I am logging my home router's firewall. It gives a lot of entries like these:

 07:17:00.157793 IP > SYSLOG local0.alert, length: 136
 07:17:00.755564 IP > SYSLOG local0.alert, length: 136
 07:17:00.918577 IP > SYSLOG local0.alert, length: 136
 07:17:02.746611 IP > SYSLOG local0.alert, length: 136 is my router. It seems unlikely my router would make these queries by itself. How do I find out where it is coming from and (what) should I do something about it?

  • You configure your router to send syslog messages to and then you think that your router would not be sending things to by itself? This makes no sense. What I think you are looking for is to understand what the different fields are in the log. From your comment below, serialgateway is the source port that the router is sending syslog messages from. This makes this not a security question, but simply a TCP basics question.
    – schroeder
    May 6, 2019 at 10:02
  • 2
    You are not understanding the facts so you are assuming the worst instead of systematically understanding what you are seeing. So much so, you posted on an information security site. You assumed "querying", dictionary attacks", and that 10,000 entries is relevant. These are an overraction (a freak out).
    – schroeder
    May 6, 2019 at 12:29
  • 1
    Please, please, just google TCP/IP source ports as I have said from the beginning.
    – schroeder
    May 6, 2019 at 12:29
  • 1
    That's fine. You asked a non-security question on a security site, that's all.
    – schroeder
    May 6, 2019 at 12:34
  • 2
    and I explained that part
    – schroeder
    May 6, 2019 at 12:55

1 Answer 1


Your router is sending these packets itself. They contain log messages. The syslog protocol is generally used to record the logs from several devices on a central server.

Your router has been configured to send log messages to You should find a page somewhere in the router's web UI to allow you to change the address or disable syslog entirely.

.serialgateway, .payrouter, .isbconference1, .isbconference2, etc. is the name of the source port. Usually source port numbers are chosen randomly (only the destination port really matters). The program you are using to capture the data is looking up which protocol normally uses those ports and displaying that instead of the number. Apparently the "random" ports your router is sending packets from, are the ports typically used by some other protocols. There is no security problem with that.

  • what are the .payrouter, .isbconference1, .isbconerence 2, (1000's of these) etc. ? It looks like something is running a dictionary on my router or something (I enabled this logging myself) May 6, 2019 at 7:51
  • @JuliusBaer I updated the answer.
    – user253751
    May 6, 2019 at 21:46

Not the answer you're looking for? Browse other questions tagged .