Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Hub One Logs - Suspicious activity?
Topic Options
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Printer Friendly Page
- Plusnet Community
- :
- Forum
- :
- Other forums
- :
- Tech Help - Software/Hardware etc
- :
- Hub One Logs - Suspicious activity?
Hub One Logs - Suspicious activity?
11-12-2015 7:14 AM
- Mark as New
- Bookmark
- Subscribe
- Subscribe to RSS Feed
- Highlight
- Report to Moderator
Hi Guys,
Have a new Plusnet Hub One and last night i saw some activity which i was wondering if anyone could interpret?
It seems to be incoming connections aimed at a device that was switched off at the time?
Can anyone make sense of what this may be? (replaced my external IP with ***.***.***.***) also i have no port forwarding set up so maybe UPNP?
Many thanks all
05:15:14, 11 Dec. IN: ACCEPT [57] Connection closed (Port Forwarding: UDP [192.168.1.99]:6889 <--> [***.***.***.***]:6889 - - - [178.93.251.109]:6881 ppp3 NAPT)
05:13:14, 11 Dec. IN: ACCEPT [54] Connection opened (Port Forwarding: UDP [192.168.1.99]:6889 <--> [***.***.***.***]:6889 - - - [178.93.251.109]:6881 ppp3 NAPT)
05:09:26, 11 Dec. IN: ACCEPT [57] Connection closed (Port Forwarding: UDP [192.168.1.99]:6889 <--> [***.***.***.***]]:6889 - - - [137.175.217.57]:9232 ppp3 NAPT)
05:07:26, 11 Dec. IN: ACCEPT [54] Connection opened (Port Forwarding: UDP [192.168.1.99]:6889 <--> [***.***.***.***]:6889 - - - [137.175.217.57]:9232 ppp3 NAPT)
05:00:48, 11 Dec. IN: ACCEPT [57] Connection closed (Port Forwarding: UDP [192.168.1.99]:6889 <-->[***.***.***.***]:6889 - - - [110.142.118.100]:50321 ppp3 NAPT)
04:58:48, 11 Dec. IN: ACCEPT [54] Connection opened (Port Forwarding: UDP [192.168.1.99]:6889 <--> [***.***.***.***]:6889 - - - [110.142.118.100]:50321 ppp3 NAPT)
04:57:30, 11 Dec. IN: ACCEPT [57] Connection closed (Port Forwarding: UDP [192.168.1.99]:6889 <--> [***.***.***.***]:6889 - - - [52.1.199.191]:8618 ppp3 NAPT)
04:57:10, 11 Dec. IN: ACCEPT [57] Connection closed (Port Forwarding: UDP [192.168.1.99]:6889 <--> [***.***.***.***]:6889 - - - [61.150.43.122]:1727 ppp3 NAPT)
04:55:30, 11 Dec. IN: ACCEPT [54] Connection opened (Port Forwarding: UDP [192.168.1.99]:6889 <--> [***.***.***.***]:6889 - - - [52.1.199.191]:8618 ppp3 NAPT)
04:55:11, 11 Dec. IN: ACCEPT [54] Connection opened (Port Forwarding: UDP [192.168.1.99]:6889 <--> [***.***.***.***]:6889 - - - [61.150.43.122]:1727 ppp3 NAPT)
04:52:37, 11 Dec. IN: ACCEPT [57] Connection closed (Port Forwarding: UDP [192.168.1.99]:6889 <--> [***.***.***.***]:6889 - - - [41.37.184.5]:6881 ppp3 NAPT)
04:50:38, 11 Dec. IN: ACCEPT [54] Connection opened (Port Forwarding: UDP [192.168.1.99]:6889 <--> [***.***.***.***]:6889 - - - [41.37.184.5]:6881 ppp3 NAPT)
04:50:12, 11 Dec. IN: ACCEPT [57] Connection closed (Port Forwarding: UDP [192.168.1.99]:6889 <--> [***.***.***.***]:6889 - - - [121.216.47.78]:50348 ppp3 NAPT)
04:48:12, 11 Dec. IN: ACCEPT [54] Connection opened (Port Forwarding: UDP [192.168.1.99]:6889 <--> [***.***.***.***]]:6889 - - - [121.216.47.78]:50348 ppp3 NAPT)
04:38:01, 11 Dec. IN: ACCEPT [57] Connection closed (Port Forwarding: UDP [192.168.1.99]:6889 <--> [***.***.***.***]:6889 - - - [95.56.67.130]:12767 ppp3 NAPT)
04:36:01, 11 Dec. IN: ACCEPT [54] Connection opened (Port Forwarding: UDP [192.168.1.99]:6889 <--> [***.***.***.***]]:6889 - - - [95.56.67.130]:12767 ppp3 NAPT)
04:20:17, 11 Dec. IN: ACCEPT [57] Connection closed (Port Forwarding: UDP [192.168.1.99]:6889 <--> [***.***.***.***]:6889 - - - [202.169.225.52]:58050 ppp3 NAPT)
04:18:17, 11 Dec. IN: ACCEPT [54] Connection opened (Port Forwarding: UDP [192.168.1.99]:6889 <-->[***.***.***.***]:6889 - - - [202.169.225.52]:58050 ppp3 NAPT)
Have a new Plusnet Hub One and last night i saw some activity which i was wondering if anyone could interpret?
It seems to be incoming connections aimed at a device that was switched off at the time?
Can anyone make sense of what this may be? (replaced my external IP with ***.***.***.***) also i have no port forwarding set up so maybe UPNP?
Many thanks all
05:15:14, 11 Dec. IN: ACCEPT [57] Connection closed (Port Forwarding: UDP [192.168.1.99]:6889 <--> [***.***.***.***]:6889 - - - [178.93.251.109]:6881 ppp3 NAPT)
05:13:14, 11 Dec. IN: ACCEPT [54] Connection opened (Port Forwarding: UDP [192.168.1.99]:6889 <--> [***.***.***.***]:6889 - - - [178.93.251.109]:6881 ppp3 NAPT)
05:09:26, 11 Dec. IN: ACCEPT [57] Connection closed (Port Forwarding: UDP [192.168.1.99]:6889 <--> [***.***.***.***]]:6889 - - - [137.175.217.57]:9232 ppp3 NAPT)
05:07:26, 11 Dec. IN: ACCEPT [54] Connection opened (Port Forwarding: UDP [192.168.1.99]:6889 <--> [***.***.***.***]:6889 - - - [137.175.217.57]:9232 ppp3 NAPT)
05:00:48, 11 Dec. IN: ACCEPT [57] Connection closed (Port Forwarding: UDP [192.168.1.99]:6889 <-->[***.***.***.***]:6889 - - - [110.142.118.100]:50321 ppp3 NAPT)
04:58:48, 11 Dec. IN: ACCEPT [54] Connection opened (Port Forwarding: UDP [192.168.1.99]:6889 <--> [***.***.***.***]:6889 - - - [110.142.118.100]:50321 ppp3 NAPT)
04:57:30, 11 Dec. IN: ACCEPT [57] Connection closed (Port Forwarding: UDP [192.168.1.99]:6889 <--> [***.***.***.***]:6889 - - - [52.1.199.191]:8618 ppp3 NAPT)
04:57:10, 11 Dec. IN: ACCEPT [57] Connection closed (Port Forwarding: UDP [192.168.1.99]:6889 <--> [***.***.***.***]:6889 - - - [61.150.43.122]:1727 ppp3 NAPT)
04:55:30, 11 Dec. IN: ACCEPT [54] Connection opened (Port Forwarding: UDP [192.168.1.99]:6889 <--> [***.***.***.***]:6889 - - - [52.1.199.191]:8618 ppp3 NAPT)
04:55:11, 11 Dec. IN: ACCEPT [54] Connection opened (Port Forwarding: UDP [192.168.1.99]:6889 <--> [***.***.***.***]:6889 - - - [61.150.43.122]:1727 ppp3 NAPT)
04:52:37, 11 Dec. IN: ACCEPT [57] Connection closed (Port Forwarding: UDP [192.168.1.99]:6889 <--> [***.***.***.***]:6889 - - - [41.37.184.5]:6881 ppp3 NAPT)
04:50:38, 11 Dec. IN: ACCEPT [54] Connection opened (Port Forwarding: UDP [192.168.1.99]:6889 <--> [***.***.***.***]:6889 - - - [41.37.184.5]:6881 ppp3 NAPT)
04:50:12, 11 Dec. IN: ACCEPT [57] Connection closed (Port Forwarding: UDP [192.168.1.99]:6889 <--> [***.***.***.***]:6889 - - - [121.216.47.78]:50348 ppp3 NAPT)
04:48:12, 11 Dec. IN: ACCEPT [54] Connection opened (Port Forwarding: UDP [192.168.1.99]:6889 <--> [***.***.***.***]]:6889 - - - [121.216.47.78]:50348 ppp3 NAPT)
04:38:01, 11 Dec. IN: ACCEPT [57] Connection closed (Port Forwarding: UDP [192.168.1.99]:6889 <--> [***.***.***.***]:6889 - - - [95.56.67.130]:12767 ppp3 NAPT)
04:36:01, 11 Dec. IN: ACCEPT [54] Connection opened (Port Forwarding: UDP [192.168.1.99]:6889 <--> [***.***.***.***]]:6889 - - - [95.56.67.130]:12767 ppp3 NAPT)
04:20:17, 11 Dec. IN: ACCEPT [57] Connection closed (Port Forwarding: UDP [192.168.1.99]:6889 <--> [***.***.***.***]:6889 - - - [202.169.225.52]:58050 ppp3 NAPT)
04:18:17, 11 Dec. IN: ACCEPT [54] Connection opened (Port Forwarding: UDP [192.168.1.99]:6889 <-->[***.***.***.***]:6889 - - - [202.169.225.52]:58050 ppp3 NAPT)
3 REPLIES 3
Re: Hub One Logs - Suspicious activity?
11-12-2015 1:47 PM
- Mark as New
- Bookmark
- Subscribe
- Subscribe to RSS Feed
- Highlight
- Report to Moderator
UDP over port 6889 is quite often attributed to bittorrent connections.
Do you have any torrent software installed? It probably though, if you are on a non-static IP that someone who used to have your current IP was using torrent software and it's still being broadcast as a possible connection.
Do you have any torrent software installed? It probably though, if you are on a non-static IP that someone who used to have your current IP was using torrent software and it's still being broadcast as a possible connection.
Re: Hub One Logs - Suspicious activity?
11-12-2015 5:23 PM
- Mark as New
- Bookmark
- Subscribe
- Subscribe to RSS Feed
- Highlight
- Report to Moderator
To be honest I have used uTorrent on that system for downloading Linux images so maybe it was that? As i say though the pc was off at the time. I do have a static IP so I can understand how something may have been directing to me for bits of a file but what I dont quite follow is how with 3 separate pc's that have all used bittorrent, the router chose to direct the requests to that one?
Re: Hub One Logs - Suspicious activity?
11-12-2015 6:24 PM
- Mark as New
- Bookmark
- Subscribe
- Subscribe to RSS Feed
- Highlight
- Report to Moderator
Only one computer can use port 6889 on your external IP at any one time, so the router must have stored which computer used port 6889 last.
Topic Options
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Printer Friendly Page
- Plusnet Community
- :
- Forum
- :
- Other forums
- :
- Tech Help - Software/Hardware etc
- :
- Hub One Logs - Suspicious activity?