• May 09, 2025, 10:13:27 AM
  • Welcome, Guest
Please login or register.

Login with username, password and session length
Advanced search  

News:

This Forum Beta is ONLY for registered owners of D-Link products in the USA for which we have created boards at this time.

Author Topic: Explanation sought for meaning of "Blocked incoming TCP packets"  (Read 7325 times)

wmh

  • Level 2 Member
  • **
  • Posts: 31
Explanation sought for meaning of "Blocked incoming TCP packets"
« on: February 01, 2010, 05:59:33 AM »
Can anyone please explain the following "Blocked incoming TCP Packets" from my log. Does this indicate a problem or is there a normal explanation for this? This seems to be going on all the time. From my perspective, the router is working fine but would just like to know what this means.

Thanks.


[INFO]   Mon Feb 01 08:19:11 2010   UPnP renew entry 255.255.255.255 <-> 172.27.35.49:62850 <-> 192.168.0.197:62850 UDP timeout:0 'Teredo'
[INFO]   Mon Feb 01 08:19:05 2010   Blocked incoming TCP packet from 74.125.45.149:80 to 172.27.35.49:63477 as FIN:ACK received but there is no active connection
[INFO]   Mon Feb 01 08:18:49 2010   Above message repeated 6 times
[INFO]   Mon Feb 01 08:18:29 2010   Blocked incoming TCP packet from 74.125.45.149:80 to 172.27.35.49:63430 as FIN:ACK received but there is no active connection
[INFO]   Mon Feb 01 08:18:29 2010   UPnP renew entry 255.255.255.255 <-> 172.27.35.49:62850 <-> 192.168.0.197:62850 UDP timeout:0 'Teredo'
[INFO]   Mon Feb 01 08:18:28 2010   Blocked incoming TCP packet from 74.125.45.149:80 to 172.27.35.49:63428 as FIN:ACK received but there is no active connection
[INFO]   Mon Feb 01 08:18:27 2010   Blocked incoming TCP packet from 74.125.45.149:80 to 172.27.35.49:63424 as FIN:ACK received but there is no active connection
[INFO]   Mon Feb 01 08:18:27 2010   Blocked incoming TCP packet from 74.125.45.149:80 to 172.27.35.49:63423 as FIN:ACK received but there is no active connection
[INFO]   Mon Feb 01 08:18:27 2010   Blocked incoming TCP packet from 74.125.45.149:80 to 172.27.35.49:63421 as FIN:ACK received but there is no active connection
[INFO]   Mon Feb 01 08:18:13 2010   Blocked incoming TCP packet from 74.125.45.149:80 to 172.27.35.49:63430 as FIN:ACK received but there is no active connection
[INFO]   Mon Feb 01 08:18:12 2010   Blocked incoming TCP packet from 74.125.45.149:80 to 172.27.35.49:63428 as FIN:ACK received but there is no active connection
[INFO]   Mon Feb 01 08:18:11 2010   Blocked incoming TCP packet from 74.125.45.149:80 to 172.27.35.49:63424 as FIN:ACK received but there is no active connection
[INFO]   Mon Feb 01 08:18:11 2010   Blocked incoming TCP packet from 74.125.45.149:80 to 172.27.35.49:63423 as FIN:ACK received but there is no active connection
[INFO]   Mon Feb 01 08:18:11 2010   Blocked incoming TCP packet from 74.125.45.149:80 to 172.27.35.49:63421 as FIN:ACK received but there is no active connection
[INFO]   Mon Feb 01 08:18:05 2010   Blocked incoming TCP packet from 74.125.45.149:80 to 172.27.35.49:63430 as FIN:ACK received but there is no active connection
[INFO]   Mon Feb 01 08:18:04 2010   Blocked incoming TCP packet from 74.125.45.149:80 to 172.27.35.49:63428 as FIN:ACK received but there is no active connection
[INFO]   Mon Feb 01 08:18:03 2010   Blocked incoming TCP packet from 74.125.45.149:80 to 172.27.35.49:63424 as FIN:ACK received but there is no active connection
[INFO]   Mon Feb 01 08:18:03 2010   Blocked incoming TCP packet from 74.125.45.149:80 to 172.27.35.49:63423 as FIN:ACK received but there is no active connection
[INFO]   Mon Feb 01 08:18:03 2010   Blocked incoming TCP packet from 74.125.45.149:80 to 172.27.35.49:63421 as FIN:ACK received but there is no active connection
[INFO]   Mon Feb 01 08:18:01 2010   Blocked incoming TCP packet from 74.125.45.149:80 to 172.27.35.49:63430 as FIN:ACK received but there is no active connection
[INFO]   Mon Feb 01 08:18:00 2010   Blocked incoming TCP packet from 74.125.45.149:80 to 172.27.35.49:63428 as FIN:ACK received but there is no active connection
[INFO]   Mon Feb 01 08:18:00 2010   Blocked incoming TCP packet from 74.125.45.149:80 to 172.27.35.49:63424 as FIN:ACK received but there is no active connection
[INFO]   Mon Feb 01 08:17:59 2010   Blocked incoming TCP packet from 74.125.45.149:80 to 172.27.35.49:63430 as FIN:ACK received but there is no active connection
Logged

sideloaded1

  • Level 1 Member
  • *
  • Posts: 21
Re: Explanation sought for meaning of "Blocked incoming TCP packets"
« Reply #1 on: February 01, 2010, 06:12:22 AM »
It means the router has no record of your network requesting those packets so it drops them. Its a security feature.
Logged

xli

  • Level 1 Member
  • *
  • Posts: 9
Re: Explanation sought for meaning of "Blocked incoming TCP packets"
« Reply #2 on: May 14, 2011, 05:41:28 PM »
To add some color to the above response - the FIN/ACK's (also known as Maimon scan) is frequently  used as a fingerprinting (discovery) technique.  Per IP protocol standards, the scanned system should send a RST (reset) packet to the originator of the FIN/ACK regardless of whether the scanned port is open or closed when there is no active session.  The sender of the FIN/ACK logs the ip adderss of the system responding with a RST as a valid ip address for later additional exploration and exploitation.  As indicated above your router blocks your outgoing response as a security feature.
Logged