cancel
Showing results for 
Search instead for 
Did you mean: 

Is this normal? A router - plus - block?

moreofthesame
Grafter
Posts: 25
Registered: ‎13-11-2009

Is this normal? A router - plus - block?

I'm not exactly sure where to ask this but here goes. Every now and then I look in my router's log to see if anything unusual is happening, I notice a lot of DOS attacks, but one I'm not sure about is this:
TCP Packet - Source:192.168.0.3,1891 Destination:ggc02.plus.net,80 - [BLOCK]
Sun, 2015-09-13 06:39:58 - TCP Packet - Source:192.168.0.3,1892 Destination:ggc02.plus.net,80 - [BLOCK]
Sun, 2015-09-13 06:40:08 - TCP Packet - Source:192.168.0.3,1895 Destination:ggc02.plus.net,80 - [BLOCK]
Sun, 2015-09-13 06:40:18 - TCP Packet - Source:192.168.0.3,1896 Destination:ggc02.plus.net,80 - [BLOCK]
Sun, 2015-09-13 06:40:28 - TCP Packet - Source:192.168.0.3,1897 Destination:ggc01.plus.net,80 - [BLOCK]
Sun, 2015-09-13 06:40:38 - TCP Packet - Source:192.168.0.3,1898 Destination:ggc01.plus.net,80 - [BLOCK]
My computer is the 192.168.0.3, when I try and understand this, is my computer trying to send something to plus.net and it gets blocked? My worry is my computer is trying to gain access to something at plus net, as might a virus on my computer.
Basically, do I need to worry?
2 REPLIES 2
spraxyt
Resting Legend
Posts: 10,063
Thanks: 674
Fixes: 75
Registered: ‎06-04-2007

Re: Is this normal? A router - plus - block?

How often does this occur? It looks like an application on your computer is trying to fetch page content directly from those sources. This is just a guess but I wonder if 'ggc' is Google Cloud. Whilst content might be delivered from there probably the requests should be to a different URL.
David
ejs
Aspiring Hero
Posts: 5,442
Thanks: 631
Fixes: 25
Registered: ‎10-06-2010

Re: Is this normal? A router - plus - block?

ggc01.plus.net and ggc02.plus.net could be pretty much any Google server.
When you lookup the IP address for www.google.co.uk, on Plusnet you might get 212.56.71.240 (and lots of other 212.56.71.XXX IP addresses).
When you do a reverse lookup for 212.56.71.240, you get ggc01.plus.net.
If you try and lookup the IP address for ggc01.plus.net, it's not found, it doesn't work that way round, and doesn't need to.
i.e. when we go to www.google.co.uk, we're accessing ggc01.plus.net
So your computer is trying to access some Google website, but the router is blocking it. Can't tell from the logs why it's being blocked, or if it should be being blocked.