DComTalk.com

Guest

Hi,

I've got a D-Link wireless router. Last night I got about 200 attack
logs sent to me from it - one every few minutes. The contents looked
like the following:

Nov/21/2005 08:12:37
Target IP(192.168.0.255), Target Port(138) Packet Dropped
Nov/21/2005 08:12:37
Spoof IP(192.168.0.104), Spoof Port(138)
Nov/21/2005 08:12:37
Spoof Attack fromd MAC(XX) Detect,
Nov/21/2005 08:04:06
SMTP: send mail succeed
Nov/21/2005 08:04:05
Target IP(192.168.0.255), Target Port(137) Packet Dropped
Nov/21/2005 08:04:05
Spoof IP(192.168.0.104), Spoof Port(137)
Nov/21/2005 08:04:05
Spoof Attack fromd MAC(XX) Detect,

The MAC address in this log corresponds to my MAC address. I've
replaced it here with XX.

The Spoof IP is the IP of my system. The Target IP doesn't exist.

It seems like this attack is internal. But I am not sure why it is
occurring. Can anyone shed any light?

My system is running Windows XP.

Thanks for your help.

Regards,
Steve

E. · Guest

google@stevesanyal.com wrote:

Guest

I didn't think it was malicious. However, it seems to me like it is an
infinite loop, because I suddenly get my router logs filled with these
requests.

I have turned off attack logging so I don't get 200 logs sent to me in
a few hours. But ideally I'd like to reduce the amount of logging of
this nature. Any idea how?

Thanks,
Steve

	DComTalk.com Forum Index -> Firewalls	All times are GMT
Page 1 of 1