1

I checked my home (broadband)routers security logs just today and found these logs

LAN Attack: IN=ptm0.1 OUT=n/a MAC="mac address here"a SRC="source ip address here" DST="my public ip address here" LEN=129 TOS=0x00 PREC=0x00 TTL=115 PROTO=UDP SPT=6881 DPT=15936 LEN=109 MARK=0x8000000

and second log:

Port Scan Attack: IN=ptm0.1 OUT=n/a MAC="mac address here"2 SRC="source ip address here"DST="my public ip address here" LEN=100 TOS=0x00 PREC=0x00 TTL=118 PROTO=UDP SPT=13291 DPT=54327 LEN=80 MARK=0x8000000

These two logs have been appearing in my sec logs every day since June this year and there are already over 600 entries, probably .I can't view older logs

Can you explain what do these logs mean? Is this an actual attack? Can I prevent it?

  • It would help if you say what make and model of router you are using. Also, whether or not the source IP is your internal LAN or another public IP. That first source port looks like Bitorrent. – user79331 Jun 26 '15 at 18:04
  • source addrress public ip router model zyxel f1000 – Peter Jun 26 '15 at 20:47
  • 2
    Everyone freaks out when they first see their router logs. I see nothing here to be worried about. – schroeder Jun 26 '15 at 22:15
1
PROTO=UDP SPT=6881 

TCP or UDP on port 6881 is usually associated with BitTorrent. Most likely you (or a former user of your IP address) used BitTorrent for downloading something, and this is just a routine check to see if your computer is still part of the relevant BitTorrent swarm. Nothing to worry about.

PROTO=UDP SPT=13291 DPT=54327

This could be anything. Neither UDP port 13291 nor UDP port 54327 is associated with anything in particular; this could be backscatter, or a corrupted UDP packet, or leftovers from a VOIP session, or who-knows-what. The one thing it probably isn't is a port scan: UDP port scans are slow, so an attacker will usually only scan ports that are likely to have something interesting on them.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.