K.S. Bhaskar on 20 Apr 2019 15:52:28 -0700


[Date Prev] [Date Next] [Thread Prev] [Thread Next] [Date Index] [Thread Index]

[PLUG] Messages in security log of my FiOS Quantum router

My Verizon FiOS Quantum router has a message like this in the security log every few seconds (not exact; varies):

<UTCDateTime> ulogd[895] notice<173> Blocked IN=eth1 OUT= MAC=<WANMACAddress>:2c:21:72:60:0f:c1:08:00 SRC="" DST=<WANIPAddress> LEN=88 TOS=00 PREC=0x00 TTL=90 ID=1443 DF PROTO=TCP SPT=443 DPT=37085 SEQ=1187210841 ACK=1457699171 WINDOW=330 ACK URGP=0 MARK=0

In the above, the SRC IP address changes, as do most of the parameters, but the hex digits after the <WANMACAddress> seem to be constant.

I'm not sure what to make of these messages. They seem to regular and infrequent to be scripts probing for vulnerabilities. But I can't figure out what they are. Ideas welcome. Thank you very much, in advance.

Regards
– Bhaskar
___________________________________________________________________________
Philadelphia Linux Users Group         --        http://www.phillylinux.org
Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce
General Discussion  --   http://lists.phillylinux.org/mailman/listinfo/plug