I just tracerouted one of the most common target IP's of the packet flood while there was no flood at my interface, and I got some pretty crazy result:
112.201.130.84


I also tracerouted it earlier on while the flood was on at my interface, and I found my own IP in the route several times as well. Forgot to save the output though.

I don't know could it be that someone or some virus on the subnet is playing around and poisoning the arp cache of their router or whatever?

What do ISP's do to prevent this kind of attack if everyone is on the same giant switch (DSLAM)? I mean here they cannot be using static arp entries since they do not force the users to register their MAC, right?

Here is the output of the arp cache of my dd-wrt router (just after pinging x.y.152.12):
Again, I am not sure why x.y.152.12 maps to the same MAC address as x.y.128.1. Even with the DSLAM explanation above: if the DSLAM acts as a switch, then I should be getting the actual MAC address of x.y.152.12, should I not?

I don't know what is a verbose switch port?

I hear you on the topology, although I did other tests at a different time, and it seems to be routing through x.y.128.1 now!?:
(if you have an idea of commands I could try to confirm, please let me know).

I also hear you on the "hidden authentication".

And thank you for your explanations, this is most helpful. I know a little because I administer a small office network and networking is a hobby for me, but I have no experience on how things are done on the ISP side.

I beg to disagree on "your DSLAM is just oversubscribed" though. I have bandwidth graphs on my dd-wrt router, and it's not like traffic is gently creeping up at rush hour. It suddenly goes from zero to maxed out, unsolicited, and what I see on my tcpdump (confirmed many times) is the SYN or SYN/ACK packet flood, with (non multicast/broadcast) IP's and MAC addresses that are not mines. Look at the wireshark screenshot. At normal times, the only traffic at my interface is (as I would expect) traffic to and from my IP/MAC and the occasional broadcast. Again, this only started happening recently. Before that, my "1Mbps" connection would give me speeds between 500 and 700 Kbps depending on the time of the day.

I am also not sure I understand your idea with the tap. What could be happening between the tap and the LAN side of the modem that could cause this flood? This cannot be caused by something on my side (like a virus): this is happening with ot without my dd-wrt router in line, and it is happening both when I am logged into Linux and Windows with my scan box, and also happening when I use a different laptop. These rogue packets are definitely coming from outside, not originating from my side.

Also, there is no filtering in this country, the net is wide open.

It has been a week that I have been trying to get my ISP to fix this. If it is not done today, I switch to their competition.

I am still curious how it can happen that I am getting traffic at my interface that is not for me. I mean if the DSLAM you mentioned acts as a switch, this should not happen right? And if it acted as a hub, I would see other's traffic at all times, not just when the flood happens.

If anyone has ideas of commands I could run to further document this, please let me know.

Yes for the purpose of this scan I did connect my scanning box straight to the internet. One of the reasons is that I was interested in neighbouring MAC addresses, which I can only get at if  my scan box is directly on the same subnet as the machines of interest. In this config my scan box is the only host at home connected to the net, through my dsl modem configured as a bridge (not a router or DHCP server). In my normal setup, I have a Linksys router loaded with dd-wrt sitting between the modem and my local home network.

Yes the scan box does get a public IP (from the ISP's DHCP server) in the x.y.128.0/17 subnet mentioned in OP. To be clear here is what the vlan2 of my dd-wrt router looks like, and my scan box eth0 looks the same when it is connected directly:


I did not do the nmap scan with a different computer, however I did the tcpdump with both my scan box and also from the command line of my dd-wrt Linksys router. Results are the same: SYN, SYN/ACK or UDP packet flood with src and dst IP's and MAC's having nothing to do with me. See http://imageshack.us/photo/my-images/37/tcpdump.png/, screenshot of the pcap file in wireshark. It goes on like that for hours. In the packet flood, the MAC address of the dst machine is 00:23:69:a:b:c, but if I nmap that IP, it resolves again to 00:21:a0:d:e:f, just as every other IP on the subnet.

Outside the hours mentioned in OP, traffic is as normal: next to zero bandwidth when my computer is idle, and then I only see normal packets meant for my IP/MAC (or from my IP/MAC) at the interface.

I even tried to change the dsl modem for a different model and brand, same result. This thing only started happening when I came back from holiday one week ago. Before that everything was more or less normal apart from occasional intermittent connectivity issues and sluggish connection at rush hours.

Whichever way, I may lack experience but I can't understand how I can be only a single hop away from every host on the subnet, and how every IP on the subnet resolves to a single MAC!? Is this normal??

Hello,

I recently moved to Asia and am having some severe problems with my ISP, which they apparently are unable to solve, so I decided to investigate on my own. My connection is DSL and my ISP uses DHCP without authentication or MAC registration (as an aside, in my personal experience, this is a management and security disaster).

My subnet is x.y.128.0/17 (255.255.128.0 netmask), my gateway being x.y.128.1. For the purpose of the scan, I am not behind my usual home router.

The first thing I do not get is their network topology. Every host I nmap in my subnet is showing the same MAC address: apparently the one of the gateway. The Zenmap topology output shows a perfect star with... me (localhost) in the center... For example:

with the MAC address always the same as that of x.y.128.1, the gateway, but the gateway's IP not showing in the route.

When I scan further, every host is showing different open ports and different OSes though, so they seem to all be real live hosts. For example:

... again always with the same MAC address.

Now the problem I have is that starting from about 10AM to 7PM, I hardly can access the internet. I have found by running tcpdump and looking at the output that at these times there are packet floods at my interface, which vary from SYN, SYN/ACK and UDP packets. However these packets have a source and destination IP distinct from mine. Mostly they are SYN packets aimed at port 445 or SYN/ACK packets aimed at port 7170 and often the same IPs are involved. The source MAC is always the usual 00:21:A0:a:b:c, but the destination MAC is also not mine!! So I have no idea how and why these packets make it to my interface to start with!? All I can think of is that they have some crossed wires or short circuits in their junction boxes!

I scanned the source and destination hosts most often mentioned in the SYN/ACK flood and here is what I got:

Any idea, thought or  insight from people more experienced than I am would be most welcome.