This topic

BT router firewall log has 'Possible PS or DA' in firewall events

gillian_gt — Wed, 18 May 2022 09:06:46 GMT

I have a number of these messages in my router firewall log that look like this:

Possible PS or DA. src=91.240.118.77 DST=<my ipv4 address> LEN=40 TOS=0x00 PREC=0x00 TTL=244 ID=53246 PROTO=TCP SPT=59751 DPT=33813 WINDOW=1024 RES=0x00 SYN URGP=0

The SRC IP address is not the same for all messages and the ones I've checked point to locations in the Russian Federation and Ukraine.

What does the message mean? Has a hack been successful?

I've tried Google but can't find the actual meaning of the message.

Re: BT router firewall log has 'Possible PS or DA' in firewall events

gillian_gt — Wed, 18 May 2022 09:15:28 GMT

OK I think PA = Persistent Attack

Is DS the same as DOS (Denial of Service)?

My setup is just a home network not a business or anything

Re: BT router firewall log has 'Possible PS or DA' in firewall events

licquorice — Wed, 18 May 2022 10:18:59 GMT

It simply means that your firewall is doing its job. Just ignore it.

Re: BT router firewall log has 'Possible PS or DA' in firewall events

gillian_gt — Wed, 18 May 2022 13:27:45 GMT

Thanks @licquorice The reason I was looking in the log in the first place is because I had some C&C Callback messages in my anti-virus log this morning and one of the callback addresses was the router.

I think I need to do some locking down and updating (if I can). It's quite an old router (BT Home Hub 3.0) and the last firmware update was 17/11/16.

I don't suppose you would know if BT would upgrade our router for us? We've recently renewed our contract.

Re: BT router firewall log has 'Possible PS or DA' in firewall events

licquorice — Wed, 18 May 2022 14:28:28 GMT

I'm sure if it happened to go faulty BT would replace it.😉