blir jeg hacket? logg fra router

Spr0cket · 15. januar 2008

syndefloden er over meg. jeg vet ikke hva dette er for noe og trenge hjelp til å tolke sikkerhetsloggen fra min smc router. 192.168.2.1** er mine maskiner.

2008-01-15  03:28:53 sending ACK to 192.168.2.102
2008-01-15  03:08:02 **SYN Flood** 83.117.9.119, 2641->> 192.168.2.102, 33906 (from WAN Inbound)
2008-01-15  02:49:42 sending ACK to 192.168.2.100
2008-01-15  02:49:38 sending ACK to 192.168.2.100
2008-01-15  02:39:32 **Smurf** 221.221.165.0, 64051->> 192.168.2.100, 31204 (from WAN Inbound)
2008-01-15  02:19:33 sending ACK to 192.168.2.101
2008-01-15  02:19:25 sending ACK to 192.168.2.101
2008-01-15  02:19:22 sending ACK to 192.168.2.101
2008-01-15  02:18:42 sending ACK to 192.168.2.102
2008-01-15  01:49:11 sending ACK to 192.168.2.100
2008-01-15  01:48:09 **Smurf** 221.126.67.0, 16092->> 192.168.2.100, 31204 (from WAN Inbound)
2008-01-15  01:47:13 **UDP Flood Stop**  (from WAN Inbound)
2008-01-15  01:47:12 **SYN Flood** 192.168.2.100, 3680->> 217.202.201.68, 12308 (from WAN Outbound)
2008-01-15  01:47:12 **SYN Flood** 62.10.56.142, 65477->> 192.168.2.100, 31204 (from WAN Inbound)
2008-01-15  01:47:12 **SYN Flood** 74.131.134.247, 2908->> 192.168.2.102, 33906 (from WAN Inbound)
2008-01-15  01:47:11 **SYN Flood** 99.224.75.199, 60391->> 192.168.2.102, 33906 (from WAN Inbound)
2008-01-15  01:47:11 **SYN Flood** 192.168.2.100, 3679->> 80.182.25.230, 13405 (from WAN Outbound)
2008-01-15  01:47:11 **SYN Flood** 192.168.2.100, 3675->> 90.149.45.185, 31204 (from WAN Outbound)
2008-01-15  01:47:10 **SYN Flood** 59.50.33.142, 33459->> 192.168.2.100, 31204 (from WAN Inbound)
2008-01-15  01:47:10 **SYN Flood** 217.54.65.252, 19261->> 192.168.2.100, 31204 (from WAN Inbound)
2008-01-15  01:47:10 **SYN Flood** 193.213.41.71, 4224->> 192.168.2.100, 31204 (from WAN Inbound)
2008-01-15  01:47:10 **SYN Flood** 219.93.152.12, 23242->> 192.168.2.102, 33906 (from WAN Inbound)
2008-01-15  01:47:10 **SYN Flood** 212.116.83.22, 1498->> 192.168.2.100, 31204 (from WAN Inbound)
2008-01-15  01:47:09 **SYN Flood** 213.130.239.224, 4722->> 192.168.2.100, 31204 (from WAN Inbound)
2008-01-15  01:47:09 **SYN Flood** 192.168.2.100, 3678->> 86.101.109.37, 22888 (from WAN Outbound)
2008-01-15  01:47:09 **SYN Flood** 192.168.2.100, 3677->> 89.148.43.146, 6881 (from WAN Outbound)
2008-01-15  01:47:09 **SYN Flood** 62.10.56.142, 65477->> 192.168.2.100, 31204 (from WAN Inbound)
2008-01-15  01:47:08 **SYN Flood** 205.242.37.35, 3453->> 192.168.2.100, 31204 (from WAN Inbound)
2008-01-15  01:47:08 **SYN Flood** 99.224.75.199, 60391->> 192.168.2.102, 33906 (from WAN Inbound)
2008-01-15  01:47:08 **SYN Flood** 202.41.85.2, 4763->> 192.168.2.102, 33906 (from WAN Inbound)
2008-01-15  01:47:08 **SYN Flood** 192.168.2.100, 3679->> 80.182.25.230, 13405 (from WAN Outbound)
2008-01-15  01:47:08 **SYN Flood** 192.168.2.100, 3674->> 77.232.120.173, 50948 (from WAN Outbound)
2008-01-15  01:47:07 **SYN Flood** 85.182.46.97, 59643->> 192.168.2.100, 31204 (from WAN Inbound)
2008-01-15  01:47:07 **SYN Flood** 217.54.65.252, 19261->> 192.168.2.100, 31204 (from WAN Inbound)
2008-01-15  01:47:07 **SYN Flood** 193.213.41.71, 4224->> 192.168.2.100, 31204 (from WAN Inbound)
2008-01-15  01:47:07 **SYN Flood** 151.67.45.156, 4527->> 192.168.2.100, 31204 (from WAN Inbound)
2008-01-15  01:47:07 **SYN Flood** 192.168.2.100, 3676->> 84.187.15.90, 16607 (from WAN Outbound)
2008-01-15  01:47:06 **SYN Flood** 192.168.2.100, 3678->> 86.101.109.37, 22888 (from WAN Outbound)
2008-01-15  01:47:06 **SYN Flood** 213.40.220.204, 1225->> 192.168.2.102, 33906 (from WAN Inbound)
2008-01-15  01:47:06 **SYN Flood** 192.168.2.100, 3677->> 89.148.43.146, 6881 (from WAN Outbound)
2008-01-15  01:47:05 **SYN Flood** 192.168.2.100, 3673->> 81.215.208.49, 19844 (from WAN Outbound)
2008-01-15  01:47:05 **SYN Flood** 205.242.37.35, 3453->> 192.168.2.100, 31204 (from WAN Inbound)
2008-01-15  01:47:05 **SYN Flood** 85.182.46.97, 59643->> 192.168.2.100, 31204 (from WAN Inbound)
2008-01-15  01:47:05 **SYN Flood** 202.41.85.2, 4763->> 192.168.2.102, 33906 (from WAN Inbound)
2008-01-15  01:47:05 **SYN Flood** 192.168.2.100, 3675->> 90.149.45.185, 31204 (from WAN Outbound)
2008-01-15  01:47:05 **SYN Flood** 59.50.33.142, 33459->> 192.168.2.100, 31204 (from WAN Inbound)
2008-01-15  01:47:04 **SYN Flood** 151.67.45.156, 4527->> 192.168.2.100, 31204 (from WAN Inbound)
2008-01-15  01:47:04 **SYN Flood** 75.71.20.231, 2148->> 192.168.2.102, 33906 (from WAN Inbound)
2008-01-15  01:47:04 **SYN Flood** 192.168.2.100, 3676->> 84.187.15.90, 16607 (from WAN Outbound)
2008-01-15  01:47:04 **SYN Flood** 219.93.152.12, 23242->> 192.168.2.102, 33906 (from WAN Inbound)
2008-01-15  01:47:03 **SYN Flood** 213.130.239.224, 4722->> 192.168.2.100, 31204 (from WAN Inbound)
2008-01-15  01:47:03 **SYN Flood** 213.40.220.204, 1225->> 192.168.2.102, 33906 (from WAN Inbound)
2008-01-15  01:47:03 **SYN Flood** 192.168.2.100, 3672->> 202.74.195.68, 42961 (from WAN Outbound)
2008-01-15  01:47:03 **SYN Flood** 89.164.237.167, 57618->> 192.168.2.102, 33906 (from WAN Inbound)
2008-01-15  01:47:02 **SYN Flood** 192.168.2.100, 3671->> 24.85.34.33, 6881 (from WAN Outbound)
2008-01-15  01:47:02 **SYN Flood** 192.168.2.100, 1711->> 72.14.217.18, 80 (from WAN Outbound)
2008-01-15  01:47:02 **SYN Flood** 192.168.2.100, 3675->> 90.149.45.185, 31204 (from WAN Outbound)
2008-01-15  01:47:02 **SYN Flood** 192.168.2.100, 3674->> 77.232.120.173, 50948 (from WAN Outbound)
2008-01-15  01:47:02 **SYN Flood** 59.50.33.142, 33459->> 192.168.2.100, 31204 (from WAN Inbound)
2008-01-15  01:47:01 **SYN Flood** 219.93.152.12, 23242->> 192.168.2.102, 33906 (from WAN Inbound)
2008-01-15  01:47:01 **SYN Flood** 213.130.239.224, 4722->> 192.168.2.100, 31204 (from WAN Inbound)
2008-01-15  01:47:00 **SYN Flood** 192.168.2.100, 3670->> 62.10.147.49, 22968 (from WAN Outbound)
2008-01-15  01:47:00 **SYN Flood** 192.168.2.100, 3673->> 81.215.208.49, 19844 (from WAN Outbound)
2008-01-15  01:46:59 **SYN Flood** 84.221.120.30, 1435->> 192.168.2.100, 31204 (from WAN Inbound)
2008-01-15  01:46:59 **SYN Flood** 192.168.2.100, 3674->> 77.232.120.173, 50948 (from WAN Outbound)
2008-01-15  01:46:57 **SYN Flood** 192.168.2.100, 3672->> 202.74.195.68, 42961 (from WAN Outbound)
2008-01-15  01:46:57 **SYN Flood** 217.211.5.244, 23204->> 192.168.2.100, 31204 (from WAN Inbound)
2008-01-15  01:46:56 **SYN Flood** 192.168.2.100, 3673->> 81.215.208.49, 19844 (from WAN Outbound)
2008-01-15  01:46:56 **SYN Flood** 192.168.2.100, 3671->> 24.85.34.33, 6881 (from WAN Outbound)
2008-01-15  01:46:56 **SYN Flood** 192.168.2.100, 1711->> 72.14.217.18, 80 (from WAN Outbound)
2008-01-15  01:46:56 **SYN Flood** 192.168.2.100, 3669->> 99.233.51.147, 64622 (from WAN Outbound)
2008-01-15  01:46:56 **SYN Flood** 208.104.161.200, 63733->> 192.168.2.102, 33906 (from WAN Inbound)
2008-01-15  01:46:55 **SYN Flood** 86.151.104.167, 54374->> 192.168.2.102, 33906 (from WAN Inbound)
2008-01-15  01:46:55 **SYN Flood** 129.241.139.169, 1460->> 192.168.2.102, 33906 (from WAN Inbound)
2008-01-15  01:46:54 **SYN Flood** 192.168.2.100, 3668->> 83.26.162.193, 57478 (from WAN Outbound)
2008-01-15  01:46:54 **SYN Flood** 192.168.2.100, 3667->> 41.201.127.30, 2816 (from WAN Outbound)
2008-01-15  01:46:54 **SYN Flood** 192.168.2.100, 3670->> 62.10.147.49, 22968 (from WAN Outbound)
2008-01-15  01:46:54 **SYN Flood** 192.168.2.100, 3672->> 202.74.195.68, 42961 (from WAN Outbound)
2008-01-15  01:46:54 **SYN Flood** 217.211.5.244, 23204->> 192.168.2.100, 31204 (from WAN Inbound)
2008-01-15  01:46:53 **SYN Flood** 87.80.182.35, 1433->> 192.168.2.102, 33906 (from WAN Inbound)
2008-01-15  01:46:53 **SYN Flood** 192.168.2.100, 3671->> 24.85.34.33, 6881 (from WAN Outbound)
2008-01-15  01:46:53 **SYN Flood** 192.168.2.100, 1711->> 72.14.217.18, 80 (from WAN Outbound)
2008-01-15  01:46:53 **SYN Flood** 84.221.120.30, 1435->> 192.168.2.100, 31204 (from WAN Inbound)
2008-01-15  01:46:53 **SYN Flood** 208.104.161.200, 63733->> 192.168.2.102, 33906 (from WAN Inbound)
2008-01-15  01:46:52 **SYN Flood** 192.168.2.100, 3666->> 84.149.253.147, 6881 (from WAN Outbound)
2008-01-15  01:46:52 **SYN Flood** 76.69.230.116, 61090->> 192.168.2.100, 31204 (from WAN Inbound)
2008-01-15  01:46:52 **SYN Flood** 217.202.229.32, 4165->> 192.168.2.100, 31204 (from WAN Inbound)
2008-01-15  01:46:52 **SYN Flood** 129.241.139.169, 1460->> 192.168.2.102, 33906 (from WAN Inbound)
2008-01-15  01:46:51 **SYN Flood** 99.233.84.91, 3154->> 192.168.2.100, 31204 (from WAN Inbound)
2008-01-15  01:46:51 **SYN Flood** 99.238.171.242, 54701->> 192.168.2.102, 33906 (from WAN Inbound)
2008-01-15  01:46:51 **SYN Flood** 192.168.2.100, 3670->> 62.10.147.49, 22968 (from WAN Outbound)
2008-01-15  01:46:51 **SYN Flood** 71.191.83.144, 59553->> 192.168.2.102, 33906 (from WAN Inbound)
2008-01-15  01:46:51 **SYN Flood** 87.80.182.35, 1433->> 192.168.2.102, 33906 (from WAN Inbound)
2008-01-15  01:46:50 **SYN Flood** 192.168.2.100, 3669->> 99.233.51.147, 64622 (from WAN Outbound)
2008-01-15  01:46:50 **SYN Flood** 84.221.120.30, 1435->> 192.168.2.100, 31204 (from WAN Inbound)
2008-01-15  01:46:50 **SYN Flood** 192.168.2.100, 3665->> 78.86.136.163, 16521 (from WAN Outbound)
2008-01-15  01:46:49 **SYN Flood** 86.151.104.167, 54374->> 192.168.2.102, 33906 (from WAN Inbound)
2008-01-15  01:46:49 **SYN Flood** 24.108.196.58, 51789->> 192.168.2.100, 31204 (from WAN Inbound)
2008-01-15  01:46:48 **SYN Flood** 192.168.2.100, 3668->> 83.26.162.193, 57478 (from WAN Outbound)
2008-01-15  01:46:48 **SYN Flood** 192.168.2.100, 3667->> 41.201.127.30, 2816 (from WAN Outbound)
2008-01-15  01:46:48 **SYN Flood** 90.129.5.204, 58754->> 192.168.2.102, 33906 (from WAN Inbound)
2008-01-15  01:46:48 **SYN Flood** 71.191.83.144, 59553->> 192.168.2.102, 33906 (from WAN Inbound)
2008-01-15  01:46:47 **SYN Flood** 83.233.210.27, 2484->> 192.168.2.102, 33906 (from WAN Inbound)
2008-01-15  01:46:47 **SYN Flood** 192.168.2.100, 3669->> 99.233.51.147, 64622 (from WAN Outbound)
2008-01-15  01:46:47 **SYN Flood** 85.180.66.182, 2314->> 192.168.2.100, 31204 (from WAN Inbound)
2008-01-15  01:46:47 **SYN Flood** 192.168.2.100, 3664->> 81.156.211.93, 19762 (from WAN Outbound)
2008-01-15  01:46:46 **SYN Flood** 90.206.46.165, 63562->> 192.168.2.102, 33906 (from WAN Inbound)
2008-01-15  01:46:46 **SYN Flood** 76.69.230.116, 61090->> 192.168.2.100, 31204 (from WAN Inbound)
2008-01-15  01:46:46 **SYN Flood** 192.168.2.100, 3666->> 84.149.253.147, 6881 (from WAN Outbound)
2008-01-15  01:46:46 **SYN Flood** 217.202.229.32, 4165->> 192.168.2.100, 31204 (from WAN Inbound)
2008-01-15  01:46:46 **SYN Flood** 81.84.129.20, 50696->> 192.168.2.102, 33906 (from WAN Inbound)
2008-01-15  01:46:45 **SYN Flood** 99.233.84.91, 3154->> 192.168.2.100, 31204 (from WAN Inbound)
2008-01-15  01:46:45 **SYN Flood** 192.168.2.100, 3668->> 83.26.162.193, 57478 (from WAN Outbound)
2008-01-15  01:46:45 **SYN Flood** 99.238.171.242, 54701->> 192.168.2.102, 33906 (from WAN Inbound)
2008-01-15  01:46:45 **SYN Flood** 192.168.2.100, 3667->> 41.201.127.30, 2816 (from WAN Outbound)
2008-01-15  01:46:45 **SYN Flood** 98.192.43.133, 23010->> 192.168.2.100, 31204 (from WAN Inbound)
2008-01-15  01:46:45 **SYN Flood** 84.71.111.4, 4349->> 192.168.2.100, 31204 (from WAN Inbound)
2008-01-15  01:46:44 **SYN Flood** 192.168.2.100, 3663->> 58.178.236.166, 22638 (from WAN Outbound)
2008-01-15  01:46:44 **SYN Flood** 99.238.171.242, 54681->> 192.168.2.102, 33906 (from WAN Inbound)
2008-01-15  01:46:44 **SYN Flood** 90.206.46.165, 63562->> 192.168.2.102, 33906 (from WAN Inbound)
2008-01-15  01:46:44 **SYN Flood** 192.168.2.100, 3665->> 78.86.136.163, 16521 (from WAN Outbound)
2008-01-15  01:46:43 **SYN Flood** 190.6.237.88, 4106->> 192.168.2.100, 31204 (from WAN Inbound)
2008-01-15  01:46:43 **SYN Flood** 90.176.82.125, 17150->> 192.168.2.102, 33906 (from WAN Inbound)
2008-01-15  01:46:43 **SYN Flood** 76.69.230.116, 61090->> 192.168.2.100, 31204 (from WAN Inbound)
2008-01-15  01:46:43 **SYN Flood** 192.168.2.100, 3666->> 84.149.253.147, 6881 (from WAN Outbound)
2008-01-15  01:46:43 **SYN Flood** 217.202.229.32, 4165->> 192.168.2.100, 31204 (from WAN Inbound)
2008-01-15  01:46:43 **SYN Flood** 24.108.196.58, 51789->> 192.168.2.100, 31204 (from WAN Inbound)
2008-01-15  01:46:43 **SYN Flood** 213.164.199.140, 1752->> 192.168.2.100, 31204 (from WAN Inbound)
2008-01-15  01:46:43 **SYN Flood** 99.233.84.91, 3154->> 192.168.2.100, 31204 (from WAN Inbound)
2008-01-15  01:46:42 **SYN Flood** 99.238.171.242, 54701->> 192.168.2.102, 33906 (from WAN Inbound)
2008-01-15  01:46:42 **SYN Flood** 192.168.2.100, 3662->> 83.30.250.34, 42144 (from WAN Outbound)
2008-01-15  01:46:42 **SYN Flood** 76.84.209.234, 32945->> 192.168.2.100, 31204 (from WAN Inbound)
2008-01-15  01:46:42 **SYN Flood** 98.192.43.133, 23010->> 192.168.2.100, 31204 (from WAN Inbound)
2008-01-15  01:46:41 **SYN Flood** 85.108.225.113, 3680->> 192.168.2.100, 31204 (from WAN Inbound)
2008-01-15  01:46:41 **SYN Flood** 83.233.210.27, 2484->> 192.168.2.102, 33906 (from WAN Inbound)
2008-01-15  01:46:41 **SYN Flood** 98.196.159.57, 2892->> 192.168.2.102, 33906 (from WAN Inbound)
2008-01-15  01:46:41 **SYN Flood** 68.82.53.157, 62060->> 192.168.2.100, 31204 (from WAN Inbound)
2008-01-15  01:46:41 **SYN Flood** 192.168.2.100, 3661->> 89.172.36.98, 21485 (from WAN Outbound)
2008-01-15  01:46:41 **SYN Flood** 85.180.66.182, 2314->> 192.168.2.100, 31204 (from WAN Inbound)
2008-01-15  01:46:41 **SYN Flood** 192.168.2.100, 3665->> 78.86.136.163, 16521 (from WAN Outbound)
2008-01-15  01:46:41 **SYN Flood** 192.168.2.100, 3664->> 81.156.211.93, 19762 (from WAN Outbound)
2008-01-15  01:46:41 **SYN Flood** 190.6.237.88, 4106->> 192.168.2.100, 31204 (from WAN Inbound)
2008-01-15  01:46:40 **SYN Flood** 90.176.82.125, 17150->> 192.168.2.102, 33906 (from WAN Inbound)
2008-01-15  01:46:40 **SYN Flood** 81.84.129.20, 50696->> 192.168.2.102, 33906 (from WAN Inbound)
2008-01-15  01:46:40 **SYN Flood** 213.164.199.140, 1752->> 192.168.2.100, 31204 (from WAN Inbound)
2008-01-15  01:46:40 **SYN Flood** 24.108.196.58, 51789->> 192.168.2.100, 31204 (from WAN Inbound)
2008-01-15  01:46:39 **SYN Flood** 192.168.2.100, 1686->> 72.14.217.18, 80 (from WAN Outbound)
2008-01-15  01:46:39 **SYN Flood** 192.168.2.100, 3660->> 78.148.97.63, 28242 (from WAN Outbound)
2008-01-15  01:46:38 **SYN Flood** 192.168.2.100, 3663->> 58.178.236.166, 22638 (from WAN Outbound)
2008-01-15  01:46:38 **SYN Flood** 84.56.24.142, 2334->> 192.168.2.102, 33906 (from WAN Inbound)
2008-01-15  01:46:38 **SYN Flood** 121.72.89.204, 2891->> 192.168.2.102, 33906 (from WAN Inbound)
2008-01-15  01:46:38 **SYN Flood** 84.71.111.4, 4349->> 192.168.2.100, 31204 (from WAN Inbound)
2008-01-15  01:46:38 **SYN Flood** 85.108.225.113, 3680->> 192.168.2.100, 31204 (from WAN Inbound)
2008-01-15  01:46:38 **SYN Flood** 83.233.210.27, 2484->> 192.168.2.102, 33906 (from WAN Inbound)
2008-01-15  01:46:38 **SYN Flood** 99.238.171.242, 54681->> 192.168.2.102, 33906 (from WAN Inbound)
2008-01-15  01:46:38 **SYN Flood** 86.140.50.160, 56167->> 192.168.2.100, 31204 (from WAN Inbound)

Xkr%#^+* · 15. januar 2008

http://en.wikipedia.org/wiki/SYN_flood

Bolson · 15. januar 2008

Ja, du er blitt angrepet.

SYN Flood forklaring på Wikipedia

Smurf attack på Wikipedia

Hva jeg ikke liker er at du har "utgående" SYN Flood, men jeg kan for lite til at jeg kan gi noen gode svar. Har selv med jevne mellomrom SYN Flood mot nettet mitt, men de blokkeres i routeren.

Nå ser jeg at det bare har pågått en periode på noen minutter, med noe i loggen senere.

Men du bør trolig ta en full sikkerhetssjekk på nettet ditt, sjekke maskiner for trojaner og annet dritt, samt se over oppsettet av router. Det er maskina med adresse 192.168.2.100 som også sender ut (mulig det er routeren). Jeg ville ha oppgradert firmware på router, stengt alle porter med unntak av 80 og inngående/utgående epost. Er de UPNP på routeren slår du dette av (har et sikkerhetshull). Og sjekket om oppsettet var tett fra utsida.

Spr0cket · 16. januar 2008

takk for svar. siste nytt er dette:

2008-01-15 23:59:17 **IP Spoofing** 127.0.0.1, 3128->> 90.149.45.185, 3755 (from WAN Inbound)

jeg har undret på om dette kan ha sammenheng med de siste dager nyheter om upnp-svakheten.

bruker avg, det skal finne evt trojanere?

Bolson · 16. januar 2008

takk for svar. siste nytt er dette:

2008-01-15 23:59:17 **IP Spoofing** 127.0.0.1, 3128->> 90.149.45.185, 3755 (from WAN Inbound)

jeg har undret på om dette kan ha sammenheng med de siste dager nyheter om upnp-svakheten.

bruker avg, det skal finne evt trojanere?

Det ser ut som du har et problem. Nei, AVG Antivirus finner nok ikke alt som kan være aktuelt av styggheter, men den finner de fleste trojanere.

Her finner du tråder som kan hjelpe deg med fremgangsmåte for opprydding.

Makky · 16. januar 2008

Kjør en online scan fra f.eks. panda antivirus eller norton.

Kjør også en "sikkerhetssjekk" fra norton.

Knopfix · 16. januar 2008

DOS angrep bruker ping,eller ICMP pakker i så store mengder at bufferen som med å holde styr på TCP pakker blir sprengt og en en kopi av MAC addressen din kan brukes for å få tilgang på ditt private nett når bufferen er sprengt.

Nyere rutere har en funksjon som du kan huke av for å ikke sende reply tilbake til de spm pinger deg,da vil de få svar som "destination unreachble" i stedet for svaret med tid og reply.Så du kan jo sjekke om du kan huke av for dette et sted på ruteren,min gamle Dlink har det og en del Linsys rutere.

Eller kan du også sjekke fra RUN\CMD og skrive NETSTAT -VB og se om det er åpnet noen programmer via nettet som du mener du selv ikke har tillatt.

Har du mulighet for å blokke IP addresser på ruteren din kan du legge inn addressene som ikke begynner på 192.168.x.x som du har i loggen din inn i en blokkliste,disse som har med SYNCH,ACK,Flooding og Smurf å gjøre.

Spr0cket · 16. januar 2008

 TCP	raid10:3065			adsl-074-183-105-205.sip.aby.bellsouth.net:57837
SYN_SENT		3416

er dette et relevant poeng?

jeg får opp ganske mange oppføringer som er knyttet til utorrent, men dette var den eneste jeg så med syn_sent...

subsidiært, hva skal jeg gjøre med informasjonen jeg får fra netstat?

er det noen routere som er sikrere enn andre?

jeg har nå oppdatert firmware på routeren, og nettverket ble litt mer stabilt, men det samme med syn flood opptrer i sikkerhetsloggen på routeren.

har bedt den om å ikke svare på ding, dvs det var default i routerens oppsett.

smc wbr14t g eu.

daruu · 16. januar 2008

Jeg har sammer router, og har selv slitt med ustabilt nett (regner med at det kan komme fra noe lignende som dette?)

Sorry for ot, men uansett en tråd jeg gjerne vil ha i mine innlegg

Knopfix · 16. januar 2008

jeg får opp ganske mange oppføringer som er knyttet til utorrent, men dette var den eneste jeg så med syn_sent...

Eh sorry jeg mente flood.Syn og ack brukes av alle TCP oppkoblinger.

Har du oppe Torrent vil du ikke får mye nytte av Netstat -vb siden du må se igjennom opptil

hundrevis av oppkoblinger.Men du vil kunne se hvilke programmer som åpnet og tillat av deg,og ikke tillat av deg.

Spr0cket · 16. januar 2008

men kan dette relateres til routeren? dvs, hva kan jeg gjøre ut over å slå lemmer oevr alle vinduer..

dette er jo litt som å gå i tilfluktsrommet og skal være en midlertidig tilstand. på sikt må jeg jo få en slutt på dette.

alle av-scans samt nortons sikkerhetsscan var negativ som forventet, dvs ingenting galt der.

skal jeg kjøpe en annen router eller be isp om ny ip?

Knopfix · 16. januar 2008

Jeg tviler på at de har noe særlig å hente hos en "vanlig" hjemmebruker så du er nok bare

et tilfeldig uskyldig offer for noen fjortiser som har lastet ned Hackers black book eller noe i den stilen.Hvis du har feks Telenor vil IP addressen din forandre seg når du restarter modemet.

Sørg for en grundig virus scann,Adware skal også være bra for å fjerne mistenkelig spyware.

Også et prg som heter Trojan remover som kan sjekke om noe mistenkelig er innstallert.

Ellers er en god brannmur og ikke flere åpnede porter enn nødvendig lurt.

Ellers kan du sjekke med Netstat om det er et implementert programm som styres utenifra.

Sikkert ikke så mye å bekymre seg for.

Endret 16. januar 2008 av Knopfix

Spr0cket · 16. januar 2008

jeg har neppe noen hemmeligheter som er viktig for nasjonal sikkerhet nei, og du har nok mye rett i det. når det gjelder virusscan har jeg gjennomført både avg og 2xsymantec. ingen meldte om noe unormalt.

det meste av forsvarsverker er oppe. i praksis er det noen som driver og "nuker" routeren min, det var i alle fall det vi kalte det på irc tilbake i forrige årtusen. neppe noe å bry seg om, men det er forbanna slitsomt å måtte reboote routeren flere ganger for dag. jeg gjentar derfor spørsmålet, er det noe å hente på å kjøpe en ny router? så langt har denne vært stort sett stabil.

adware schmadware, jeg har etterhvert opparbeidet meg en sunn fornuft rundt dette og tror jeg har gått klar av det meste av adware, malware og spyware de siste ti årene. så med mindre jeg har surfet i dritfylla tviler jeg på at jeg har takket ja til noe som helst. men takk for omtanken.

edit [dette siste avsnittet hørtes litt syrlig ut, ikke meninga]

Endret 16. januar 2008 av Spr0cket

Knopfix · 17. januar 2008

Dyrere rutere mer beregnet for bedriftsmarked kan gjøre mye mer når det gjelder sikkerhet.

Men det krever også kunnskaper å sette opp,men noen i mellomprisklassen har nok et fint

GUI for oppsett mens du kan gjøre mer i commando line interface.Men CLI holder du deg unna

hvis du ikke vet hva det er.

Cisco rutere beregnet for mindre bedrifer\kontorer kan være verdt å kikke på men det koster fort noen kroner.

Jeg kan dessverre ikke komme med et konkret forslag,men prøv å kikk på noen rimelige av Cisco eller håp på at noen andre her komer med noen gode tips.

Hvis du finner ut hvilken ISP angrepene kommer fra kan du jo prøve å sende loggen inn som bevis og klage men jeg tviler på at det hjelper.

Logg inn

blir jeg hacket? logg fra router

Anbefalte innlegg

Spr0cket

Lenke til kommentar

Videoannonse

Xkr%#^+*

Lenke til kommentar

Bolson

Lenke til kommentar

Spr0cket

Lenke til kommentar

Bolson

Lenke til kommentar

Makky

Lenke til kommentar

Knopfix

Lenke til kommentar

Spr0cket

Lenke til kommentar

daruu

Lenke til kommentar

Knopfix

Lenke til kommentar

Spr0cket

Lenke til kommentar

Knopfix

Lenke til kommentar

Spr0cket

Lenke til kommentar

Knopfix

Lenke til kommentar

Opprett en konto eller logg inn for å kommentere

Opprett konto

Logg inn

Hvem er aktive 0 medlemmer