# \[DoS attack: Smurf\] attack packets in last 20 sec from ip **URL:** \ **Category:** Questions & Help\ **Created:** [July 31, 2019, 9:38am UTC](https://community.homey.app/t/dos-attack-smurf-attack-packets-in-last-20-sec-from-ip/16245 "2019-07-31T09:38:42Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![John\_Otte](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/john_otte/32/11115_2.png) [@John\_Otte](https://community.homey.app/u/John_Otte)\ **Post date:** [July 31, 2019, 9:38am UTC](https://community.homey.app/t/dos-attack-smurf-attack-packets-in-last-20-sec-from-ip/16245/1 "2019-07-31T09:38:42Z")
Since de update to Homey 2.5.0 I notice smurf attack packages originating form my homey 192.168.1.160. Is it the firmware or one of the apps? First apperarance in my routers log is: [DHCP IP: (192.168.1.120)] to MAC address 0C:B2:B7:5F:24:E7, Wednesday, Jul 31,2019 04:59:47 [Time synchronized with NTP server] Wednesday, Jul 31,2019 04:57:06 [Internet connected] IP address: 77.251.16.46, Wednesday, Jul 31,2019 04:56:59 [Internet disconnected] Wednesday, Jul 31,2019 04:56:57 [DoS attack: Smurf] attack packets in last 20 sec from ip [192.168.1.160], Wednesday, Jul 31,2019 04:55:31 [DHCP IP: (192.168.1.160)] to MAC address 6C:AD:F8:1D:A0:7F, Wednesday, Jul 31,2019 04:53:43 [DHCP IP: (192.168.1.120)] to MAC address 0C:B2:B7:5F:24:E7, Wednesday, Jul 31,2019 04:48:39 [DoS attack: Smurf] attack packets in last 20 sec from ip [91.134.139.255], Wednesday, Jul 31,2019 04:48:25 [DoS attack: Smurf] attack packets in last 20 sec from ip [188.32.211.255], Wednesday, Jul 31,2019 04:21:22 ---
**Author:** ![robertklep](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/robertklep/32/160628_2.png) [@robertklep](https://community.homey.app/u/robertklep)\ **Post date:** [July 31, 2019, 9:47am UTC](https://community.homey.app/t/dos-attack-smurf-attack-packets-in-last-20-sec-from-ip/16245/2 "2019-07-31T09:47:26Z")
Smurf attacks use ICMP-packets, which Homey apps cannot create, so it won’t be an app. That leaves the firmware, or, possibly, a false positive from your router. Other (external) IP-addresses are also flagged for the same attack. ---
**Author:** ![John\_Otte](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/john_otte/32/11115_2.png) [@John\_Otte](https://community.homey.app/u/John_Otte)\ **Post date:** [July 31, 2019, 10:04am UTC](https://community.homey.app/t/dos-attack-smurf-attack-packets-in-last-20-sec-from-ip/16245/3 "2019-07-31T10:04:55Z")
Correct, but it can’t be coincidence. Homey was update and since the update I notice smurf attacks originating from Homey ---
**Author:** ![John\_Otte](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/john_otte/32/11115_2.png) [@John\_Otte](https://community.homey.app/u/John_Otte)\ **Post date:** [July 31, 2019, 10:30am UTC](https://community.homey.app/t/dos-attack-smurf-attack-packets-in-last-20-sec-from-ip/16245/4 "2019-07-31T10:30:49Z")
In case support is reading: I’ve made a diagnostic report code EE25748397 ---
**Author:** ![David\_K](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/david_k/32/10319_2.png) [@David\_K](https://community.homey.app/u/David_K)\ **Post date:** [July 31, 2019, 11:05am UTC](https://community.homey.app/t/dos-attack-smurf-attack-packets-in-last-20-sec-from-ip/16245/5 "2019-07-31T11:05:07Z")
2.5.0 firmware has new [discovery](https://apps.developer.athom.com/tutorial-Drivers-Discovery.html) capabilities so could be that its somehow related. 77.251.16.46 is Nederland registered IP, could be used by Athom or this is your public IP. Logs are quite hard to understand like this. I would put my bet on false positive for smurf… ---
**Author:** ![John\_Otte](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/john_otte/32/11115_2.png) [@John\_Otte](https://community.homey.app/u/John_Otte)\ **Post date:** [July 31, 2019, 1:50pm UTC](https://community.homey.app/t/dos-attack-smurf-attack-packets-in-last-20-sec-from-ip/16245/6 "2019-07-31T13:50:18Z")
I Think that the discovery should be triggered and not automatically started ---
**Author:** ![John\_Otte](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/john_otte/32/11115_2.png) [@John\_Otte](https://community.homey.app/u/John_Otte)\ **Post date:** [July 31, 2019, 1:55pm UTC](https://community.homey.app/t/dos-attack-smurf-attack-packets-in-last-20-sec-from-ip/16245/7 "2019-07-31T13:55:04Z")
That there are Obvious attacks from the outside is “normal”. But, as I stated, this is within my network and all adresses within my network are reserved and dedicated. Within DHCP, when a conflict arises there must be somethingin the log ---
**Author:** ![robertklep](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/robertklep/32/160628_2.png) [@robertklep](https://community.homey.app/u/robertklep)\ **Post date:** [July 31, 2019, 1:57pm UTC](https://community.homey.app/t/dos-attack-smurf-attack-packets-in-last-20-sec-from-ip/16245/8 "2019-07-31T13:57:24Z")
Discovery is passive (Homey listening to devices broadcasting their presence on the network). ---
**Author:** ![David\_K](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/david_k/32/10319_2.png) [@David\_K](https://community.homey.app/u/David_K)\ **Post date:** [July 31, 2019, 2:21pm UTC](https://community.homey.app/t/dos-attack-smurf-attack-packets-in-last-20-sec-from-ip/16245/9 "2019-07-31T14:21:14Z")
Aha those are DHCPACK logs. Bah, what I wanted to say about the logs is if the logs are not normalized they are hard to read. Actually I noticed now on the bottom additional two public IPs. Well, maybe there really is something happening. Do you have static or dynamic public IP? If you have dynamic (which most home users do) just restart the router. You will get new public IP from ISP and if this happens again after then something is fishy behind it. ---
**Author:** ![John\_Otte](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/john_otte/32/11115_2.png) [@John\_Otte](https://community.homey.app/u/John_Otte)\ **Post date:** [July 31, 2019, 2:24pm UTC](https://community.homey.app/t/dos-attack-smurf-attack-packets-in-last-20-sec-from-ip/16245/10 "2019-07-31T14:24:22Z")
Did that, it’s the routers log about all things happening to, on and from my network. Not just DHCP. And if someone performs a portscan it will be noticed. Already rebooted homey and my router ---
**Author:** ![Rene\_Kraaijenbrink](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/rene_kraaijenbrink/32/20692_2.png) [@Rene\_Kraaijenbrink](https://community.homey.app/u/Rene_Kraaijenbrink)\ **Post date:** [January 19, 2020, 5:12pm UTC](https://community.homey.app/t/dos-attack-smurf-attack-packets-in-last-20-sec-from-ip/16245/11 "2020-01-19T17:12:58Z")
DoS attack: Smurf] (6) attack packets in last 20 sec from ip [192.168.1.7], Saturday, Jan 18,2020 23:59:58 [DoS attack: Smurf] (6) attack packets in last 20 sec from ip [192.168.1.7], Saturday, Jan 18,2020 23:44:58 [DoS attack: Smurf] (6) attack packets in last 20 sec from ip [192.168.1.7], Saturday, Jan 18,2020 23:29:58 [DoS attack: Smurf] (6) attack packets in last 20 sec from ip [192.168.1.7], Saturday, Jan 18,2020 23:14:58 [DoS attack: Smurf] (6) attack packets in last 20 sec from ip [192.168.1.7], Saturday, Jan 18,2020 22:59:58 [DoS attack: Smurf] (6) attack packets in last 20 sec from ip [192.168.1.7], Saturday, Jan 18,2020 etc. Etc. Happens as soon as i am adding or changing light and.or other stuf. Same wifi, same router . Router X.x.1.X coupled to X.x.2.X which talks to outside Word. Nothing fancy. ---
**Author:** ![lexvanderloo](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/lexvanderloo/32/10347_2.png) [@lexvanderloo](https://community.homey.app/u/lexvanderloo)\ **Post date:** [January 27, 2020, 7:01pm UTC](https://community.homey.app/t/dos-attack-smurf-attack-packets-in-last-20-sec-from-ip/16245/12 "2020-01-27T19:01:32Z")
Same problem overhere: [DoS attack: Smurf] (6) attack packets in last 20 sec from ip [192.168.1.163], Monday, Jan 27,2020 10:33:32 The IP-address is the address of the Homey. And NO other networktraffic from or to outside, ---
**Author:** ![Robin\_van\_Kekem](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/robin_van_kekem/32/8187_2.png) [@Robin\_van\_Kekem](https://community.homey.app/u/Robin_van_Kekem)\ **Post date:** [January 28, 2020, 9:36am UTC](https://community.homey.app/t/dos-attack-smurf-attack-packets-in-last-20-sec-from-ip/16245/13 "2020-01-28T09:36:51Z")
Smurf attacks are just ICMP ECHO (ping) requests [https://www.imperva.com/learn/application-security/smurf-attack-ddos/](https://www.imperva.com/learn/application-security/smurf-attack-ddos/) Isn’t it possible Homey is just pinging a device to see if it’s up? 6 packets in 20sec isn’t very much as ICMP packets are really small. ---
**Author:** ![John\_Otte](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/john_otte/32/11115_2.png) [@John\_Otte](https://community.homey.app/u/John_Otte)\ **Post date:** [January 28, 2020, 9:58am UTC](https://community.homey.app/t/dos-attack-smurf-attack-packets-in-last-20-sec-from-ip/16245/14 "2020-01-28T09:58:54Z")
Yep, I suppose that homey is questioning my netgear router. I have the netgear app iinstalled. So i assume that this app is the origine of the attacks ---
**Author:** ![Joakim\_Clivemo](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/joakim_clivemo/32/18722_2.png) [@Joakim\_Clivemo](https://community.homey.app/u/Joakim_Clivemo)\ **Post date:** [August 12, 2020, 4:57pm UTC](https://community.homey.app/t/dos-attack-smurf-attack-packets-in-last-20-sec-from-ip/16245/15 "2020-08-12T16:57:58Z")
I get the same Smurf attacks from my Homey address at a fixed interval of 15 minutes I also use a Netgear router (the Nighthawk). No problems reported from outside addresses. Apps: IKEA Trådfri IKEA Trådfri Gateway Sonos Sony Bravia SmartTV app Virtual Devices ---
**Author:** ![Gruijter](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/gruijter/32/1973_2.png) [@Gruijter](https://community.homey.app/u/Gruijter)\ **Post date:** [August 12, 2020, 5:06pm UTC](https://community.homey.app/t/dos-attack-smurf-attack-packets-in-last-20-sec-from-ip/16245/16 "2020-08-12T17:06:56Z")
> [@John\_Otte](#): > > I have the netgear app iinstalled. So i assume that this app is the origine of the attacks No, the Netgear app is not causing smurf attacks or anything. It does a regular http request to the soap port of the router once a minute or so. ---
**Author:** ![amoscami](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/amoscami/32/14024_2.png) [@amoscami](https://community.homey.app/u/amoscami)\ **Post date:** [January 15, 2021, 11:14am UTC](https://community.homey.app/t/dos-attack-smurf-attack-packets-in-last-20-sec-from-ip/16245/17 "2021-01-15T11:14:48Z")
Identical problem started a couple of rounds. It causes disruptions on the network with traffic interruptions. By scanning for vulnerabilities with Nessus, a vulnerability is identified precisely on DDoS attacks. In attach the vulnerability ![2021-01-15 12_14_03-Window](https://us1.discourse-cdn.com/flex025/uploads/athom/original/3X/8/4/84e4dbb4b2adff26019ee149849875b23fc8a6aa.png) ---
**Author:** ![robertklep](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/robertklep/32/160628_2.png) [@robertklep](https://community.homey.app/u/robertklep)\ **Post date:** [January 15, 2021, 11:36am UTC](https://community.homey.app/t/dos-attack-smurf-attack-packets-in-last-20-sec-from-ip/16245/18 "2021-01-15T11:36:20Z")
Which DNS server are you testing? ---
**Author:** ![amoscami](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/amoscami/32/14024_2.png) [@amoscami](https://community.homey.app/u/amoscami)\ **Post date:** [January 15, 2021, 12:13pm UTC](https://community.homey.app/t/dos-attack-smurf-attack-packets-in-last-20-sec-from-ip/16245/19 "2021-01-15T12:13:21Z")
Homey has a dns server that respond on interface you can check with nslookup ---
**Author:** ![amoscami](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/amoscami/32/14024_2.png) [@amoscami](https://community.homey.app/u/amoscami)\ **Post date:** [January 15, 2021, 12:19pm UTC](https://community.homey.app/t/dos-attack-smurf-attack-packets-in-last-20-sec-from-ip/16245/20 "2021-01-15T12:19:10Z")
this is the logs i see only the packets on external interface but all the traffic coming from homey [DoS Attack: RST Scan] from source: 163.181.50.231, port 443, Friday, January 15, 2021 12:22:12 [DoS Attack: ACK Scan] from source: 40.103.27.6, port 443, Friday, January 15, 2021 12:13:47 [DoS Attack: ACK Scan] from source: 40.103.49.230, port 443, Friday, January 15, 2021 12:11:00 [DoS Attack: ACK Scan] from source: 52.96.54.162, port 443, Friday, January 15, 2021 11:59:59 [Next page](https://community.homey.app/t/dos-attack-smurf-attack-packets-in-last-20-sec-from-ip/16245.md?page=2)