Wednesday 28 December 2011

Not a bot after all

For the past few weeks I have been bugged by occasional hangs of my ADSL router. The logfile shows entries such as

12/04/2011  13:19:55 **UDP flood** 192.168.1.5, 65400->> 62.24.139.140, 53 (from PVC1 Outbound)
12/04/2011  13:19:55 **UDP flood** 192.168.1.5, 65400->> 62.24.139.139, 53 (from PVC1 Outbound)
12/04/2011  13:19:54 **UDP flood** 192.168.1.5, 20559->> 62.24.139.140, 53 (from PVC1 Outbound)
12/04/2011  13:19:53 **UDP flood** 192.168.1.5, 65400->> 62.24.139.139, 53 (from PVC1 Outbound)
12/04/2011  13:19:52 **UDP flood** 192.168.1.5, 65400->> 62.24.139.140, 53 (from PVC1 Outbound)
12/04/2011  13:19:51 **UDP flood** 192.168.1.5, 65400->> 62.24.139.139, 53 (from PVC1 Outbound

I have been sure that I have been infested with some sort of 'bot' that is causing all this, and I have tried all sorts of things to get rid of it. I have changed the virus scanner, I run ccleaner and malwarebytes, I reloaded spybot. I have a list of other things to try.

And it is not just the PC causing them. My Android Tablet also does. 

This afternoon I investigated the fact that this flood seemed to occur as Firefox was started so I searched for infections of Firefox. I found a forum that gave the answer. The problem is that as web pages get more complex, the browser tries to open many more sockets at once. The suggested solution is:

1. Many routers have the following option: 
"Maximum incomplete TCP/UDP sessions number from same host"
Commonly the default value is 10. People report that changing it to 30 or 50 solves problems.




This worked. I seem to remember a year or so ago changing the option on the browser to allow it to open more ports simultaneously because  web pages were loading so slowly. As web pages have become more complex, this has been the result. 

Life would be so much simpler if all these web pages did not have so many advertisements.  


No comments: