cancel
Showing results for 
Search instead for 
Did you mean: 

Could someone kindly explain this.

madswitcher
Pro
Posts: 364
Thanks: 77
Fixes: 1
Registered: ‎01-08-2007

Could someone kindly explain this.

Hi All,

having just got my new Plusnet fibre hub fired up today, I decided to have a look around to see what is what.

Looking at the log file I can see a number of entries of the type

IN: BLOCK [16] Remote administration (TCP [113.190.242.144]:6000-​>[51.7.237.96]:8080 on ppp3)

I assume that this was an attempt at remore administration of my router that was blocked

According to Whois  the IP address is based in Taiwan.  There are also entries from Vietnam and Thailand and they are coming in about every 3 seconds or so - in fact the log file is full of them.

What is going on here, and why is such traffic allowed to roam freely on the Plusnet network?

Kind regards

Mike

1 REPLY 1
VileReynard
Hero
Posts: 12,613
Thanks: 630
Fixes: 20
Registered: ‎01-09-2007

Re: Could someone kindly explain this.

You can set up a server in SE Asia and send perfectly valid data to selected ports on large ranges of internet addresses.

8080 & 80 are ports used by web servers - so its designed to check if you are running a web server.

Its probably a futile attempt to overload a web server with the numbers set up by an idiot.

As I say, its valid traffic although I believe Plusnet have a firewall you can setup and its possible that there is a setting which would allow you to block traffic to port 8080. Don't bother myself.

Unless you have an application that is listening on port 8080, this kind of traffic is totally harmless.

"In The Beginning Was The Word, And The Word Was Aardvark."