Is this Normal on a router log?

martin57

Hi,

I just logged into my netgerar router logs and saw the following, never have seen it before, is this normal?

Wed, 2010-11-17 11:07:16 - UDP Packet - Source:93.184.210.85,5004 Destination:192.168.0.2,64496 - [DOS]
Wed, 2010-11-17 11:07:17 - UDP Packet - Source:93.184.223.134,5004 Destination:192.168.0.2,64498 - [DOS]
Wed, 2010-11-17 11:07:17 - UDP Packet - Source:93.184.210.85,5004 Destination:192.168.0.2,64496 - [DOS]
Wed, 2010-11-17 11:07:17 - UDP Packet - Source:93.184.223.134,5004 Destination:192.168.0.2,64498 - [DOS]
Wed, 2010-11-17 11:07:17 - UDP Packet - Source:93.184.210.85,5004 Destination:192.168.0.2,64496 - [DOS]

Much more like the above, my security is wep. I did upgrade the netgear router some days ago, but wonder if the above log is anything to worry about?

martin57

hubert_cumberdale

that just looks like packet being sent from the router/ external websites to your PC/laptop @ 192.168.0.2

what is odd is if you visit thos IP address windows media pops up never seen that before

have a gander on the netgear forums its fairly common but the router is stopping them for somereason

gaming_guy

...........

debitcardmayhem

Sounds like your router is doing a DOS (Denial of Service) block on 93.184.223.134 which is

% Information related to '93.184.216.0 - 93.184.223.255'

inetnum:        93.184.216.0 - 93.184.223.255
netname:        EDGECAST-NETBLK-04
descr:          NETBLK-04-EU -22
country:        EU
admin-c:        PG4404-RIPE
tech-c:         PG4404-RIPE
status:         ASSIGNED PA
mnt-by:         MNT-EDGECAST
source:         RIPE # Filtered

person:         Philip1 Goldsmith1
address:        2850 Ocean Park Blvd., Suite 110, Santa Monica CA 90405 USA
phone:          +13104793200
nic-hdl:        PG4404-RIPE
source:         RIPE # Filtered

Hope this helps

dispossessed

If you are concerned regarding the security of your Router (and, ultimately, your home network) then I would recommend running a few tests via the "Audit My PC website". They have a variety of online tools etc to scan for open ports and suchlike.

Trevor

Hammyman

debitcardmayhem wrote: »

Sounds like your router is doing a DOS (Denial of Service) block on 93.184.223.134

Slight problem with that in so much as the traffic is INBOUND to the router from the internet so its someone with that IP address doing a port scan.

debitcardmayhem

Hammyman wrote: »

Slight problem with that in so much as the traffic is INBOUND to the router from the internet so its someone with that IP address doing a port scan.

My router and afaik no other does not stop me doing outbound DOS , I know it was inbound , thats why I told OP who was doing it.;)

jayme1

you should check that remote access to the router is turned off and also your routers admin password is secure (ie not the default 'password' or 'blank')

closed

nothing to worry about, however wep is not very secure, use wpa/wpa2 instead (totally unconnected to the log)

if it continues after rebooting the router, check to see if something is talking on that port on the pc, using tcpview