0

I found this in the logs of my router

Intrusion -> SRC=198.20.70.114 DST=(here was my own ip) LEN=44 TOS=0x00 PREC=0x00 TTL=111 ID=43361 PROTO=TCP SPT=1940 DPT=49152 WINDOW=34917 RES=0x00 SYNURGP=0

I went to check IP geolocation to see if it's just my own IP or something and here is the result https://gyazo.com/9edf54b3e052a43316c2f8bdaaa75b5b

What is this? I live in Finland and I got this warning of intrusion from Chicago? The weird thing is, as I noticed this when I was just exploring the logs and found this, it got removed like 5 mins after I saw it? Sometimes my ping went to 600-700 when I was not doing anything on my internet except playing a game that shows ping, and I was home alone, not downloading anything. Is someone using my internet?

Should I be worried about this?

Also there is something like this CWMP:Cwmp post inform success.

IPPing diagnostic is complete.

CWMP inform message: event: 8 DIAGNOSTICS COMPLETE.

CWMP:Cwmp post inform success.

User ACS(195.197.95.135) modify IPPingDiagnostics.Host,IPPingDiagnostics.NumberOfRepetitions,IPPingDiagnostics.Timeout,IPPingDiagnostics.DataBlockSize,IPPingDiagnostics.DiagnosticsState

Detect UDP port scan attack, scan packet from 192.168.100.14.
  • 3
    Just normal "background radiation" of the Intenet. Everyone gets stuff like this. – schroeder Aug 12 '18 at 17:23
  • If you are worried about your bandwidth, use control panel to find out from which application it comes from. It is very probably just a background update from one of your installed software. – Xavier59 Aug 12 '18 at 18:44
  • @Xavier59 how can i do that to find out which application it comes from? – helpme123 Aug 12 '18 at 19:51
  • @helpme123 depending of your exploitation system there is usually a preinstalled application which allows you to see bandwidth used by applications. This is the task manager on Windows and the activity monitor on macOS for example. – Xavier59 Aug 12 '18 at 20:04
1

This can be just something like a system inside your network doing auto-update. You already have the clue.

PROTO=TCP SPT=1940 DPT=49152

Searching source port will give you the agent which is jetVision client.

http://www.adminsub.net/tcp-udp-port-finder/1940

If still you really feel that it is some form of intrusion or its not the jetVision client then try to isolate this source agent to identify where its from your home network by doing the following.

  • Isolate your router, disconnect all devices to your router and see if this intrusion log is still reflecting. If there is then your router is the culprit, check manuals for any references to this source port.
  • If the intrusion log is no longer reflecting after you disconnect all devices to your router, then connect one device at a time and check for the intrusion log again.
  • At the end congrats yourself, you just did a forensic investigation.
  • Thanks for your answer,but i dont know anything about this stuff you just explained sadly, so i doubt i could manage to do such investigation myself .I dont even know what jetVision client is and i dont have such thing downloaded on any of my devices. I hope it isnt an intrusion the location just weirded me out because i live in EU and it came from Chicago. – helpme123 Aug 13 '18 at 1:02
  • did you already isolate your router and check logs? what is the brand and model of your router if you mind me asking. – Winnnn Aug 13 '18 at 2:27
0

No, you should not be worried because everyone gets stuff like this all the time and it looks like your router handled the problem.

The log says SRC= which is where the traffic is coming from, and these events come from all over the world. That does not mean someone is using your Internet. It means someone is trying to connect to whatever might be listening on your IP. Nothing in your own home needs to be even turned on for people from the outside to try to connect to things. You do not need to be home for someone to knock on your front door.

The worry should start if you see this traffic coming inside your network, and that will take some tools to install and some technical knowledge to set up. But because your router is alerting on them, you can assume that it is blocking them, but confirm with the router manual or your router's vendor's support.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.