0

My ZyXEL VMG8924-B30A VDSL modem recently had these alerts in its log. The WAN IP address of the modem is 10.225.205.128.

There was nothing like this before 1 May. What is this?

2019 -05 -01 T16:05:12  daemon  alert   kernel: Intrusion -> IN=ppp1.1 OUT= MAC= SRC=104.152.52.21 DST=10.225.205.128 LEN=40 TOS=0x00 PREC=0x00 TTL=237 PROTO=TCP SPT=59504 DPT=43665 WINDOW=1024 RES=0x00 SYN URGP=0 MARK=0x8000000 235
2019 -05 -01 T16:06:01  daemon  alert   kernel: Intrusion -> IN=ppp1.1 OUT= MAC= SRC=193.106.30.154 DST=10.225.205.128 LEN=40 TOS=0x00 PREC=0x00 TTL=243 PROTO=TCP SPT=54548 DPT=48304 WINDOW=1024 RES=0x00 SYN URGP=0 MARK=0x8000000 236
2019 -05 -01 T20:24:50  daemon  alert   kernel: Intrusion -> IN=ppp1.1 OUT= MAC= SRC=89.248.162.168 DST=10.225.205.128 LEN=40 TOS=0x00 PREC=0x00 TTL=242 PROTO=TCP SPT=41082 DPT=38807 WINDOW=1024 RES=0x00 SYN URGP=0 MARK=0x8000000 236
2019 -05 -03 T20:20:34  daemon  alert   kernel: Intrusion -> IN=ppp1.1 OUT= MAC= SRC=185.176.26.61 DST=10.225.205.128 LEN=40 TOS=0x00 PREC=0x00 TTL=246 PROTO=TCP SPT=44714 DPT=52011 WINDOW=1024 RES=0x00 SYN URGP=0 MARK=0x8000000 235
2019 -05 -04 T02:07:04  daemon  alert   kernel: Intrusion -> IN=ppp1.1 OUT= MAC= SRC=185.176.27.242 DST=10.225.205.128 LEN=40 TOS=0x00 PREC=0x00 TTL=244 PROTO=TCP SPT=45152 DPT=45970 189
2019 -05 -04 T06:15:00  daemon  alert   kernel: Intrusion -> IN=ppp1.1 OUT= MAC= SRC=81.22.45.193 DST=10.225.205.128 LEN=40 TOS=0x00 PREC=0x00 TTL=240 PROTO=TCP SPT=49338 DPT=35238 WINDOW=1024 RES=0x00 SYN URGP=0 MARK=0x8000000 234
2019 -05 -04 T06:19:09  daemon  alert   kernel: Intrusion -> IN=ppp1.1 OUT= MAC= SRC=81.22.45.4 DST=10.225.205.128 LEN=40 TOS=0x00 PREC=0x00 TTL=240 PROTO=TCP SPT=57267 DPT=55569 WINDOW=1024 RES=0x00 SYN URGP=0 MARK=0x8000000 232
2019 -05 -04 T07:49:45  daemon  alert   kernel: Intrusion -> IN=ppp1.1 OUT= MAC= SRC=81.22.45.193 DST=10.225.205.128 LEN=40 TOS=0x00 PREC=0x00 TTL=240 PROTO=TCP SPT=49338 DPT=37554 WINDOW=1024 RES=0x00 SYN URGP=0 MARK=0x8000000 234
2019 -05 -04 T08:44:46  daemon  alert   kernel: Intrusion -> IN=ppp1.1 OUT= MAC= SRC=5.188.86.114 DST=10.225.205.128 LEN=40 TOS=0x00 PREC=0x00 TTL=246 PROTO=TCP SPT=50301 DPT=41902 WINDOW=1024 RES=0x00 SYN URGP=0 MARK=0x8000000 234
2019 -05 -04 T09:40:29  daemon  alert   kernel: Intrusion -> IN=ppp1.1 OUT= MAC= SRC=185.134.121.0 DST=10.225.205.128 LEN=48 TOS=0x00 PREC=0x00 TTL=107 DF PROTO=TCP SPT=36303 DPT=44947 191
2019 -05 -04 T09:40:32  daemon  alert   kernel: Intrusion -> IN=ppp1.1 OUT= MAC= 86
2019 -05 -04 T09:40:38  daemon  alert   kernel: Intrusion -> IN=ppp1.1 OUT= 82
2019 -05 -04 T09:40:53  daemon  alert   kernel: Intrusion -> IN=ppp1.1 OUT= MAC= SRC=2.76.144.99 DST=10.225.205.128 LEN=52 TOS=0x00 PREC=0x00 TTL=109 DF PROTO=TCP SPT=51635 DPT=44947 WINDOW=8192 RES=0x00 SYN URGP=0 MARK=0x8000000 236
2019 -05 -04 T09:40:56  daemon  alert   kernel: Intrusion -> IN=ppp1.1 OUT= MAC= SRC=2.76.144.99 DST=10.225.205.128 LEN=52 TOS=0x00 PREC=0x00 TTL=109 DF PROTO=TCP SPT=51635 DPT=44947 WINDOW=8192 RES=0x00 SYN URGP=0 MARK=0x8000000 236
2019 -05 -04 T09:50:36  daemon  alert   kernel: Intrusion -> IN=ppp1.1 OUT= MAC= SRC=91.218.102.19 DST=10.225.205.128 LEN=52 TOS=0x00 PREC=0x00 TTL=111 DF PROTO=TCP SPT=49328 DPT=44947 WINDOW=8192 RES=0x00 SYN URGP=0 MARK=0x8000000 238
2019 -05 -04 T10:07:03  daemon  alert   kernel: Intrusion -> IN=ppp1.1 OUT= MAC= SRC=2.62.140.76 DST=10.225.205.128 LEN=52 TOS=0x00 PREC=0x00 TTL=116 DF PROTO=TCP SPT=62683 DPT=44947 WINDOW=17520 202
2019 -05 -05 T00:19:14  daemon  alert   kernel: Intrusion -> IN=ppp1.1 OUT= MAC= SRC=185.216.140.6 DST=10.225.205.128 LEN=40 TOS=0x00 PREC=0x00 TTL=242 PROTO=TCP SPT=52165 DPT=59818 WINDOW=65535 RES=0x00 SYN URGP=0 MARK=0x8000000 236
2019 -05 -05 T08:54:01  daemon  alert   kernel: Intrusion -> IN=ppp1.1 OUT= MAC= SRC=193.32.161.19 DST=10.225.205.128 LEN=40 TOS=0x00 PREC=0x00 TTL=241 PROTO=TCP SPT=48844 DPT=39102 WINDOW=1024 RES=0x00 SYN URGP=0 MARK=0x8000000 235
2019 -05 -05 T20:23:34  daemon  alert   kernel: Intrusion -> IN=ppp1.1 OUT= MAC= SRC=46.232.112.17 DST=10.225.205.128 LEN=40 TOS=0x00 PREC=0x00 TTL=240 PROTO=TCP SPT=59071 DPT=53266 WINDOW=1024 RES=0x00 SYN URGP=0 MARK=0x8000000 235
2019 -05 -06 T21:14:20  daemon  alert   kernel: Intrusion -> IN=ppp1.1 OUT= MAC= SRC=81.22.45.243 DST=10.225.205.128 LEN=40 TOS=0x00 PREC=0x00 TTL=239 PROTO=TCP SPT=46260 DPT=44930 WINDOW=1024 RES=0x00 SYN URGP=0 MARK=0x8000000 234
  • 10.0.0.0/8 is a private, non-routed IP-address range. The SRC= seems much more interesting than the DST= – MechMK1 May 7 at 13:40
  • @MechMK1 Agreed! Any significance to the ports? – rickhg12hs May 7 at 13:41
  • The ports are all very high, which indicates that they are usually dynamically allocated when communication is requested. When you open a website, you communicate with the destination port 443 (or 80), but your source port will more likely be something like 41914. This means that there seems no specific service they were trying to probe. – MechMK1 May 7 at 13:46
  • 1
    Looks for me like some normal port scan, i.e. trying to establish a TCP connection (SYN set). Should be nothing to worry about. A system which reports such things as "intrusion" has a mindset from 10 years ago - today such "attacks" are too common so reporting this just produces useless noise (But I know, the customer wants to see that the system is protected him - even if it is just trivial stuff). These scans do not do any actual harm when they just get silently blocked. – Steffen Ullrich May 7 at 13:47
  • @Steffen_Ullrich It's interesting that there was no activity like this before 1 May... And that the target is the WAN IP address. – rickhg12hs May 7 at 14:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.