I have a query about some logs I keep seeing in my Hub 5 event log that have only just started to appear since I upgraded from a hub 4 to the Hub 5.
Specifically (just a couple of samples as i wont post them all):
|08:54:09, 17 Jul.||DoS(UDP Loopback): IN=ppp0 OUT= MAC= src=188.8.131.52 DST=184.108.40.206 LEN=29 TOS=0x18 PREC=0x60 TTL=49 ID=64176 DF PROTO=UDP SPT=57512 DPT=19 LEN=9 MARK=0x8000000|
|19:14:44, 16 Jul.||DoS(UDP Loopback): IN=ppp0 OUT= MAC= src=220.127.116.11 DST=18.104.22.168 LEN=28 TOS=0x18 PREC=0x60 TTL=233 ID=54321 PROTO=UDP SPT=46473 DPT=19 LEN=8 MARK=0x8000000|
My hub is working fine and im getting all my speeds as I normally would but i was curious as to what these entries mean. They happen roughly 4 times a day randomly. Is this an indication of an attempted hack or ddos attack? If anyone can help and put my mind at rest id be grateful.
Solved! Go to Solution.
It probably is an attempted attack. You may just be getting them now because swapping one Hub for another will have given you a new IP address.
If you connect anything directly to the internet, then expect it to be attacked 24 hours a day. All Home Hubs have a built-in firewall and simply block all unexpected incoming messages. This firewall has the added advantage of protecting not just the Hub itself but everything on your home network.
I have tried turning off the modem and the hub for a bit in an attempt to get a new IP address but it wont release.
Anything else i can do apart from ignore it?
Just ignore it, if you get a new address it probably won't make any difference any way.
It's just port scanning - your router is doing its job and blocking them, so just ignore. The first IP address belongs to shadowserver.org - see their website for details about their port scanning.