This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Do these Router log files and Wireshark capture files denote flood attacks as shown by the Router?

0

My router picks up Flood attacks every time I switch it on. So, I tried capturing packets on wireshark by connecting the WAN cable to the PC directly. I've attached the Router log files generated in a single session for a period of time and Wireshark's Captured packet files at another point of time, using Win10PCap as WinPCap 4.1.3 didn't work for some reason on Wireshark 2.2.1(64-bit)on Windows 10 x64. Please help me analyze if there are truly any DOS or DDOS attacks occurring on my network as the router log suggests. Router Log 1- https://drive.google.com/open?id=0B4PGygpcKwfkZXB0TkpjZWdoSW8 Router Log 2- https://drive.google.com/open?id=0B4PGygpcKwfkV3NuMEdrV1UzOGs Router Log 3- https://drive.google.com/open?id=0B4PGygpcKwfkVFZENkI5T1d0OUk Router Log 4- https://drive.google.com/open?id=0B4PGygpcKwfkZkJlVUE4clRrV28 Router Log 5- https://drive.google.com/open?id=0B4PGygpcKwfkWWpRMm5pYjN5Rnc Router Log 6- https://drive.google.com/open?id=0B4PGygpcKwfkSjB4Um9mcERTdFk Router Log 7- https://drive.google.com/open?id=0B4PGygpcKwfkcmpDa0lYWExvTlk Router Log 8- https://drive.google.com/open?id=0B4PGygpcKwfkOF9RWjBIZ1FSMHM

Wireshark1st pcapng- https://drive.google.com/open?id=0B4PGygpcKwfkMnBlZDFLb1B6Sjg Wireshark2nd pcap- https://drive.google.com/open?id=0B4PGygpcKwfkUHQ1d0lkUW9LWjg Wireshark3rd pcap- https://drive.google.com/open?id=0B4PGygpcKwfkTkdCN2xkWDg2WTQ Wireshark4th pcapng- https://drive.google.com/open?id=0B4PGygpcKwfkMUg0YUktZXZIWDA


Please HELP in finding if the router log files are true! The IP 172.16.23.65 on Router log denotes the gateway of my ISP which is shown to be the place where most flood attacks seem to come from according to the router!

asked 26 Oct '16, 06:33

Aritra_B's gravatar image

Aritra_B
5113
accept rate: 0%

What's the model of your router?

(26 Oct '16, 06:44) grahamb ♦

It's DLink DIR-600L,a tad bit old of a model but the firmware is upgraded as per Dlink's provided upgrade. You'll find most of the information in the Router Log files which have a preview so you can check without downloading them.

(26 Oct '16, 06:49) Aritra_B

Oh, I forgot to mention that 172.16.23.67 is also an IP belonging to my ISP confirmed by the representative when I called them up to notify of these logs from the router. They did ask me to keep monitoring for another 24 Hours and then get back to them, so I took up this pain.

(26 Oct '16, 06:51) Aritra_B