Random SAAF - is this normal?

DrPeterVC — Sun, 26 Mar 2023 13:30:50 GMT

I noticed a few days ago my port forwards seemed to disappear. I eventually tracked it down to this event on 20th March in the morning. I was nowhere near the router (BT Hub) at the time.

There is a random DoS port scan (I have redacted my own public IP in the log below) followed by a SAAF restart (which obviously wiped my port forwards)

09:19:09, 20 Mar. PPP LCP Receive Configuration ACK

09:19:08, 20 Mar. PPP LCP Send Configuration ACK

09:19:08, 20 Mar. PPP LCP Receive Configuration Request

09:19:08, 20 Mar. PPP LCP Send Configuration Request

09:19:05, 20 Mar. PPP: Received PADS

09:19:05, 20 Mar. PPP: Sending PADR

09:19:05, 20 Mar. PPP: Received PADO

09:19:05, 20 Mar. PPP: Sending PADI

09:19:00, 20 Mar. PPP: Starting PPP daemon

09:18:57, 20 Mar. WAN Auto-sensing detected port Ethernet WAN

09:18:56, 20 Mar. Booting firmware v0.38.00.10147-BT (Fri Oct 14 23:39:03 2022)

09:18:53, 20 Mar. System start Button press (SAAF)

09:18:52, 20 Mar. System up

09:18:33, 20 Mar. WAN Auto-sensing last connection port: Ethernet WAN

09:17:46, 20 Mar. System restart, reason: SAAF

09:17:45, 20 Mar. TLS 0 Close

09:17:45, 20 Mar. SIP 60da1e06 SEND 200 NOTIFY

09:17:45, 20 Mar. SIP 60da1e06 RECV NOTIFY

09:17:45, 20 Mar. SIP 60da1e06 RECV 200 SUBSCRIBE

09:17:45, 20 Mar. SIP 60da1e06 SEND SUBSCRIBE

09:17:45, 20 Mar. SIP De-registrations

09:17:45, 20 Mar. DoS(UDP Loopback): IN=ppp0 OUT= MAC= src=128.232.21.75 DST=81.xxx.xxx.xxx LEN=28 TOS=0x00 PREC=0x00 TTL=240 ID=54321 PROTO=UDP SPT=33967 DPT=19 LEN=8 MARK=0x8000000

Re: Random SAAF - is this normal?

Les-Gibson — Sun, 26 Mar 2023 20:55:48 GMT

If it's what I think it is

Safeguarding Children Assessment and Analysis Framework (SAAF) – Child and Family Training

This topic

Random SAAF - is this normal?

Re: Random SAAF - is this normal?