-2

screenshot

I am logging my home router's firewall. It gives a lot of entries like these:

 07:17:00.157793 IP 192.168.178.1.serialgateway > 192.168.178.10.syslog: SYSLOG local0.alert, length: 136
 07:17:00.755564 IP 192.168.178.1.isbconference1 > 192.168.178.10.syslog: SYSLOG local0.alert, length: 136
 07:17:00.918577 IP 192.168.178.1.isbconference2 > 192.168.178.10.syslog: SYSLOG local0.alert, length: 136
 07:17:02.746611 IP 192.168.178.1.payrouter > 192.168.178.10.syslog: SYSLOG local0.alert, length: 136

192.168.178.1 is my router. It seems unlikely my router would make these queries by itself. How do I find out where it is coming from and (what) should I do something about it?

  • You configure your router to send syslog messages to 192.168.178.10 and then you think that your router would not be sending things to 192.168.178.10 by itself? This makes no sense. What I think you are looking for is to understand what the different fields are in the log. From your comment below, serialgateway is the source port that the router is sending syslog messages from. This makes this not a security question, but simply a TCP basics question. – schroeder May 6 '19 at 10:02
  • 1
    You are not understanding the facts so you are assuming the worst instead of systematically understanding what you are seeing. So much so, you posted on an information security site. You assumed "querying", dictionary attacks", and that 10,000 entries is relevant. These are an overraction (a freak out). – schroeder May 6 '19 at 12:29
  • 1
    Please, please, just google TCP/IP source ports as I have said from the beginning. – schroeder May 6 '19 at 12:29
  • 1
    That's fine. You asked a non-security question on a security site, that's all. – schroeder May 6 '19 at 12:34
  • 1
    and I explained that part – schroeder May 6 '19 at 12:55
1

Your router is sending these packets itself. They contain log messages. The syslog protocol is generally used to record the logs from several devices on a central server.

Your router has been configured to send log messages to 192.168.178.10. You should find a page somewhere in the router's web UI to allow you to change the address or disable syslog entirely.

.serialgateway, .payrouter, .isbconference1, .isbconference2, etc. is the name of the source port. Usually source port numbers are chosen randomly (only the destination port really matters). The program you are using to capture the data is looking up which protocol normally uses those ports and displaying that instead of the number. Apparently the "random" ports your router is sending packets from, are the ports typically used by some other protocols. There is no security problem with that.

| improve this answer | |
  • what are the .payrouter, .isbconference1, .isbconerence 2, (1000's of these) etc. ? It looks like something is running a dictionary on my router or something (I enabled this logging myself) – Julius Baer May 6 '19 at 7:51
  • @JuliusBaer I updated the answer. – user253751 May 6 '19 at 21:46

Not the answer you're looking for? Browse other questions tagged or ask your own question.