Comware

i have a new 3com router 3CRWDR101A-75

and all the time i'm connecting to the internet the allert red led flashing

and this message from the router log dispalyed :

2003.01.01 00:33:45 PPPoE receive PADT


2003.01.01 00:33:35 PPPoE receive PADT


2003.01.01 00:33:21 PPPoE receive PADT


2003.01.01 00:33:10 PPPoE receive PADT


2003.01.01 00:32:59 PPPoE receive PADT


2003.01.01 00:32:39 PPPoE receive PADT


2003.01.01 00:32:35 PPPoE receive PADT


2003.01.01 00:32:23 PPPoE receive PADT


2003.01.01 00:32:23 PPPoE receive PADT


2003.01.01 00:32:21 PPPoE receive PADT


2003.01.01 00:32:16 **Smurf** 169.254.255.255->> 169.254.81.238, Type:3, Code:3 (from PPPoE1 Outbound)


2003.01.01 00:32:14 **Smurf** 169.254.255.255->> 169.254.81.238, Type:3, Code:3 (from PPPoE1 Outbound)


2003.01.01 00:32:13 **Smurf** 169.254.255.255->> 169.254.81.238, Type:3, Code:3 (from PPPoE1 Outbound)


2003.01.01 00:32:12 **Smurf** 169.254.255.255->> 169.254.81.238, Type:3, Code:3 (from PPPoE1 Outbound)


2003.01.01 00:32:00 PPPoE receive PADT


2003.01.01 00:31:59 **Smurf** 169.254.255.255->> 169.254.23.35, Type:3, Code:3 (from PPPoE1 Outbound)


2003.01.01 00:31:57 **Smurf** 169.254.255.255->> 169.254.23.35, Type:3, Code:3 (from PPPoE1 Outbound)


2003.01.01 00:31:51 **Smurf** 169.254.255.255->> 169.254.23.35, Type:3, Code:3 (from PPPoE1 Outbound)


2003.01.01 00:31:49 **Smurf** 169.254.255.255->> 169.254.23.35, Type:3, Code:3 (from PPPoE1 Outbound)

i dont know what is the problem

what is your advise about this problem .

Ahmed from palestine ..

Salam/Shalom Ahmed,

It looks like a computer on your network probably was compromised in what is known as a Smurf attack unless the router is malfunctioning.

See Wiki link for info: http://en.wikipedia.org/wiki/Smurf_attack

Firstly, is your router set up on an active LAN yet? If so, how many computers are plugged into it. Is it plugged into another switch? The reason I am asking is to determine where the traffic is coming from. If the router has not been set up on the LAN yet and you are only connecint the WAN port to your Internet service and your single computer to the LAN then you know that the computer you are using to configure the router is the one that is compromised.

If you need help figuring out which machines are compromised, please feel free to ask.

What are the operating systems of the computer(s) you are using?

First thing to do is:


Make sure you have legal/legit copies of your operating systems.


If you are running windows go to: http://www.microsoft.com/genuine/ and click the Validate button.

Secondly run a variety of virus scans:


http://safety.live.com is an on-demand scanner for Windows machines


 

Let me know if this helps and/or if you have additional questions.

-Jonathan