Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Is this normal? A router - plus - block?
Topic Options
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Printer Friendly Page
- Plusnet Community
- :
- Forum
- :
- Help with my Plusnet services
- :
- Broadband
- :
- Is this normal? A router - plus - block?
Is this normal? A router - plus - block?
13-09-2015 10:28 AM
- Mark as New
- Bookmark
- Subscribe
- Subscribe to RSS Feed
- Highlight
- Report to Moderator
I'm not exactly sure where to ask this but here goes. Every now and then I look in my router's log to see if anything unusual is happening, I notice a lot of DOS attacks, but one I'm not sure about is this:
TCP Packet - Source:192.168.0.3,1891 Destination:ggc02.plus.net,80 - [BLOCK]
Sun, 2015-09-13 06:39:58 - TCP Packet - Source:192.168.0.3,1892 Destination:ggc02.plus.net,80 - [BLOCK]
Sun, 2015-09-13 06:40:08 - TCP Packet - Source:192.168.0.3,1895 Destination:ggc02.plus.net,80 - [BLOCK]
Sun, 2015-09-13 06:40:18 - TCP Packet - Source:192.168.0.3,1896 Destination:ggc02.plus.net,80 - [BLOCK]
Sun, 2015-09-13 06:40:28 - TCP Packet - Source:192.168.0.3,1897 Destination:ggc01.plus.net,80 - [BLOCK]
Sun, 2015-09-13 06:40:38 - TCP Packet - Source:192.168.0.3,1898 Destination:ggc01.plus.net,80 - [BLOCK]
My computer is the 192.168.0.3, when I try and understand this, is my computer trying to send something to plus.net and it gets blocked? My worry is my computer is trying to gain access to something at plus net, as might a virus on my computer.
Basically, do I need to worry?
TCP Packet - Source:192.168.0.3,1891 Destination:ggc02.plus.net,80 - [BLOCK]
Sun, 2015-09-13 06:39:58 - TCP Packet - Source:192.168.0.3,1892 Destination:ggc02.plus.net,80 - [BLOCK]
Sun, 2015-09-13 06:40:08 - TCP Packet - Source:192.168.0.3,1895 Destination:ggc02.plus.net,80 - [BLOCK]
Sun, 2015-09-13 06:40:18 - TCP Packet - Source:192.168.0.3,1896 Destination:ggc02.plus.net,80 - [BLOCK]
Sun, 2015-09-13 06:40:28 - TCP Packet - Source:192.168.0.3,1897 Destination:ggc01.plus.net,80 - [BLOCK]
Sun, 2015-09-13 06:40:38 - TCP Packet - Source:192.168.0.3,1898 Destination:ggc01.plus.net,80 - [BLOCK]
My computer is the 192.168.0.3, when I try and understand this, is my computer trying to send something to plus.net and it gets blocked? My worry is my computer is trying to gain access to something at plus net, as might a virus on my computer.
Basically, do I need to worry?
Message 1 of 3
(1,200 Views)
2 REPLIES 2
Re: Is this normal? A router - plus - block?
13-09-2015 7:02 PM
- Mark as New
- Bookmark
- Subscribe
- Subscribe to RSS Feed
- Highlight
- Report to Moderator
How often does this occur? It looks like an application on your computer is trying to fetch page content directly from those sources. This is just a guess but I wonder if 'ggc' is Google Cloud. Whilst content might be delivered from there probably the requests should be to a different URL.
David
Message 2 of 3
(770 Views)
Re: Is this normal? A router - plus - block?
13-09-2015 8:06 PM
- Mark as New
- Bookmark
- Subscribe
- Subscribe to RSS Feed
- Highlight
- Report to Moderator
ggc01.plus.net and ggc02.plus.net could be pretty much any Google server.
When you lookup the IP address for www.google.co.uk, on Plusnet you might get 212.56.71.240 (and lots of other 212.56.71.XXX IP addresses).
When you do a reverse lookup for 212.56.71.240, you get ggc01.plus.net.
If you try and lookup the IP address for ggc01.plus.net, it's not found, it doesn't work that way round, and doesn't need to.
i.e. when we go to www.google.co.uk, we're accessing ggc01.plus.net
So your computer is trying to access some Google website, but the router is blocking it. Can't tell from the logs why it's being blocked, or if it should be being blocked.
When you lookup the IP address for www.google.co.uk, on Plusnet you might get 212.56.71.240 (and lots of other 212.56.71.XXX IP addresses).
When you do a reverse lookup for 212.56.71.240, you get ggc01.plus.net.
If you try and lookup the IP address for ggc01.plus.net, it's not found, it doesn't work that way round, and doesn't need to.
i.e. when we go to www.google.co.uk, we're accessing ggc01.plus.net
So your computer is trying to access some Google website, but the router is blocking it. Can't tell from the logs why it's being blocked, or if it should be being blocked.
Message 3 of 3
(770 Views)
Topic Options
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Printer Friendly Page
- Plusnet Community
- :
- Forum
- :
- Help with my Plusnet services
- :
- Broadband
- :
- Is this normal? A router - plus - block?