DDOS/DOS attack Peplink Soho solution?

Product Discussion
21

I was hoping that you had solved your issues, but apparently not as I chanced across another reddit post 2 days ago.

Experts here have recommended using PingPlotter to find out if you have DDOS or other interruptions in your ISP’s internet service. Ping is a tool which network knowledgeable people use to determine the latency of network traffic or if packets are dropped. There are also less scientific methods to perhaps find out if you are experiencing internet service interruptions. For example, when you have a problem on your PC, what happens to a streaming show on your TV? Or other devices which you may be using when the issue occurs? If it isn’t occurring on other devices, then this may not be a WAN issue from a DDOS attack or other ISP problem.

To get to the bottom of this, will you please provide the following information and steps:

  1. What type of Internet service do you have and what are the provisioned upload/download speeds; cable, fiber, DSL, Starlink or Fixed Wireless (WiFi to Verizon or T-Mobile are examples in the US)? What is the make and model number of your modem and router? If you have cable for instance, hopefully it is a DOCSIS 3.1 modem (some older DOCSIS 3.0 modems with Intel Puma chips experience delays for example).

  2. How is your network wired, presumably with Ethernet cables, but perhaps something like MoCA? Do you have any switches and if so, what is the topology? How many Wi-Fi access points or extenders do you have beyond your main router if any? In particular, how is your PC connected and what operating system is it running (Windows 10 or 11?)?

  3. Which devices are experiencing delays or interruptions, and are they hard wired or WiFi (if you are still using WiFi)? Do they experience issues at the same time, or are some working fine to access the internet while others are experiencing issues?

  4. Assuming you have Windows on your PC, will you please bring up a CMD window and run “ping google.com -n 1000 -l 1024” (-n is the number of iterations, -l is the packet length). You will get statistics that show your Minimum latency, Maximum Latency and Average Latency, along with the number of Lost packets and percentage of Lost packets. You want zero Lost packets. If you have lost packets, then we need to track down why it is happening which usually is a WAN issue. You can run this while you are gaming or having an online meeting. However, please do not use a VPN when you are doing this (we can’t tell whether latency issues are with the VPN or the ISP, plus VPN’s can retransmit packets). High latency issues are also a problem, but can be caused by overloading your upload or download beyond the limits of your provisioned service (“bufferbloat”). Let’s see what you report.

PingPlotter remains the tool of choice for figuring out issues. It will report dropped packets, the latency of WAN traffic, and do this 24 hours a day so you can capture sporadic problems. Plus people use it as proof to their ISP that there are issues that the ISP needs to address. I believe you have tried using it. So do you have any dropped packets? Those are shown in red on the bottom timeline graph.

  1. Will you please explain further what these “drops” are that your ISP has verified? ISP’s normally have the capability to communicate with their modems to determine if there are signal level issues or dropouts. Is this what is happening? If so, it is the ISP’s issue (unless you have flakey power to the modem, or you are sharing a power outlet on the wall with your neighbor and he is somehow playing with your power cables). The ISP may also have the ability to communicate with their router (you may have a combined modem / router). If they do have the capability, is the router experiencing the drops while the modem doesn’t experience any drops or signal level issues, something they should be able to tell you?

Additional Comments:

  • In your recent reddit post, you said “I am looking for a device with good/enhanced security, specifically guarding against DOS attacks and also allows me to disable wireless and use LAN only.” All a router can do is ignore DDOS attack packets to ports which are not open on the router, or in some cases, let you know that a SYN attack is going on. It can’t stop the DDOS attack packets from being sent to an IP address and arriving to your router when you have that IP address, thus using up 99% of your download bandwidth. Also, every WiFi router that I am aware of, including those from ISP’s, allows you to turn of WiFi.
    https://www.reddit.com/r/HomeNetworking/comments/11gegoh/secure_router_recommendations_isp_recognizes_dos/
    https://www.reddit.com/r/Peplink/comments/10cirbd/ddosdos_attack_please_advise/

  • You commented that you believe the Surf Soho allows you the capability to change your router IP address. While there is a configuration option to change a static IP address, static IP’s are generally only available for business accounts, at least in the US. And even if you have a static IP address from your ISP, they assign it, not you. More than likely you have a dynamically assigned IP address (“DHCP”) from your ISP. That IP address tends to be sticky. However, turning your modem and router off for 30 minutes to 24 hours may result in getting a new IP address. Or you may be able to call your ISP and see if they will change it.

  • FYI, it is possible for there to be electromagnetic interference from your equipment or from your neighbor which can affect cable signals and equipment. Unusual but possible (did your neighbor purchased a giant magnet that he rubs against the wall…) So at some point you may want to try separating your equipment and cables from each other, and if they are on the wall next to the neighbor, away from that wall, perhaps even using a long extension power cord from another part of the house rather than power from the wall you share with your neighbor.
    SG :: Short Stories and Fixes
    SG :: Router speed drop solved

22

I strongly suggest you have over-thought what is potentially going on and some of your fears are bordering on conspiracy theory.

What cable medium is your internet connection coming into your house over? xDSL? Cable? Fibre?

If you are using WiFi on your home network it may be poorly configured and your neighbour has used “off the shelf” tools to exploit it and gain access.

As has been mentioned, if there is anywhere that your neighbour can access cabling between your modem and the street he may be interfering with it physically or generating enough RF interferance in close proximity to upset your modem sync and cause a disconnect.

He can’t be DOS’ing you at the packet level unless you have a publicly accessible IP which he knows. Does your ISP use CG NAT? What does your WAN IP start with?

Replacing any of your equipment to anything else including Peplink will make zero difference. You need to get an IT professional in to inspect your system and advise you. They will be able to do a few simple things to determine the source of the issue.

Reset your modem & router back to defaults, disable WiFi. Leave it disabled and use ethernet only for a few weeks and see if the problem still occurs. If not setup WiFi again SECURELY.

If you’re using a broadband connection method that can be subject to interference, your modem will likely have a way to display signal stats. You should see if there’s a high noise floor or low signal. Your modem may detail in the logs reason for disconnection, e.g. Loss of sync, remote end termination, etc.

23

Ok i stumbled on this thread because the title piqued my interest as i opened the forums.

A little background about me. I am a licensed communications contractor that does everything from LAN cabling, fiber optics, RF, microwave radios, Wifi, etc as well as a peplink dealer and experienced network tech when it comes to security, firewalls, etc

now, what you have going on here is NOT i repeat NOT a DDOS/DOS attack and getting a peplink router will not help you. why? because the message youre getting says LAN disconnected. in the OSI model this is the physical layer of the network meaning the network card in your computer, the ethernet cable, the switch router or gateway it connects to etc. in other words your ethernet cable is being physically disconnected either at the computer or the other end. could be many reasons for this. bad cable causing intermittent connection, bad network card in computer, bad port on ISP equipment, or (and this would be rare), your neighbor has found your LAN cable in the wall, cut it, terminated 2 RJ45 modular plugs onto each end and put a coupler in between. this would allow him to physical unplug and plug your cable causing you to get the message youre getting. but i highly doubt this is the case

responses about wifi or anything else other than dealing with the physical cabling in your house are misleading and unrelated.

so as has been asked before, please tell us in detail how the cable from your computer gets to your internet/ISP equipment. Do you have a jack in the wall that is shared with your neighbor? does the cable run on the carpet or hardwood floor where it is likely to get crushed with foot traffic? or? please give us a detailed description of the cabling in your house

as others have said, please take a deep breath and step back from the conspiracies about your neighbor. I highly doubt this issue involves them… you need to do some physical troubleshooting of the cabling in your house to determine where the issue is