Advertisement
If you have a new account but are having problems posting or verifying your account, please email us on hello@boards.ie for help. Thanks :)
Hello all! Please ensure that you are posting a new thread or question in the appropriate forum. The Feedback forum is overwhelmed with questions that are having to be moved elsewhere. If you need help to verify your account contact hello@boards.ie

Firewall Log

Options
  • 09-07-2011 11:01am
    #1
    PopIT
    Registered Users Posts: 223 ✭✭


    Hey All,
    I have just discovered that my Vodafone router has a log that looks like it logs attempted logins from outside. The log entries look something like this

    Jul 9 08:18:48 kernel warning kernel: [fwlog] Udp bomb attack, SRC=xx.xx.xxx.xxx DST=xxx.xx.xx.xx.

    I took out the IP addresses just in case it was giving my personal information. So far this morning there are about 80 of these mostly with different SRC IP address which I am assuming to be the source IP but from 08:18 to 08:19 there are 10 entries all from the same source. Is this normal?


Comments

  • Options
    #2
    jakedixon2004
    Registered Users Posts: 495 ✭✭jakedixon2004


    Do you have an active Xbox or PS3 connected to that router by any chance?


  • Options
    #3
    PopIT
    Registered Users Posts: 223 ✭✭PopIT


    jakedixon2004 wrote: »
    Do you have an active Xbox or PS3 connected to that router by any chance?

    No I don't. At the time some of the log entries were made there wouldn't have even been a computer on the internet.


  • Options
    #4
    jakedixon2004
    Registered Users Posts: 495 ✭✭jakedixon2004


    PopIT wrote: »
    No I don't. At the time some of the log entries were made there wouldn't have even been a computer on the internet.

    Well then I'm afraid that it might be a remote threat. Can you please make sure that your router has remote management disabled and just make sure it does not have the default login info.


  • Options
    #5
    h57xiucj2z946q
    Closed Accounts Posts: 2,267 ✭✭✭h57xiucj2z946q


    They are just random IP scans.


  • Options
    #6
    PopIT
    Registered Users Posts: 223 ✭✭PopIT


    Leslie Disgusting Manuscript wrote: »
    They are just random IP scans.

    If someone had managed to access my router remotely would it show up on my firewall log as a specific entry?


  • Advertisement
  • Options
    #7
    h57xiucj2z946q
    Closed Accounts Posts: 2,267 ✭✭✭h57xiucj2z946q


    Most likely yeah.

    Chances your seeing some activity in your log is due to scanners/malware scanning for vulnerable hosts. Its fine to just ignore it. Looks like your router blocks it anyway.


Advertisement