ER7212PC - "Router Detected TCP SYN packets attack and dropped xxx packets" every ten minutes.
This thread has been locked for further replies. You can start a new thread to share your ideas or ask questions.
Hello everyone!
I have this setup (all device on the latest firmware):
Modem from my net provider - ER7212PC v1 (Router) - TL-SG2008P v3 (Switch) - EAP245(EU) v3 (Access Point)
Omada version: 5.8.36
In the Omada Controller under the Log section i got this alert every ten minutes:
"Router Detected TCP SYN packets attack and dropped ~100-300 packets" every ten minutes." - nothing more, no IP or MAC or any useful info.
What can i do with this or this is a bug in the Omada Controller?
@Tedd404 Thank you for your constructive comment…
Yes, I read the forum post that you linked and no, that is not the solution to this phenomenon.
I used the grcDOTcom "Shield up" service to request the examination of the ports and there it was, that although they are not open, they are not well configured, because they do not block the incoming requests but reject them.
So the solution was in this forum post:
Omada Gateway Cannot Get Full Stealth On The GRC ShieldsUp Test. [Case Closed] - Business Community (tp-link.com)
After I set this up, my alert line cleared up.
@Tedd404 Thank you for your constructive comment…
Yes, I read the forum post that you linked and no, that is not the solution to this phenomenon.
I used the grcDOTcom "Shield up" service to request the examination of the ports and there it was, that although they are not open, they are not well configured, because they do not block the incoming requests but reject them.
So the solution was in this forum post:
Omada Gateway Cannot Get Full Stealth On The GRC ShieldsUp Test. [Case Closed] - Business Community (tp-link.com)
After I set this up, my alert line cleared up.
Hi @rainman12
Thanks for posting in our business forum.
It was there all the time. The log did not show this before. Same thing for the DHCP log which displays its interaction even though there is zero issue with it.
If you have any issues like this in the future, please take a look at the label where we update the solutions and troubleshooting guides.
If you want to find out the root cause, please use Wireshark and mirror your WAN connection to capture any traffic that meets the "TCP SYN reset".
