Macbook Air being detected as a potential source of a DDOS attack ?

AdamBrunt · 04-04-2021, 19:30

Hi all,

So my daughter bought a brand new Macbook Air a few days ago and has been using it fine until yesterday; at which point it could connect to our router fine but not get to the internet.

After a big of digging around, I found someone who posted about having the same problem and traced it to his router detecting the Macbook Air as a potential DDOS threat and had blocked it. Sure enough, my TP-Link Archer C7 router - which had DDOS Protection enabled had done the same thing and had blacklisted the Macbook. Removing the Air from the list and disabling DDOS Protection has solved the issue. All my daughter was doing at the time was watching Youtube.

Anyone got any ideas what the Air could be doing in the background to be seen as a DDOS threat ? Or am I going to have to leave DDOS protection disabled ?

ColinD · 05-04-2021, 12:06

My bet would be ads on Youtube. So an ad-blocker might help?

AdamBrunt · 05-04-2021, 15:08

Already use Pihole so not sure it is that, besides there are other devices on the LAN streaming YouTube as well.

The other weird thing is the Air seems to appear in the router's DHCP client list twice ? Once as MACBOOKPRO and as 'Lilys-Air' ( daughter's name ) and it was the first one that was on the DDOS blacklist

Kryten · 06-04-2021, 22:45

Are you sure they are the same? Does it show MAC address? Not seen anything like that with my Air or any of my (several) Macs I have at home on my setup (UniFi). Is it able to show you what it is trying to do? Can you do anything on the Mac to see (check activity monitor, do a TCP Dump (if you are comfortable with reading those), look at network connections (netstat / ss) etc.

AdamBrunt · 07-04-2021, 06:32

Quote:

Originally Posted by Kryten

Are you sure they are the same? Does it show MAC address? Not seen anything like that with my Air or any of my (several) Macs I have at home on my setup (UniFi). Is it able to show you what it is trying to do? Can you do anything on the Mac to see (check activity monitor, do a TCP Dump (if you are comfortable with reading those), look at network connections (netstat / ss) etc.

Will do so further digging - at the moment I have just turned DDOS Protection off.

But I can re-enable it and see if it happens again

AdamBrunt · 09-04-2021, 11:19

Well this is getting crazy now

I re-enabled DDOS Protection yesterday and her iPhone has been blocked now [ when all she was looking at was TikTok videos this time ]. Either she is looking at dodgy Youtube and TikTok videos [ not impossible though she normally only looks at vlogger stuff but then so does my son and his devices haven't been blocked at all] or TP-Links DDOS Protection is overly sensitive.

The relevant settings available are:

SPI Firewall: Currently off / on
DoS Protection: Currently off / on
-- ICMP-FLOOD Attack filtering: Off / Low / Medium / High
-- UDP-FLOOD Attack filtering: Off / Low / Medium / High
-- TCP-SYN-FLOOD Attack filtering: Off / Low / Medium / High

bold = currently selected setting

shteve · 09-04-2021, 11:28

Have you done a virus check on them both? Maybe something attached to her profile?

driver8 · 09-04-2021, 12:02

I've never used a Mac or iPhone, but how about something like >>

View network activity in Activity Monitor on Mac

Fing - Network Scanne‪r‬

SNMP Router Traffic Graphe‪r

AdamBrunt · 09-04-2021, 12:23

Quote:

Originally Posted by shteve

Have you done a virus check on them both? Maybe something attached to her profile?

Quote:

Originally Posted by driver8

I've never used a Mac or iPhone, but how about something like >>

View network activity in Activity Monitor on Mac

Fing - Network Scanne‪r‬

SNMP Router Traffic Graphe‪r

Will check those out.

Though I really hope she hasn't got a virus already on a barely two week old brand new MacBook