Print

Please login or register.
1 Hour 1 Day 1 Week 1 Month Forever
Login with username, password and session length

[fgl30]

Why router connect (without my request) to mcleodusa.net domain? What this means? How is the functio connection to ip 63.253.14.xx? Iīm very concerned about this kind of attitud/connection......  .....I need some light here....

[Lycan]

Thats a UPnP request. It's normal.

[fgl30]

Could you, please explain me a little better? Why UPnP need such request over net? If I turn off UPnP so, DIR-655 will not make this connection? Thx for attention

[Lycan]

Thats not your router, it's your PC I believe.

[EricP]

FYI there is a but of a stir about what some of these firewall reports are, though this guy doesn't cite very good examples in the thread I am about to link. This needs to be cleared up:

http://www.dslreports.com/forum/r20071221-Flaw-Security-Dlink-DIR655-Router-with-implant-backdoor

[fgl30]

Iīm pretty sure isnīt my PC.... I donīt use UPnP in any of my computers.... plus, why my PC could connect a D-Link domain? Isnīt D-Link owner of McLeodUSA company?

[Lycan]

Upon further inspection, we have determined that it is the router. However it's intended. I forwarded the link to the forum post to the PM gourp responsible for that product and it's currently being reviewed.
Thank you for your attention.

[AWDL]

I read the thread. 

I promise to stop eating chocolate for a month. If there is a "true" security problem (ie: realistically exploitable).

[funchords]

I don't get it.  Why report anything to the product team if it is "as intended?"

Regardless -- I'm glad that you did forward the report.  This has to be a bug -- it may simply be that something is being incorrectly displayed (which is how I'm leaning, as packets captured in the log are generally the packets that are NOT going through). 

The original DSLReport's post (which is very confusing) suggests that something is egressing out the WAN side.  But other than that first reporter, nobody else is seeing anything of major concern.

Anyway, thanks for forwarding it along.

[fgl30]

I read the thread. 

I promise to stop eating chocolate for a month. If there is a "true" security problem (ie: realistically exploitable).

well, I donīt think your answer is serious... I really donīt care about your chocolates, I care about security router problem, that you doesnīt explain nothing..... Lycan, at least acept that there is some problem.... is a start... deny an obvious thing is not good... it seems "Received Deauthentication" problem is not alone....

[DCIFRTHS]

This is one topic I am very interested in, and quite frankly, has me concerned. The DSL Reports thread was an interesting read. Thanks for he link.

[rtoledo]

I read the thread. 

I promise to stop eating chocolate for a month. If there is a "true" security problem (ie: realistically exploitable).

Hi do you have a update on this issue?

can you give us a better description of the mechanism involved here ?

I understand you don't think it's a security issue, and I concur, but it would be best to descrive how the process is working , and how several  options within the router can cause these reports to appear,  last I wonder WHY  Dlink management has not bothered to rename the   mcleod site to something like  mcleod.dlink.com  so users of their equipment won't panic so much.

thanks

[DCIFRTHS]

Hi do you have a update on this issue?

can you give us a better description of the mechanism involved here ?

I understand you don't think it's a security issue, and I concur, but it would be best to descrive how the process is working , and how several  options within the router can cause these reports to appear,  last I wonder WHY  Dlink management has not bothered to rename the   mcleod site to something like  mcleod.dlink.com  so users of their equipment won't panic so much.

thanks

After reading the thread on dslreports, I get the impression that there is not a definitive answer as to whether this is a security concern.

An update would be welcome...

[AWDL]

Not to jump Lycan thunder.

To the ones that hated my Chocolate for Security issue comment:

I guess you have to do some deep thinking to find what I meant. To clarify: I read the DSL reports thread. I don't think it is a security issue. If you talk to SAM have him send his report to D-Link US corporate email address attn: Director of Technical Services.

We will do a scan of the WAN side of the router to find out what really is "reporting home" with default settings. They we will also perform a capture with settings our fine level headed forums users report drive the problem. Then we will figure out why the results are what they are and change code as necessary to reach our expected function if it isn't doing it already.

To the ones that want D-Link to change the name of the IP resolution to a D-Link name:

That won't happen in the near future. It belongs to the co-location that hosts our NTP servers. We lease the space and bandwidth.

If you aren't talking about the sites, we use then look for a virus on your LAN.

[fgl30]

"We will do a scan of the WAN side of the router to find out what really is "reporting home" with default settings."


@AWDL: could you, please, clarify to me how you plan to perform that scan?