cancel
Showing results for 
Search instead for 
Did you mean: 

Scary Stuff in My Router Log

lowercase
Dabbler
Posts: 21
Registered: ‎14-02-2010

Scary Stuff in My Router Log

I have my router (Netgear DG834G) set up to email me logs every few days.  But recently I've been seeing some worrying things in the form of a  "NETGEAR *Security Alert* [b2:ec:c5]"  One email from this morning contains this:
UDP Packet - Source:82.39.72.122,6146 Destination:87.XXXXXXXX - [DOS]
TCP Packet - Source:68.53.159.141,3870 Destination:87.XXXXXXX - [DOS]
UDP Packet - Source:24.222.6.190,10070 Destination:87.XXXXXXX - [DOS]
The 87. "i think" is my IP address? so I didnt include it in the message.  One from last night had about 20 of these.
What is this?  Does it mean someone is trying to access my PC...should I be worried?  It has only recently started, I havent seen it before in the nearly 7 years i've had the router.
5 REPLIES 5
JayG
Pro
Posts: 1,145
Thanks: 143
Fixes: 6
Registered: ‎30-10-2011

Re: Scary Stuff in My Router Log

I believe it is an indication that your Netgear firewall is successfully doing its job of blocking attempted DOS attacks (I get short bursts of them from time to time and then none for weeks on end...........)
adamwalker
Plusnet Help Team
Plusnet Help Team
Posts: 16,885
Thanks: 883
Fixes: 221
Registered: ‎27-04-2007

Re: Scary Stuff in My Router Log

I'd only be concerned if these start to appear on a regular basis, they do seem to be from different origins with the first IP being on Virgin Media's network.
If this post resolved your issue please click the 'This fixed my problem' button
 Adam Walker
 Plusnet Help Team
Gus
Aspiring Pro
Posts: 3,240
Thanks: 32
Fixes: 3
Registered: ‎31-07-2007

Re: Scary Stuff in My Router Log

You can get that if you have used a p2p program recently and its turned off, anyone that has had a connection to your pc will have your IP saved until its flushed over time.  So you will get repeated attempts for its attempts to handshake looking for a connection.
But anyway have a look in your routers security settings for "Block Ping from Internet" or similar and enable it., as by those logs if you are not a p2p user then it could be someone is using infected pc's trying to find an insecure router/pc/webserver to infect.  If they can't See your router they can't.
FTTP 500 regrade from Tues 28th November
lowercase
Dabbler
Posts: 21
Registered: ‎14-02-2010

Re: Scary Stuff in My Router Log

Quote from: _Adam_Walker_
I'd only be concerned if these start to appear on a regular basis, they do seem to be from different origins with the first IP being on Virgin Media's network.

They do appear regularly  Shocked  Several dozen since December.   I had 5 email logs from the router yesterday, with about 100 of those in total.
I've never used p2p, you mean fileshareing?
Gus
Aspiring Pro
Posts: 3,240
Thanks: 32
Fixes: 3
Registered: ‎31-07-2007

Re: Scary Stuff in My Router Log

Yes file sharing, but you can be using it and not know it.  Some games when patching offload the bandwidth on to your connection, steam uses it for near enough all its games if you don't turn it off.  Plus a recent update to flash player has added a new p2p option, no idea where it is used but its there for a reason.
FTTP 500 regrade from Tues 28th November