Signs of a Modem DDoS Attack

Core conclusion: A typical user cannot reliably distinguish “my modem is launching a DDoS attack” from “my modem is being DDoSed” by feel alone. The surface symptoms are nearly identical — sudden slowdowns, unstable connections, abnormal LED activity. The reliable path to a diagnosis is inspecting modem logs (especially abnormal outbound traffic and port-scan records) and corroborating with ISP or third-party alerts.

Two Different Scenarios

First, clarify the direction: is your modem the source of the attack or the target?

As a source (infected and conscripted into a botnet): Your modem has been taken over by malware and is attacking others. You will see heavy outbound traffic.
As a target: An attacker is flooding your public IP with junk packets to exhaust your bandwidth or crash the device. You will see heavy inbound traffic.

For home users, being compromised and recruited into a botnet is the more common and more concerning scenario.

Observable Technical Signs

Device-level anomalies

A modem should not be busy while idle. If you have disconnected all networked devices and the following persist, it warrants investigation:

Status LEDs flickering intensely and continuously, especially when nobody is using the network (DSL/fiber sync or data lights).
The modem runs unusually hot, particularly during low-usage hours such as the middle of the night.
Frequent reboots or instability with no identifiable hardware fault.

Traffic-level anomalies

This is the most direct clue for determining whether the modem is being used as a DDoS source:

Outbound traffic far exceeds inbound traffic, with no corresponding legitimate application (no cloud backup running, no P2P uploads enabled).
Abuse notices from your ISP stating your IP is scanning other hosts or sending attack traffic. This is a very strong signal — the ISP sees a more complete traffic pattern than you can observe locally.
Large numbers of connections to unfamiliar external IPs, especially repeated connections to the same set of IPs on specific ports within a short window.

Specific log entries

Log into the modem’s admin interface and look for:

“DoS Attack” or “Flooding” entries in firewall or system logs. Caveat: some modems have overly sensitive DoS protection and may false-positive on normal DNS queries.
Heavy outbound connections to TCP port 23 (Telnet), 2323, or other common attack ports — classic Mirai-family botnet behavior.
Unexplained admin login records, or unfamiliar accounts.

An Important Caveat

Slow internet alone is not sufficient evidence. Weak signal, channel congestion, ISP outages, and legitimate large updates can all produce a similar experience. Only when multiple anomalies appear together — for example, “slow speeds + LEDs blazing while idle + an ISP warning” — does it form a combination worth deeper investigation.

How to Confirm

If you suspect the modem is being used for DDoS:

Check ISP notifications. This is the most direct source of evidence.
Use IP reputation tools. Services such as GreyNoise’s IP Check can tell you whether your public IP has been flagged for scanning or attack activity.
Review modem logs. Look for abnormal outbound connections and port-scan records.
Disconnect all local devices and observe. Shut down every computer, phone, and IoT device, leaving only the modem. If the abnormal traffic and LED activity continue, the problem is likely in the modem itself or upstream.

If compromise is confirmed, a simple reboot usually will not help — some malware reloads itself via scripts on startup. Perform a factory reset and update the firmware immediately, and change all default credentials.

Related Preventive Measures

To reduce the risk of your modem being recruited or targeted:

Change default admin credentials and disable WAN-side remote management.
Keep firmware updated; replace devices that no longer receive security patches.
Disable UPnP unless specifically required.
Segment IoT devices onto a separate network.
Monitor your public IP’s reputation periodically and act on ISP abuse notices promptly.