I have had two Linksys EA4350 Routers for a week or so being used internal my network as wireless access points, and all of a sudden I started noticing requests from them once per minute (care of my apache logs) but network traffic indicates requests every 5 seconds.
192.168.1.x - - [19/Nov/2014:10:55:38 -0500] "GET / HTTP/1.1" 302 - "-" "-" 192.168.1.x - - [19/Nov/2014:10:55:38 -0500] "GET /HNAP1/ HTTP/1.1" 404 2989 "-" "-" 192.168.1.x - - [19/Nov/2014:10:55:38 -0500] "POST /JNAP/ HTTP/1.1" 404 2987 "-" "-" 192.168.1.x - - [19/Nov/2014:10:55:38 -0500] "GET /rest/login?next=/ HTTP/1.1" 301 - "-" "-" 192.168.1.x - - [19/Nov/2014:10:55:38 -0500] "GET /rest/login/?next=/ HTTP/1.1" 200 3634 "-" "-"
The last two "/rest/login" are actually my server redirecting the first request "GET /" to my login screen, since / is the only valid URL in my web server (Hence 302 instead of 404).
Where 192.168.1.x is the IP of my Linksys router, and all traffic is on port 80 (not 8080). I have tried rebooting both of them at the same down, updating the firmware to 22.214.171.124602, and putting them in bridge mode to disable "most" of the features. None of these have help.
NOTE: this router is not directly exposed to the internet, but can outbound access it. I suspected TheMoon worm, but too many details don't add up (Supposedly EA4200 is the last vulnerable, not directly exposed to internet, reboot didn't stop it, firmware didn't fix it, wrong port, etc...)
Should I be worried that my router is infected with something, or is this an annoyance I just need to filter out of my logs?
UPDATE: I remapped every IP on my network to an entirely different subnet (10.x.y.z), and the Traffic Continued sporadically (not once a minute, just randomly) for an additional hour AFTER the IPs changes (so it came from the router's NEW IP addresses) and then stopped and hasn't been seen for almost a week now.