What does this entry in the log mean?

[mattan]

Hi,

I've noticed the following in the log appear many times a day and every day since I've migrated to Sky broadband (just under 2 weeks). Can you tell me what this is as I've never seen this with my previous ISP.

Oct 16 20:38:36 (none) user.alert kernel: Intrusion -> IN=atm0 OUT= MAC=4c:17:eb:b7:50:f3:00:07:72:cc:86:f2:08:00 src=219.145.124.10 DST=2.218.223.22 LEN=48 TOS=0x00 PREC=0x00 TTL=235 ID=59080 DF PROTO=TCP SPT=8888 DPT=8080 WINDOW=16384 RES=0x00 SYN URGP=0 MARK=0x8000000

The "SRC" is not always the same, the above seems to be originating in China!! Looks like the firewall is blocking an intrusion?

Thanks

[NewsreadeR]

The firewall is doing its job, looks like you are being probed by a bot or similar.

[mattan]

The firewall is doing its job, looks like you are being probed by a bot or similar.

Sounds painful!

This must be happening on a range of Sky's IP addresses as I noticed these entries from day 1. Is there anything Sky can do in this case?

[NewsreadeR]

No - It happens on any ISP

Basically it is a rogue network trying to attack your PC etc - It justs spends all day looking for open doors. The Sky router has none by default so it will just move onto scanning a whole range of IP addess etc

Nothing to worry about and nothing you can do.

[speedyrite]

Actually you can change the router logging options to suppress these events from appearing (obviously won't stop them happening though!)

I may be mis-remembering but I think there were more settings on the old Netgear V1Sky router to configure what events were logged and it was possible to suppress logging of these events, but I noticed during my brief initial usage of the 2504n that there were fewer settings and it was not possible to suppress just those events without suppressing other events which were of interest.

[mattan]

There's very little in the way of suppressing events, other than the ones that show the connection going up/down.

[speedyrite]

There's very little in the way of suppressing events, other than the ones that show the connection going up/down.

I think that's the setting to change to suppress the logging of these attempted intrusions, but unfortunately that then also suppresses logging of other things thay may be if interest.

[itype]

These was an option on the V1 where you could tick a box that stopped the router from logging port scans and DOS attacks. All the current routers are missing this router, at least on my DG934G it is. Not sure on the Sagem. Chances are there won't be an option to do so.

[NewsreadeR]

There is not a lot of choice in the Sagem 2504n

[speedyrite]

These was an option on the V1 where you could tick a box that stopped the router from logging port scans and DOS attacks. All the current routers are missing this router, at least on my DG934G it is. Not sure on the Sagem. Chances are there won't be an option to do so.

Ah yes that's the option I was thinking of!