-1

screenshot

I am logging my home router's firewall. It gives a lot of entries like these:

 07:17:00.157793 IP 192.168.178.1.serialgateway > 192.168.178.10.syslog: SYSLOG local0.alert, length: 136
 07:17:00.755564 IP 192.168.178.1.isbconference1 > 192.168.178.10.syslog: SYSLOG local0.alert, length: 136
 07:17:00.918577 IP 192.168.178.1.isbconference2 > 192.168.178.10.syslog: SYSLOG local0.alert, length: 136
 07:17:02.746611 IP 192.168.178.1.payrouter > 192.168.178.10.syslog: SYSLOG local0.alert, length: 136

192.168.178.1 is my router. It seems unlikely my router would make these queries by itself. How do I find out where it is coming from and (what) should I do something about it?

closed as off-topic by Jeroen - IT Nerdbox, schroeder May 6 at 9:55

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – schroeder
If this question can be reworded to fit the rules in the help center, please edit the question.

  • You configure your router to send syslog messages to 192.168.178.10 and then you think that your router would not be sending things to 192.168.178.10 by itself? This makes no sense. What I think you are looking for is to understand what the different fields are in the log. From your comment below, serialgateway is the source port that the router is sending syslog messages from. This makes this not a security question, but simply a TCP basics question. – schroeder May 6 at 10:02
  • why does serialgateway change 1000's of times as if it is running through a dictionary? it seems to be querying the source port from a dictionary to my PC, that's my question then – Julius Baer May 6 at 12:14
  • Again, this is purely a TCP basics question. Source ports are random. Please look up "TCP source port" on Google. And look at the log. Don't just freak out. Look at each field and see what it is telling you. Your router is connecting to your syslog server. There is no "querying" of anything. And all those 1000's of things are on your router's side, not your PC's side. – schroeder May 6 at 12:15
  • you mean they are named? I thought only numbered – Julius Baer May 6 at 12:17
  • Many ports have common services that run on them, so whatever is generating the log is replacing the number with the common service on that port. – schroeder May 6 at 12:18
1

Your router is sending these packets itself. They contain log messages. The syslog protocol is generally used to record the logs from several devices on a central server.

Your router has been configured to send log messages to 192.168.178.10. You should find a page somewhere in the router's web UI to allow you to change the address or disable syslog entirely.

.serialgateway, .payrouter, .isbconference1, .isbconference2, etc. is the name of the source port. Usually source port numbers are chosen randomly (only the destination port really matters). The program you are using to capture the data is looking up which protocol normally uses those ports and displaying that instead of the number. Apparently the "random" ports your router is sending packets from, are the ports typically used by some other protocols. There is no security problem with that.

  • what are the .payrouter, .isbconference1, .isbconerence 2, (1000's of these) etc. ? It looks like something is running a dictionary on my router or something (I enabled this logging myself) – Julius Baer May 6 at 7:51
  • @JuliusBaer I updated the answer. – immibis May 6 at 21:46

Not the answer you're looking for? Browse other questions tagged or ask your own question.