Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

My home broadband connection has been up and down all day, I took a look at the router logs and saw the following:

Mar 27 12:22:30  kernel: Intrusion -> IN=atm1 OUT= MAC=34:08:04:00:08:35:18:80:f5:97:9e:98:08:00 SRC=92.48.122.218 DST=x.x.x.x LEN=48 TOS=0x00 PREC=0x00 TTL=123 ID=64889 PROTO=TCP SPT=23431 DPT=3306 WINDOW=65535 RES=0x00 SYN U
Mar 27 12:36:57  kernel: Intrusion -> IN=atm1 OUT= MAC=34:08:04:00:08:35:18:80:f5:97:9e:98:08:00 SRC=78.101.248.169 DST=x.x.x.x LEN=52 TOS=0x00 PREC=0x00 TTL=119 ID=13193 DF PROTO=TCP SPT=58734 DPT=51413 WINDOW=8192 RES=0x00 S
Mar 27 12:39:47  kernel: Intrusion -> IN=atm1 OUT= MAC=34:08:04:00:08:35:18:80:f5:97:9e:98:08:00 SRC=78.101.248.169 DST=x.x.x.x LEN=52 TOS=0x00 PREC=0x00 TTL=119 ID=16952 DF PROTO=TCP SPT=59817 DPT=51413 WINDOW=8192 RES=0x00 S
Mar 27 12:51:23  kernel: Intrusion -> IN=atm1 OUT= MAC=34:08:04:00:08:35:18:80:f5:97:9e:98:08:00 SRC=69.50.194.41 DST=x.x.x.x LEN=48 TOS=0x00 PREC=0x00 TTL=118 ID=14530 PROTO=TCP SPT=35855 DPT=22 WINDOW=65535 RES=0x00 SYN URGP
Mar 27 13:09:25  kernel: Intrusion -> IN=atm1 OUT= MAC=34:08:04:00:08:35:18:80:f5:97:9e:98:08:00 SRC=222.186.52.77 DST=x.x.x.x LEN=40 TOS=0x00 PREC=0x00 TTL=97 ID=256 PROTO=TCP SPT=6000 DPT=1433 WINDOW=16384 RES=0x00 SYN URGP=
Mar 27 13:32:24  kernel: Intrusion -> IN=atm1 OUT= MAC=34:08:04:00:08:35:18:80:f5:97:9e:98:08:00 SRC=203.156.207.196 DST=x.x.x.x LEN=40 TOS=0x00 PREC=0x00 TTL=96 ID=256 PROTO=TCP SPT=6000 DPT=1000 WINDOW=16384 RES=0x00 SYN URG
Mar 27 13:45:58  kernel: Intrusion -> IN=atm1 OUT= MAC=34:08:04:00:08:35:18:80:f5:97:9e:98:08:00 SRC=60.12.160.66 DST=x.x.x.x LEN=40 TOS=0x00 PREC=0x00 TTL=104 ID=256 PROTO=TCP SPT=46684 DPT=1433 WINDOW=16384 RES=0x00 SYN URGP
Mar 27 14:25:37  kernel: Intrusion -> IN=atm1 OUT= MAC=34:08:04:00:08:35:18:80:f5:97:9e:98:08:00 SRC=85.114.129.177 DST=x.x.x.x LEN=48 TOS=0x00 PREC=0x00 TTL=121 ID=3057 PROTO=TCP SPT=8473 DPT=3389 WINDOW=65535 RES=0x00 SYN UR
Mar 27 15:04:52  kernel: Intrusion -> IN=atm1 OUT= MAC=34:08:04:00:08:35:18:80:f5:97:9e:98:08:00 SRC=60.173.14.89 DST=x.x.x.x LEN=40 TOS=0x00 PREC=0x00 TTL=99 ID=256 PROTO=TCP SPT=6000 DPT=8909 WINDOW=16384 RES=0x00 SYN URGP=0
Mar 27 15:28:40  kernel: eth3 Link UP 100 mbps full duplex
Mar 27 15:28:50  kernel: eth3 Link DOWN.
Mar 27 15:28:51  kernel: eth3 Link UP 100 mbps full duplex
Mar 27 15:30:25  kernel: eth3 Link DOWN.
Mar 27 15:45:12  kernel: Intrusion -> IN=atm1 OUT= MAC=34:08:04:00:08:35:18:80:f5:97:9e:98:08:00 SRC=124.119.118.223 DST=x.x.x.x LEN=40 TOS=0x00 PREC=0x00 TTL=100 ID=47265 PROTO=TCP SPT=6000 DPT=3389 WINDOW=16384 RES=0x00 SYN 
Mar 27 16:02:39  kernel: Intrusion -> IN=atm1 OUT= MAC=34:08:04:00:08:35:18:80:f5:97:9e:98:08:00 SRC=2.95.45.184 DST=x.x.x.x LEN=64 TOS=0x00 PREC=0x00 TTL=42 ID=34542 DF PROTO=TCP SPT=1583 DPT=135 WINDOW=53760 RES=0x00 SYN URG
Mar 27 16:06:11  kernel: Intrusion -> IN=atm1 OUT= MAC=34:08:04:00:08:35:18:80:f5:97:9e:98:08:00 SRC=58.194.171.217 DST=x.x.x.x LEN=60 TOS=0x00 PREC=0x00 TTL=45 ID=61983 DF PROTO=TCP SPT=52273 DPT=3389 WINDOW=5840 RES=0x00 SYN
Mar 27 16:09:45  kernel: Intrusion -> IN=atm1 OUT= MAC=34:08:04:00:08:35:18:80:f5:97:9e:98:08:00 SRC=2.192.224.130 DST=x.x.x.x LEN=64 TOS=0x00 PREC=0x00 TTL=31 ID=14217 DF PROTO=TCP SPT=1052 DPT=445 WINDOW=65535 RES=0x00 SYN U
Mar 27 16:46:01  kernel: Intrusion -> IN=atm1 OUT= MAC=34:08:04:00:08:35:18:80:f5:97:9e:98:08:00 SRC=24.64.84.167 DST=x.x.x.x LEN=64 TOS=0x00 PREC=0x00 TTL=48 ID=29798 DF PROTO=TCP SPT=59723 DPT=51413 WINDOW=65535 RES=0x00 SYN
Mar 27 16:46:03  kernel: Intrusion -> IN=atm1 OUT= MAC=34:08:04:00:08:35:18:80:f5:97:9e:98:08:00 SRC=24.64.84.167 DST=x.x.x.x LEN=64 TOS=0x00 PREC=0x00 TTL=48 ID=2404 DF PROTO=TCP SPT=59723 DPT=51413 WINDOW=65535 RES=0x00 SYN 
Mar 27 16:59:48  kernel: Intrusion -> IN=atm1 OUT= MAC=34:08:04:00:08:35:18:80:f5:97:9e:98:08:00 SRC=61.176.192.164 DST=x.x.x.x LEN=40 TOS=0x00 PREC=0x00 TTL=104 ID=256 PROTO=TCP SPT=6000 DPT=1433 WINDOW=16384 RES=0x00 SYN URG
Mar 27 17:28:42  kernel: Intrusion -> IN=atm1 OUT= MAC=34:08:04:00:08:35:18:80:f5:97:9e:98:08:00 SRC=89.119.20.254 DST=x.x.x.x LEN=60 TOS=0x00 PREC=0x00 TTL=54 ID=6972 DF PROTO=TCP SPT=3522 DPT=23 WINDOW=5840 RES=0x00 SYN URGP
Mar 27 17:29:28  kernel: Intrusion -> IN=atm1 OUT= MAC=34:08:04:00:08:35:18:80:f5:97:9e:98:08:00 SRC=122.176.158.232 DST=x.x.x.x LEN=48 TOS=0x00 PREC=0x00 TTL=120 ID=2025 DF PROTO=TCP SPT=13851 DPT=443 WINDOW=65535 RES=0x00 SY
Mar 27 17:29:29  kernel: Intrusion -> IN=atm1 OUT= MAC=34:08:04:00:08:35:18:80:f5:97:9e:98:08:00 SRC=72.48.98.17 DST=x.x.x.x LEN=52 TOS=0x00 PREC=0x00 TTL=118 ID=14331 DF PROTO=TCP SPT=52695 DPT=10261 WINDOW=8192 RES=0x00 SYN 
Mar 27 17:29:31  kernel: Intrusion -> IN=atm1 OUT= MAC=34:08:04:00:08:35:18:80:f5:97:9e:98:08:00 SRC=122.176.158.232 DST=x.x.x.x LEN=48 TOS=0x00 PREC=0x00 TTL=120 ID=2030 DF PROTO=TCP SPT=13851 DPT=443 WINDOW=65535 RES=0x00 SY
Mar 27 17:29:32  kernel: Intrusion -> IN=atm1 OUT= MAC=34:08:04:00:08:35:18:80:f5:97:9e:98:08:00 SRC=72.48.98.17 DST=x.x.x.x LEN=52 TOS=0x00 PREC=0x00 TTL=118 ID=14805 DF PROTO=TCP SPT=52695 DPT=10261 WINDOW=8192 RES=0x00 SYN 
Mar 27 17:29:34  kernel: Intrusion -> IN=atm1 OUT= MAC=34:08:04:00:08:35:18:80:f5:97:9e:98:08:00 SRC=110.23.234.109 DST=x.x.x.x LEN=64 TOS=0x00 PREC=0x00 TTL=49 ID=36150 DF PROTO=TCP SPT=53042 DPT=55802 WINDOW=65535 RES=0x00 S
Mar 27 17:35:36  kernel: Intrusion -> IN=atm1 OUT= MAC=34:08:04:00:08:35:18:80:f5:97:9e:98:08:00 SRC=86.68.142.70 DST=x.x.x.x LEN=52 TOS=0x00 PREC=0x00 TTL=115 ID=11838 DF PROTO=TCP SPT=49527 DPT=55802 WINDOW=8192 RES=0x00 SYN
Mar 27 17:35:39  kernel: Intrusion -> IN=atm1 OUT= MAC=34:08:04:00:08:35:18:80:f5:97:9e:98:08:00 SRC=79.175.234.127 DST=x.x.x.x LEN=52 TOS=0x00 PREC=0x00 TTL=114 ID=4333 DF PROTO=TCP SPT=49424 DPT=80 WINDOW=8192 RES=0x00 SYN U
Mar 27 17:47:42  kernel: Intrusion -> IN=atm1 OUT= MAC=34:08:04:00:08:35:18:80:f5:97:9e:98:08:00 SRC=68.83.96.247 DST=x.x.x.x LEN=52 TOS=0x00 PREC=0x00 TTL=113 ID=9254 DF PROTO=TCP SPT=60863 DPT=55802 WINDOW=8192 RES=0x00 SYN 
Mar 27 17:47:43  kernel: Intrusion -> IN=atm1 OUT= MAC=34:08:04:00:08:35:18:80:f5:97:9e:98:08:00 SRC=87.68.235.165 DST=x.x.x.x LEN=60 TOS=0x00 PREC=0x00 TTL=54 ID=38465 DF PROTO=TCP SPT=64092 DPT=80 WINDOW=5840 RES=0x00 SYN UR
Mar 27 17:47:45  kernel: Intrusion -> IN=atm1 OUT= MAC=34:08:04:00:08:35:18:80:f5:97:9e:98:08:00 SRC=213.130.198.69 DST=x.x.x.x LEN=52 TOS=0x00 PREC=0x00 TTL=44 ID=9364 DF PROTO=TCP SPT=3486 DPT=443 WINDOW=65535 RES=0x00 SYN U

The IP address the attack is coming from changes every time, but the MAC does not. Is this relevant? From the above, all I can read is the IP address and the fact that this is a Kernel Intrusion event. Is there more information here that I am missing? What is my risk to this, if it is some sort of an attack?

share|improve this question
    
What is your router? A linux box or an appliance (linksys, d-link, etc.)? –  schroeder Mar 27 '12 at 20:56
    
An appliance, bargain basement broadband using the default router supplied! –  JMK Mar 27 '12 at 21:10
add comment

2 Answers 2

up vote 6 down vote accepted

The logging facility that is reporting

kernel:

Notice this message:

Mar 27 15:28:40  kernel: eth3 Link UP 100 mbps full duplex

So, kernel is saying that eth3 change. Therefore, the kernel is reporting "Intrusion," rather than you seeing a kernel intrusion.

Intrusion -> IN=atm1 OUT= MAC=34:08:04:00:08:35:18:80:f5:97:9e:98:08:00 SRC=213.130.198.69 DST=x.x.x.x LEN=52 TOS=0x00 PREC=0x00 TTL=44 ID=9364 DF PROTO=TCP SPT=3486 DPT=443 WINDOW=65535 RES=0x00 SYN U

That there is an iptables log message, probably generated by an iptables rule. The mac address is always the same because it's an outside address, so it always transits the same layer 2 link... probably your cable modem or the like. It does say the inbound interface is ATM, so maybe you have a very fancy home broadband link?

You probably have an iptables rule near the end of your chain that logs all traffic coming in... I'm guessing something like this:

iptables -A INPUT -j LOG --log-prefix 'Intrusion -> '

Check out iptables -L -v and see what you find. Odds are you don't want to log every single packet that isn't accepted on a public IP. There's a lot of random traffic out there.

Good link for reference: http://www.cyberciti.biz/tips/force-iptables-to-log-messages-to-a-different-log-file.html

share|improve this answer
add comment

I'm assuming it's a router appliance.

The destination ports are all over the place, and the source ports are all over the place (high port ranges), so it looks like scan activity.

The MAC won't change because it will be up the upstream (ISP) router.

It just looks like normal background noise of the internet. The 'Intrusion' part looks scary, but it's a default message with off-the shelf routers indicating an intrusion attempt.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.