My connection keeps dropping every few minutes. I opened routers logs and saw this:
Per-source UDP Flood Attack Detect Source:8.26.56.26 destination: [my ip adress] Packet Dropped
8.26.56.26 is comodo secureDNS address, can someone explain whats going on? ???
Speculation: Do you have 8.26.56.26 set up as your DNS? In that case if you request a lookup and your router drops the packet then I guess your computer will try again until it gets a response, which it never does, easiest way to check this is to check logging of allowed traffic (in either the router’s logs or with wireshark etc) and see if you have a lot of outgoing dns lookups.
Would someone have a reason to flood you? For example do you have a server of sorts which other people access which someone else would like to ruin?
If the answer to the case above is yes then it might be someone forging traffic to the DNS server which looks like if they come from you, given enough lookups per second this could very likely bring your connection down.
What port is being reported by the logs? Port 53?
Are you using Comodo DNS system wide, in Dragon or IceDragon only, or in your router?
Do the logs also show other events? If so could you please post a screenshot?
Well,now I know that this was not related to comodo, since I changed my dns settings to default, and now I am getting attacks from IP addresses that belong to ISP’s DNS.
There are no ports in the logs. I am seeing stuff like “UdpEchoChargen Attack Detect”, “Per-source UDP Flood Attack Detect”, “Port Scan Attack Detect”, and lots of “Drop packet from WAN”. This continues daily, all the time, but despite all this, my connection now is stable. So I guess I’ll just ignore those alerts.
But still…Couldn’t this be a sign that someone’s intercepting my connection?
I have wireshark, but I don’t really see anything suspicious. Only router’s logs keeps saying that I am being flooded, but it doesn’t bring my connection down anymore.
It’s not a server, just a regular computer… I have no idea why would someone flood me.