A few minutes ago I turned on my laptop and noticed that the web-connection icon was showing that there was no connection to the internet. I put in the routers webadmin address, connected to it ok and found that it had reconnected about 2 minutes before I opened that page. I checked the logs and have found the entries shown below. It reads bottom upwards so the bottom entry is a routine time check, then we get a scan warning and then the router restarts. It then went on to work normally. Jan 1 00:00:14 KERNEL Warm restart Warning Jun 1 13:47:32 IDS scan parser : tcp port scan: 192.168.1.253 scanned at least 10 ports at 192.168.1.254. (1 of 1) : 192.168.1.253 192.168.1.254 0060 TCP 41952->3750 [S.A...] seq 1036268745 ack 3797591220 win 5792 Info Jun 1 13:40:22 SNTP Synchronised to server: 22.214.171.124 This is a standard Plusnet TG582 and 192.168.1.254 is the router webadmin address. The rest of it is gibberish to me but the timing of it all is such that the port scan warning was not me connecting to the router by typing in the 192.168.1.254, that happened later. It could be coincident with the laptop booting up. Does anyone know: whether a port scan can cause the TG582 to restart - is it some sort of protection mechanism? Can anybody get anymore out of the scan warning message and tell me more about it. Could it be an external attack? - These are internal network numbers so that seems unlikely. Any suggestions on what would do a scan like this that might be there on a normal domestic network. and would know the 254 number. I'm not paranoid about this but it would be nice to understand what made my router restart.