SYN Attack to Fingbox?

Dominick · May 2020

It is almost exactly 7 days ago to this second that I've had a SYN attack on my network. Last Friday around this time my WiFi router stopped responding. It has now done the same thing and come back up again. In each instance the attack originated from 88.99.37.190 which is showing as service.fingbox coming from Germany. Is this a legitimate host? If so, why is this occuring?

ProTecK · May 2020

What router are you using and where are you getting this information from?

Was it from router logs?

Dominick · June 2020

Yes, router logs. ASUS RT-AC88U

Interestingly enough my Fingbox just sent me last month’s report for Internet performance and it shows 2 outages that were 1 minute each at the times I described for the past two Fridays.

There was a flood of traffic to my router from that IP to the point the router became unresponsive until the flood stopped.

Dominick · June 2020

Update: This has happened at the exact same time again today. I can also see that fing.com main page has an error on it. Something is definitely happening to the Fing server at 11AM EST each Friday. Error message on Fing site below:

Image: https://us.v-cdn.net/6031733/uploads/editor/65/k6i2hvccz8pb.png

Robin · June 2020

Hi @Dominick
It seems weird and I will investigate this. I will need further information in order to isolate the issue. I have sent you a private message. Please reply to my message directly. Thanks

Dominick · June 2020

Robin said:

Hi @Dominick
It seems weird and I will investigate this. I will need further information in order to isolate the issue. I have sent you a private message. Please reply to my message directly. Thanks

Thanks Robin. I'll keep an eye out for your message.

RBl · November 2020

Robin said:

Hi @Dominick
It seems weird and I will investigate this. I will need further information in order to isolate the issue. I have sent you a private message. Please reply to my message directly. Thanks

Has the problem been identified, as I have the exact same issue:
*** detected stationary source TCP SYN Flood attack and dropped 2664 packets. (Attack-Source=88.99.37.190) Nov 24, 2020 16:59:21

Dominick · November 2020

https://community.fing.com/discussion/comment/23429#Comment_23429

No, I ultimately unplugged my Fing permanently because it continues to happened regardless of what I did. After unplugging it I had no issues anymore.

Robin · November 2020

Hi @Dominick @RBl
Can you reconnect the Fingbox and as soon as alerts come in again, Can you send the screenshots of new alerts and router logs so I can take this to our engineering team for review.

RBl · December 2020

There you go.....
XXXXXXX detected stationary source TCP SYN Flood attack and dropped 1034 packets. (Attack-Source=88.99.37.190) Dec 08, 2020 17:02:14

XXXXXXX detected stationary source TCP SYN Flood attack and dropped 153 packets. (Attack-Source=88.99.37.190) Dec 08, 2020 17:02:09

XXXXXXX detected stationary source TCP SYN Flood attack and dropped 3077 packets. (Attack-Source=88.99.37.190) Dec 08, 2020 17:02:04

XXXXXXX detected stationary source TCP SYN Flood attack and dropped 2579 packets. (Attack-Source=88.99.37.190) Dec 01, 2020 17:00:06

XXXXXXX detected stationary source TCP SYN Flood attack and dropped 1149 packets. (Attack-Source=88.99.37.190) Dec 01, 2020 17:00:01

XXXXXXX detected stationary source TCP SYN Flood attack and dropped 0 packets. (Attack-Source=192.168.178.43) Nov 24, 2020 16:59:26

XXXXXXX detected stationary source TCP SYN Flood attack and dropped 2664 packets. (Attack-Source=88.99.37.190) Nov 24, 2020 16:59:21

XXXXXXX detected stationary source TCP SYN Flood attack and dropped 1712 packets. (Attack-Source=88.99.37.190) Nov 24, 2020 16:59:16

XXXXXXX detected stationary source TCP SYN Flood attack and dropped 482 packets. (Attack-Source=88.99.37.190) Nov 17, 2020 16:58:45

XXXXXXX detected stationary source TCP SYN Flood attack and dropped 1110 packets. (Attack-Source=88.99.37.190) Nov 17, 2020 16:58:40

XXXXXXX detected stationary source TCP SYN Flood attack and dropped 3140 packets. (Attack-Source=88.99.37.190) Nov 17, 2020 16:58:35

RBl · December 2020

Dominick said:

\n
Robin<\/a> said:<\/div>\n
Hi
@Dominick<\/a>
It seems weird and I will investigate this. I will need further information in order to isolate the issue. I have sent you a private message. Please reply to my message directly. Thanks<\/div>\n<\/blockquote>\nHas the problem been identified, as I have the exact same issue:
*** detected stationary source TCP SYN Flood attack and dropped 2664 packets. (Attack-Source=88.99.37.190) Nov 24, 2020 16:59:21

<\/td> <\/td><\/tr><\/tbody><\/table>","bodyRaw":"

Robin<\/a> said:<\/div>
Hi @Dominick
It seems weird and I will investigate this. I will need further information in order to isolate the issue. I have sent you a private message. Please reply to my message directly. Thanks<\/div><\/blockquote>Has the problem been identified, as I have the exact same issue:
*** detected stationary source TCP SYN Flood attack and dropped 2664 packets. (Attack-Source=88.99.37.190) Nov 24, 2020  16:59:21

<\/td> <\/td><\/tr><\/tbody><\/table>","format":"wysiwyg","dateInserted":"2020-11-25T09:45:54+00:00","insertUser":{"userID":21227,"name":"RBl","url":"https:\/\/community.fing.com\/profile\/RBl","photoUrl":"https:\/\/us.v-cdn.net\/6031733\/uploads\/defaultavatar\/pIJEONH7HC39K.jpg","dateLastActive":"2020-12-09T08:20:51+00:00","label":"✭"},"displayOptions":{"showUserLabel":false,"showCompactUserInfo":true,"showDiscussionLink":false,"showPostLink":false,"showCategoryLink":false,"renderFullContent":false,"expandByDefault":false},"url":"https:\/\/community.fing.com\/discussion\/comment\/23429#Comment_23429","embedType":"quote"}">
https://community.fing.com/discussion/comment/23429#Comment_23429

No, I ultimately unplugged my Fing permanently because it continues to happened regardless of what I did. After unplugging it I had no issues anymore.

Too bad...

SYN Attack to Fingbox?

Answers