Print

Please login or register.
1 Hour 1 Day 1 Week 1 Month Forever
Login with username, password and session length

[DirtyDawg]

Ok, this is a little scarry here.  None of my devices on my LAN have an address even close to the 192.168.100.11.  They all range from 192.168.0.199 - 192.168.0.253.  Also that below was logged when all of my systems were sleeping, and I was asleep as well, so the WAN inerface cable WAS NOT disconnected (well not physically anyway).  So would the log read like that if the router was having trouble indentifying whether anything was plugged into it or not?  Also, could this possibly be a hacking attempt picked up by the router?  Some input here would be great, thanks.

Edit:  I forgot to mention all of the addresses on my LAN are reserved addresses that NEVER expire.



[INFO] Sun Feb 14 21:37:58 2010 Dropped packet from 192.168.100.11 to 255.255.255.255 (IP protocol 17) as unable to create new session
[INFO] Sun Feb 14 21:37:58 2010 WAN interface speed measurement aborted as they did not converge
[INFO] Sun Feb 14 21:37:25 2010 Estimating speed of WAN interface
[INFO] Sun Feb 14 21:37:24 2010 Obtained IP Address using DHCP. IP address is 192.168.100.11
[INFO] Sun Feb 14 21:37:22 2010 Bringing up WAN using DHCP
[INFO] Sun Feb 14 21:37:22 2010 WAN interface cable has been connected
[INFO] Sun Feb 14 21:37:20 2010 WAN interface cable has been disconnected

[EddieZ]

Unsecured wireless? Please more info on your settings.

[DirtyDawg]

My wireless settings are secure.  How do you upload an image here anyway?  If I knew how to do that I could upload the settings page here.


Well in case there is no way to send the settings page here.  Wireless is set to WPA-Personal - WPA MODE - wpa2only cypher type is aes....I also have a huge SHARED PASSKEY set up.  It is as secure as it's going to be I think.  If you need any other info, please let me know.  Thanks for your input.

Unsecured wireless? Please more info on your settings.

[EddieZ]

Then there's nothing to worry about.

[DirtyDawg]

Ok then, thanks.  So nothing in the log strikes you as a little weird/surprising?

[Cobra]

As long as it says dropped or blocked....yes you are safe

[Lycan]

disable the wireless and see if those entries continue.

[DirtyDawg]

Thanks for your input Lycan.  As you can see below, I disconnected the wireless but I still get them.


[INFO] Wed Feb 17 13:01:19 2010 Allowed configuration authentication by IP address 192.168.0.199
[INFO] Wed Feb 17 13:01:05 2010 Blocked incoming TCP connection request from 221.195.73.86:12200 to 68.102.210.73:1080
[INFO] Wed Feb 17 13:00:56 2010 Blocked incoming TCP connection request from 221.195.73.86:12200 to 68.102.210.73:8000
[INFO] Wed Feb 17 12:59:45 2010 Log viewed by IP address 192.168.0.199
[INFO] Wed Feb 17 12:59:31 2010 Stored configuration to non-volatile memory
[INFO] Wed Feb 17 12:59:30 2010 Wireless link is down
[INFO] Wed Feb 17 12:59:30 2010 Wireless shut down
[INFO] Wed Feb 17 12:59:30 2010 Disconnect all stations

disable the wireless and see if those entries continue.

[DirtyDawg]

Wow, I just found out what is needed to stop those attempted hacking entries (if that's in fact what they are).  The only way I could stop them is disable UPnP?  Isn't this option REQUIRED to be enabled in order to use the Media Extender?

Thanks for any input.

[DirtyDawg]

C*R*A*P*!!!!  They're back.  So scratch that theory  .

Wow, I just found out what is needed to stop those attempted hacking entries (if that's in fact what they are).  The only way I could stop them is disable UPnP?  Isn't this option REQUIRED to be enabled in order to use the Media Extender?

Thanks for any input.

[davevt31]

The only way to stop the hacker entries is to stop the hackers themselves.
That 221 address comes from China.
Go ahead and  eave the UPnP enabled.

[DirtyDawg]

Yes, I have many ip addresses originating from China of people trying to hack into my network.  They have nothing better to do I guess?    I'm just glad that this is a solid router capable of keeping them out.  Thanks for your input.

The only way to stop the hacker entries is to stop the hackers themselves.
That 221 address comes from China.
Go ahead and  eave the UPnP enabled.

[Sammydad1]

http://www.neowin.net/news/two-chinese-schools-identified-over-the-attacks-that-targeted-google


Interesting read.... FYI....

[DirtyDawg]

Yes, I heard a little bit about this on ABC World News about a week ago.  I thought the military side of things on that report was kind of interesting. 

http://www.neowin.net/news/two-chinese-schools-identified-over-the-attacks-that-targeted-google


Interesting read.... FYI....

[DirtyDawg]

Ok, in case someone else had the entry in the log pertaining to "WAN Interface cable has been disconnected" and they couldn't figure out what was going on, I stumbled upon a possible fix and wanted to share it.  After I forced the WAN Port Speed to 1000Mbps, I no longer have problems with disconnects, nor do I see that entry in my log anymore.  Of course your network system needs to have that speed capability first before changing it, but if your network system does, then this might be a fix for you.

I did a Google search on "WAN Interface cable has been disconnected" and found this fix (for me).

Ok, this is a little scarry here.  None of my devices on my LAN have an address even close to the 192.168.100.11.  They all range from 192.168.0.199 - 192.168.0.253.  Also that below was logged when all of my systems were sleeping, and I was asleep as well, so the WAN inerface cable WAS NOT disconnected (well not physically anyway).  So would the log read like that if the router was having trouble indentifying whether anything was plugged into it or not?  Also, could this possibly be a hacking attempt picked up by the router?  Some input here would be great, thanks.

Edit:  I forgot to mention all of the addresses on my LAN are reserved addresses that NEVER expire.



[INFO] Sun Feb 14 21:37:58 2010 Dropped packet from 192.168.100.11 to 255.255.255.255 (IP protocol 17) as unable to create new session
[INFO] Sun Feb 14 21:37:58 2010 WAN interface speed measurement aborted as they did not converge
[INFO] Sun Feb 14 21:37:25 2010 Estimating speed of WAN interface
[INFO] Sun Feb 14 21:37:24 2010 Obtained IP Address using DHCP. IP address is 192.168.100.11
[INFO] Sun Feb 14 21:37:22 2010 Bringing up WAN using DHCP
[INFO] Sun Feb 14 21:37:22 2010 WAN interface cable has been connected
[INFO] Sun Feb 14 21:37:20 2010 WAN interface cable has been disconnected