When checking my router tonight I looked at its security log. I saw thousands of blocked tcp traffic. Why are these considered security events? The log shows many blocked tcp incoming request from many different ips and on different ports. Here is one example below: TCP Blocked Connection On Security Log

Does a log fill up with thousands of blocked tcp events like this through normal internet surfing or is this something to be more concerned about? Or does this just mean the router's firewall is just doing its job and logs every time it receives tcp traffic inbound that I did not initiate?

(As a side note I did find UPnP was on and Wifi Protected Setup was on too by default, so I turned those off)


You don't have to worry about this logs. Anything connected to the internet will receive lots and lots of connection attempts every day, from random scans, bots, and security researchers.

Just configure the router to deny WAN access and you will be protected from the vast majority of the attacks. And your router will generally rotate the logs when they grow past a defined threshold, so its storage will not fill up with logs.

| improve this answer | |

Looks like you need to reconsider the configuration of the router, policies, rules, logs and so on. If you have many entries of that type on your log it is because of a reason, port scanning, IP rule, or a misconfiguration of the router. On the other hand, you need to consider that on outbound interfaces (interfaces that are plugged to the Internet) are full of bad/anomalous traffic that it would be good idea to pre-filter on your eth0 device.

| improve this answer | |
  • There is nothing in that log that suggests that there is a misconfiguration of the router. Can you explain what needs to be reconfigured? – schroeder May 26 '19 at 11:15

SPT (source port) is 443, probably the rest of yours are too, as are the ones in my log, which looks very similar to yours. This is HTTPS. Much of this is likely web crawler traffic and nothing to worry about in general.

| improve this answer | |
  • As a source port, it's not going to be crawlers. port 443 is the port that HTTPS is served on. In this example, something would have to be served by the router at port 50175. This log looks like an HTTPS reply. – schroeder May 26 '19 at 11:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.