Topic: router logs

[Baz]

have been getting a lot of logs about DOS attacks from the router.I have been well informed by Rik that its ok and the router is doing its job but it seems strange to me as I never used to get any,honest.After i get the reports sent by email i try to look in the router settings and it wont log in.

The only thing i can think of is its something to do with my son playing on line on his PS3 but he has done this for ages and we never got any bother.Why and how are these getting in to the router

Any ideas

[Simon]

I would never dispute the word of the all-knowing one on routers and ADSL, Baz.    I do believe the router firewall is just doing it's job, but I guess there comes a point where one has to ask if it's being asked to work too hard for any reason.  Can you post some of the logs, without revealing any personal info, so that we can have a look for you?

[Baz]

dont get me wrong Simon,theres no way too that I would or am disputing what Ive been told hope Rik or you dont think I am,just trying to find out why its happening all of a sudden.

latest logs from yesterday.I have some from 28dec, others i have deleted

Sat, 2010-01-02 22:00:44 - UDP Packet - Source:174.27.18.1,3074 Destination:************* - [DOS]
Sat, 2010-01-02 22:05:44 - Administrator login successful - IP:*************
Sat, 2010-01-02 22:05:44 - UDP Packet - Source:86.162.95.144,3074 Destination:************* - [DOS]
Sat, 2010-01-02 22:10:44 - Administrator login successful - IP:*************
Sat, 2010-01-02 22:10:44 - UDP Packet - Source:77.229.97.224,3074 Destination:************* - [DOS]
Sat, 2010-01-02 22:15:44 - UDP Packet - Source:82.237.102.228,3074 Destination:*************- [DOS]
Sat, 2010-01-02 22:20:44 - UDP Packet - Source:207.134.184.29,3074 Destination:************* - [DOS]
Sat, 2010-01-02 22:25:44 - UDP Packet - Source:88.17.189.60,3074 Destination:************* - [DOS]
Sat, 2010-01-02 22:25:45 - UDP Packet - Source:98.192.207.244,3074 Destination:************* - [DOS]
Sat, 2010-01-02 22:25:45 - UDP Packet - Source:75.159.216.203,3078 Destination:************* - [DOS]
Sat, 2010-01-02 22:25:45 - UDP Packet - Source:84.123.179.199,13101 Destination:************* - [DOS]
Sat, 2010-01-02 22:25:45 - UDP Packet - Source:82.13.160.190,19103 Destination:************* - [DOS]
Sat, 2010-01-02 22:25:45 - UDP Packet - Source:174.117.235.109,61537 Destination:************* - [DOS]
Sat, 2010-01-02 22:25:45 - UDP Packet - Source:87.220.30.133,3074 Destination:************* - [DOS]
Sat, 2010-01-02 22:25:45 - UDP Packet - Source:173.55.164.67,3074 Destination:************* - [DOS]
Sat, 2010-01-02 22:25:45 - UDP Packet - Source:81.100.83.233,55013 Destination:************* - [DOS]
Sat, 2010-01-02 22:25:45 - UDP Packet - Source:90.23.73.156,3081 Destination:************* - [DOS]
Sat, 2010-01-02 22:25:45 - Send E-mail Success!
Sun, 2010-01-03 01:40:48 - Send out NTP request to 158.43.192.66
Sun, 2010-01-03 01:40:48 - Receive NTP Reply from 158.43.192.66


 

[Rik]

Someone has probably visited a site where the IP address has been picked up, Baz. As we have static IPs, once they become known, we get attacks. The router log just shows the firewall at work.

[sam]

or has someone just started using torrents?

[Baz]

torrents as in what Sam.dont know enough about them   

[Baz]

Someone has probably visited a site where the IP address has been picked up, Baz. As we have static IPs, once they become known, we get attacks. The router log just shows the firewall at work.

do you get the same IP address every time. if you reboot will you get a different one

[Simon]

With IDNet, you keep the same IP address, Baz.

[Baz]

thanks Simon

[sam]

torrents as in what Sam.dont know enough about them   

says it all, just wondered if you or anyone else in your house was using them - could cause increased traffic like that.

[Simon]

Also, P2P applications like Limewire can cause it. 

[Baz]

says it all, just wondered if you or anyone else in your house was using them - could cause increased traffic like that.

well like I say Sam, as in what.I really dont know anything about torrents thats why I asked, then I could ask the rest of the family if they have used them

[Simon]

I think Sam was saying that if you don't know anything about torrents, it's unlikely that you would be using them, Baz, but basically, torrents are just another way to engage in file sharing on the internet, a bit like traditional P2P such as LimeWire, only with torrents, the files are 'split', and you are downloading from (and uploading to) many multiples of users at any one time, which, technically, makes the downloading faster.  There are various BitTorrent 'clients' (programs), and possibly the most common is 'uTorrent', so if anyone has that on their PC, it's likely that they are engaging in torrent activity.

Despite most torrent activity being illegal, it could be argued that it's safer than traditional P2P, as you have more control over what files are being shared from your computer - usually, you are simultaneously uploading a copy of the file you are downloading at the time.

[topquark]

It would be useful to know what the destination port number was (not the IP address) if it's shown.  In your source information it's shown after the comma in the source IP address info.  As already said, doesn't look like anything to worry about, probably just someone thinks you're running a website (port 80) that they want to hinder access to (very sad!).

You could always do a port scan and check that you have no ports open, there are plenty of sites on the web you can use to do that.

Edit:  If you are worried that someone may be getting in (unlikely) you can always use something like: http://www.snort.org/ on your PC('s).

[Baz]

the destination port number you ask about is the same in all the logs do you mean its the one after the comma too in the destination address.is it ok to post it here.