cancel
Showing results for 
Search instead for 
Did you mean: 

Port scan causes router to restart - maybe

EnglishMohican
Aspiring Pro
Posts: 310
Thanks: 54
Fixes: 1
Registered: 08-04-2009

Port scan causes router to restart - maybe

A few minutes ago I turned on my laptop and noticed that the web-connection icon was showing that there was no connection to the internet. I put in the routers webadmin address, connected to it ok and found that it had reconnected about 2 minutes before I opened that page.
I checked the logs and have found the entries shown below. It reads bottom upwards so the bottom entry is a routine time check, then we get a scan warning and then the router restarts. It then went on to work normally.
Jan 1 00:00:14 KERNEL Warm restart
Warning Jun 1 13:47:32 IDS scan parser : tcp port scan: 192.168.1.253 scanned at least 10 ports at 192.168.1.254. (1 of 1) : 192.168.1.253 192.168.1.254 0060 TCP 41952->3750 [S.A...] seq 1036268745 ack 3797591220 win 5792
Info Jun 1 13:40:22 SNTP Synchronised to server: 212.159.13.49
This is a standard Plusnet TG582 and 192.168.1.254 is the router webadmin address. The rest of it is gibberish to me but the timing of it all is such that the port scan warning was not me connecting to the router by typing in the 192.168.1.254, that happened later. It could be coincident with the laptop booting up.
Does anyone know: whether a port scan can cause the TG582 to restart - is it some sort of protection mechanism?
Can anybody get anymore out of the scan warning message and tell me more about it. Could it be an external attack? - These are internal network numbers so that seems unlikely. Any suggestions on what would do a scan like this that might be there on a normal domestic network. and would know the 254 number.
I'm not paranoid about this but it would be nice to understand what made my router restart.
1 REPLY
RPMozley
Aspiring Pro
Posts: 1,117
Thanks: 30
Fixes: 5
Registered: 04-11-2011

Re: Port scan causes router to restart - maybe

.253 is (I think) from the router as well. It must have got its knickers in a twist and rebooted.  Huh
That's RPM to you!!