Your forum username:
Do you already have an account?
Forgot your password?
  • Log in or Sign up


    Welcome to Sky User - The Unofficial Support Forum for everything Sky! - Proudly helping over 65k members.


    Advertisement

    Results 1 to 4 of 4

    Intrusion noticed in log

    This is a discussion on Intrusion noticed in log within the Sky Broadband help forums, part of the Sky Broadband help and support category; I was looking at the system logs as I had noticed the wireless and internet lights flashing on our sagem ...

    1. #1
      QMayberry's Avatar
      QMayberry is offline Sky User Member
      Exchange:
      Broadband ISP: Sky Broadband Unlimited
      Router: Sagem F@ST 2504
      Sky TV: Sky Basic
      Join Date
      Dec 2012
      Posts
      2
      Thanks
      1
      Thanked 0 Times in 0 Posts

      Intrusion noticed in log

      I was looking at the system logs as I had noticed the wireless and internet lights flashing on our sagem router when nothing was apparently accessing it. I found the following, can anyone please tell me what does it mean? I also don't know what type of sagem router we have as it doesn't mention any of the types listed on the skyuser registration details ( I selected one which was the F@ST 2504 , couldn't tell you if it is correct)!

      Dec 29 17:30:16 (none) user.alert kernel: Intrusion -> IN=nas_0_40 OUT= MAC=00:25:69:15:06:de:00:07:72:99:e9:9c:08:00 SRC=186.148.243.167 DST=94.3.28.120 LEN=48 TOS=0x00 PREC=0x00 TTL=105 ID=52311 DF PROTO=TCP SPT=4844 DPT=445 WINDOW=65535 RES=0x00


      Dec 29 17:38:36 (none) user.alert kernel: Intrusion -> IN=nas_0_40 OUT= MAC=00:25:69:15:06:de:00:07:72:99:e9:9c:08:00 SRC=59.67.107.53 DST=94.3.28.120 LEN=44 TOS=0x00 PREC=0x00 TTL=97 ID=256 PROTO=TCP SPT=6000 DPT=3389 WINDOW=16384 RES=0x00 SYN URGP


      Dec 29 17:40:33 (none) user.alert kernel: Intrusion -> IN=nas_0_40 OUT= MAC=00:25:69:15:06:de:00:07:72:99:e9:9c:08:00 SRC=87.97.83.95 DST=94.3.28.120 LEN=48 TOS=0x00 PREC=0x00 TTL=112 ID=30449 DF PROTO=TCP SPT=10164 DPT=445 WINDOW=65535 RES=0x00 SYN


      Dec 29 17:42:44 (none) user.alert kernel: Intrusion -> IN=nas_0_40 OUT= MAC=00:25:69:15:06:de:00:07:72:99:e9:9c:08:00 SRC=89.38.144.184 DST=94.3.28.120 LEN=48 TOS=0x00 PREC=0x00 TTL=113 ID=11928 DF PROTO=TCP SPT=9352 DPT=445 WINDOW=65535 RES=0x00 SY


    2. Advertisement
    3. #2
      Isitme's Avatar
      Isitme is offline Sky User Moderator
      Exchange: Bannockburn
      Broadband ISP: Sky Fibre Unlimited
      Router: Sky Hub SR102
      Sky TV: Sky+ HD
      Join Date
      Dec 2006
      Location
      Central Scotland
      Posts
      34,131
      Thanks
      64
      Thanked 1,641 Times in 1,602 Posts

      Re: Intrusion noticed in log

      It is just your router doing its job, nothing to worry about. You may find the intrusions decrease or disappear if you turn off 'Respond to Ping' on the WAN. Then do a power cycle with the router, which may get you a new IP address.

      TomD


      Please note the views and recommendations in my posts are my own and in no way reflect the views of SkyUser.


      Useful Utilites

      http://www.nirsoft.net/utils/wifi_information_view.html/ TCPOptimiser /Test Socket

      Note - When downloading always select the Custom install or you will end up with stuff you don't want.





    4. #3
      QMayberry's Avatar
      QMayberry is offline Sky User Member
      Exchange:
      Broadband ISP: Sky Broadband Unlimited
      Router: Sagem F@ST 2504
      Sky TV: Sky Basic
      Join Date
      Dec 2012
      Posts
      2
      Thanks
      1
      Thanked 0 Times in 0 Posts

      Re: Intrusion noticed in log

      Thanks for that, I turned off the ping, don't know why it was on in the first place! I also did the power cycle, but it came back with the same ip address.

      So was this from something trying to get into our network or some software trying to get out of our network?

    5. #4
      Isitme's Avatar
      Isitme is offline Sky User Moderator
      Exchange: Bannockburn
      Broadband ISP: Sky Fibre Unlimited
      Router: Sky Hub SR102
      Sky TV: Sky+ HD
      Join Date
      Dec 2006
      Location
      Central Scotland
      Posts
      34,131
      Thanks
      64
      Thanked 1,641 Times in 1,602 Posts

      Re: Intrusion noticed in log

      The 'intrusions' are from other routers probing yours to attempt to get access. The attempts shown in the log you posted were from machines in countries ranging from China to Argentina. There are individuals all over the world who like to try to hack others networks, sometimes for nefarious reasons and sometime just for the fun and challenge of doing it. It may also be possible they are requests coming from P2P networks or maybe even gaming networks. If the P2P client or game is closed when the request is made, the router will reject it. It is one of the big advantages of using a firewall router, if you were not using a router you would be depending on a software firewall to protect you, these are not nearly so effective.

      TomD


      Please note the views and recommendations in my posts are my own and in no way reflect the views of SkyUser.


      Useful Utilites

      http://www.nirsoft.net/utils/wifi_information_view.html/ TCPOptimiser /Test Socket

      Note - When downloading always select the Custom install or you will end up with stuff you don't want.





    6. The Following User Says Thank You to Isitme For This Useful Post:

      QMayberry (01-01-13)

     

     

    Tags for this Thread

    Posting Permissions

    • You may not post new threads
    • You may not post replies
    • You may not post attachments
    • You may not edit your posts
    •  
    SkyUser - Copyright © 2006-2017. SatDish and NewsreadeR | SkyUser is in no way affiliated with Sky Broadband / BSkyB
    RIPA NOTICE: NO CONSENT IS GIVEN FOR INTERCEPTION OF PAGE TRANSMISSION