Wireless Router keeps going out of service -- probed on various ports

So, my D-Link router keeps failing. It says its access to the internet
is fine, but it won't give me anything until I power cycle it. I worked
out the password eventually (there's a little story behind my three
failed login attempts) and watched the log.
I think Zombies are trying to attack me. Could this be causing my
problem?
Ion
----
WAN Type: Dynamic IP Address (2.60 build 2)
Display time: Tuesday, July 19, 2005 11:48:15

* DOD:triggered internally
Tuesday, July 19, 2005 11:24:00 DHCP:discover()
Tuesday, July 19, 2005 11:24:00 DHCP:offer(<ip>)
Tuesday, July 19, 2005 11:24:00 DHCP:request(<ip>)
Tuesday, July 19, 2005 11:24:01 DHCP:ack(DOL=177709,T1=88854,T2=155496)
Tuesday, July 19, 2005 11:25:28 <me> login failed
Tuesday, July 19, 2005 11:25:30 <me> login failed
Tuesday, July 19, 2005 11:25:35 <me> login failed
Tuesday, July 19, 2005 11:26:48 Unrecognized access from
61.141.184.193:2834 to TCP port 25
Tuesday, July 19, 2005 11:26:54 Unrecognized access from
61.141.184.193:2834 to TCP port 25
Tuesday, July 19, 2005 11:27:49 <me> login successful
Tuesday, July 19, 2005 11:29:16 Unrecognized access from
70.85.177.186:44441 to UDP port 1026
Tuesday, July 19, 2005 11:31:24 Unrecognized access from
216.234.161.168:55314 to TCP port 2834
Tuesday, July 19, 2005 11:31:25 Unrecognized access from
216.234.161.168:55315 to TCP port 2834
Tuesday, July 19, 2005 11:34:21 Unrecognized access from
70.85.177.74:36368 to UDP port 1026
Tuesday, July 19, 2005 11:34:21 Unrecognized access from
70.85.177.74:36368 to UDP port 1027
Tuesday, July 19, 2005 11:35:52 Unrecognized access from
222.136.188.49:50702 to UDP port 1026
Tuesday, July 19, 2005 11:35:52 Unrecognized access from
222.136.188.49:50702 to UDP port 1027
Tuesday, July 19, 2005 11:35:53 Unrecognized access from
218.66.104.140:60715 to UDP port 1026
Tuesday, July 19, 2005 11:35:53 Unrecognized access from
218.66.104.140:60715 to UDP port 1027
Tuesday, July 19, 2005 11:40:34 Unrecognized access from
220.168.156.71:34537 to UDP port 1026
Tuesday, July 19, 2005 11:40:46 Unrecognized access from
61.235.154.91:33414 to UDP port 1027
Tuesday, July 19, 2005 11:43:03 Unrecognized access from
24.128.199.131:1026 to UDP port 38293
Tuesday, July 19, 2005 11:43:03 Unrecognized access from
24.128.199.131:1026 to UDP port 38293
Tuesday, July 19, 2005 11:43:03 Unrecognized access from
24.128.199.131:1026 to UDP port 38293
Tuesday, July 19, 2005 11:43:03 Unrecognized access from
24.128.199.131:1026 to UDP port 38293
Tuesday, July 19, 2005 11:43:03 Unrecognized access from
24.128.199.131:1026 to UDP port 38293
Tuesday, July 19, 2005 11:43:03 Unrecognized access from
24.128.199.131:1026 to UDP port 38293
Tuesday, July 19, 2005 11:47:51 Unrecognized access from
66.160.191.166:44649 to UDP port 1026

ion wrote:

> I think Zombies are trying to attack me. Could this be causing my
> problem?
> Ion
> ----

NO

The router should be able to deal with thousands of unsolicited inbound
traffic from scans and attacks.

Did you try a hard reset of the router?

Have you tried re-flashing the router with the current version of the
firmware the router is using or a later version?

Maybe, the router is going defective.

Maybe, the connection to the ISP is bad.

Duane :)

Duane,
Thanks. I don't think it's the connection to the ISP, as I can't
ping the router itself when I get my error. I'm suspicious that it's
neighbors using my connection, as it's not password protected.
Ion

ion said the following on 7/19/2005 8:51 AM:

> I think Zombies are trying to attack me. Could this be causing my
> problem?
> Ion

Your log listing shows connection attempts every few minutes. This is
not an attack, for a home connection this is normal maybe even slow.

Duane is right, your router can handle this and gobs more.

Lance
*****

On Tue, 19 Jul 2005 18:21:12 GMT, Duane Arnold <Notme@notme.com>
wrote:

>ion wrote:
>
>> I think Zombies are trying to attack me. Could this be causing my
>> problem?
>> Ion

Hmmm... The original message didn't show up on Newsguy.com (yet).

>NO
>The router should be able to deal with thousands of unsolicited inbound
>traffic from scans and attacks.

Tell that to my Linksys BEFW11S4v4 router. Two attacks (forgot which
ones) will cause it to go comatose. Try:
| http://www.pcflank.com/exploits.htm
Most of the other routers I've tested survive just fine. The ones
that failed are really old or have ancient firmware. Anyway, it's
worth testing.

If that doesn't work, here's 10 ways to kill a zombie:
| http://www.brockpress.com/media/pape...e-781311.shtml


--
Jeff Liebermann jeffl@comix.santa-cruz.ca.us
150 Felker St #D http://www.LearnByDestroying.com
Santa Cruz CA 95060 AE6KS 831-336-2558

Jeff Liebermann wrote:

> On Tue, 19 Jul 2005 18:21:12 GMT, Duane Arnold <Notme@notme.com>
> wrote:
>
>>ion wrote:
>>
>>> I think Zombies are trying to attack me. Could this be causing my
>>> problem?
>>> Ion
>
> Hmmm... The original message didn't show up on Newsguy.com (yet).
>
>>NO
>>The router should be able to deal with thousands of unsolicited inbound
>>traffic from scans and attacks.
>
> Tell that to my Linksys BEFW11S4v4 router. Two attacks (forgot which
> ones) will cause it to go comatose. Try:
> | http://www.pcflank.com/exploits.htm

I tried it and the Watchguard Firebox III SOHO 6 never even flinched.
I also ran that against my 11S4 v1 router when it was the border device. As
I recall, it didn't have any problems either.

> Most of the other routers I've tested survive just fine. The ones
> that failed are really old or have ancient firmware. Anyway, it's
> worth testing.

Out of the I would say millions of scans and attacks that came at the 11S4
when it was the border device only two probes came past it at SQL server,
which prompted me to go get the WG.
>
> If that doesn't work, here's 10 ways to kill a zombie:
> |
http://www.brockpress.com/media/pape...e-781311.shtml
>
;-)

Duane :)

ion wrote:

> Duane,
> Thanks. I don't think it's the connection to the ISP, as I can't
> ping the router itself when I get my error. I'm suspicious that it's
> neighbors using my connection, as it's not password protected.
> Ion

I had a problem with the ISP several months ago. And several months prior to
that I had the same problems. They perodically ran a network maintenance,
test or whatever and it would hose my connection particular connecting the
NG servers. The first time after I didn't pay the bill in time it was
cutoff. I paid the bill and got a new IP assigned from the ISP and the
problems away. I failed to pay bill again in time and got a new IP and the
problems cameback. I called the ISP and at first they refused to give me a
new IP that I demanded. But I went off on them and hammered them and got
the new IP and no more problems.

It's just a little rant. ;-)

You may want to look into disabling DHCP on the router and using static
IP(s) with possibly changing the Subnet Mask on the router away from
255.255.255.0.

http://compnetworking.about.com/od/w...fisecurity.htm

Duane :)

Well, maybe not me in particular. Thanks for your help, everyone.