routers?

 

[OMNI619]

Yes I don't trust my ISP I called them and told them to stop the s****t their we wouldn't do that I'm like b's I send them their own ip address and their like that's weird why our server would do that I'm like stop it or I will switch provider once in while I get hit

Sent from my SAMSUNG-SM-G920AZ using Tapatalk

 

[eastavin]

Yes I don't trust my ISP I called them and told them to stop the s****t their we wouldn't do that I'm like b's I send them their own ip address and their like that's weird why our server would do that I'm like stop it or I will switch provider once in while I get hit

Are you looking at the IP address or the MAC address? I went down this road before thinking the MAC was relevant as it was from the ISP and learned from the senior people here that only the IP address will tell you where its coming from. The MAC is a red herring. https://www.snbforums.com/threads/two-way-ips-question-382-2-beta-2.43951/#post-372847

 

[sfx2000]

Since using the new Trend Micro protection, I have noticed I have been hit 4 times so far. Can someone tell me if I should be considered about these attacks?

Maybe a false alarm - Trend Micro is generally good, but integration might have some issues...

 

[Mrwirez]

Since using the new Trend Micro protection, I have noticed I have been hit 4 times so far. Can someone tell me if I should be considered about these attacks?

I've been getting them too. My network is using the AiMesh system, and my main router is in AC86U. My nodes are a converted TM-AC1900 → AC68U and the other is on my AC3100.

I've also been getting the Amazon gift certificate reward redirect (P.I.T.A too).

P.S. Im on Comcast.

 

[st3v3n]

Mrwirez, made me wonder if your TM-AC1900 came from an Amazon vendor as ours? That would be more than irritating; difficult to believe Amazon would do that; Comcast covers a lot of pita territory for redirects and other pains.

 

[OMNI619]

I would suggest to get a Asus latest stock firmware and then install it back whatever firmware you had

Sent from my SAMSUNG-SM-G920AZ using Tapatalk

 

[ChatmanR]

I'm using Frontier FIOS and AdGuard DNS. No issues.

 

[Mrwirez]

Mrwirez, made me wonder if your TM-AC1900 came from an Amazon vendor as ours? That would be more than irritating; difficult to believe Amazon would do that; Comcast covers a lot of pita territory for redirects and other pains.

Not sure, but my (AC-3100) came from a neighbor, and he doesn't remember where he bought it.

Here's where the other two came from.

RT-AC86U = Amazon (router)
TM/RT-AC68U = T-Mo (node)

RT-AC3100 = unknown (node)

I haven't had any in a week or so.

 

[Mrwirez]

I would suggest to get a Asus latest stock firmware and then install it back whatever firmware you had

Sent from my SAMSUNG-SM-G920AZ using Tapatalk

That is the latest ASUS firmware. I'm in AiMesh. The latest FW can be used as normal router, router in mesh, or as a node in mesh setup. It's a one size fits all FW now...

The only FW changes were from TM-AC1900 to RT-AC68U to the current FW. The other change was the AC-3100 came from Merlin to current FW also.

 

[st3v3n]

Thanks for the information, if yours is running that well, I don't have much of a reason to dally. Which version CFE did you use on your conversion?

 

[Mrwirez]

Thanks for the information, if yours is running that well, I don't have much of a reason to dally. Which version CFE did you use on your conversion?

I flashed the 1.0.2.0 CFE first to increase the root file system, with this older ASUS FW:

RT_AC68U_30043763626.trx

1.0.2.0 (US) ASUS => Compiled from ASUS *increase rootfs/mtd3 to 64MB*

Then I flashed the 1.0.2.1 CFE, because the CPU and RAM over-clock wouldn't "stick".

1.0.2.1 (US) => DDR3*unlocked* to 800MHZ

I *believe* the OC did stick after this flash (I never went back to check after final FW - I got lazy...lol). I then upgraded to the latest ASUS firmware for AiMesh.

PS. AiMesh is still a work in progress... The Feb 3 FW update is better.
.