Re: [PLUG] Messages in security log of my FiOS Quantum router

[Robert <mlists@zoominternet.net>]

Hello Bhaskar,

The MAC Address will always remain the same as MAC Addresses is a layer 
2 protocol.  As for the rest it looks like responses to your web site 
surfing.

SPT=443 = The web servers responce

DPT=37085 = The web browsers port it chose when making the connection.





On 4/20/19 6:52 PM, K.S. Bhaskar wrote:
> My Verizon FiOS Quantum router has a message like this in the security 
> log every few seconds (not exact; varies):
>
> *<UTCDateTime>*ulogd[895] notice<173> Blocked IN=eth1 OUT= 
> MAC=*<WANMACAddress>*:2c:21:72:60:0f:c1:08:00 SRC=31.13.71.50 
> DST=*<WANIPAddress>* LEN=88 TOS=00 PREC=0x00 TTL=90 ID=1443 DF 
> PROTO=TCP SPT=443 DPT=37085 SEQ=1187210841 ACK=1457699171 WINDOW=330 
> ACK URGP=0 MARK=0
>
> In the above, the SRC IP address changes, as do most of the 
> parameters, but the hex digits after the <WANMACAddress> seem to be 
> constant.
>
> I'm not sure what to make of these messages. They seem to regular and 
> infrequent to be scripts probing for vulnerabilities. But I can't 
> figure out what they are. Ideas welcome. Thank you very much, in advance.
>
> Regards
> – Bhaskar
>
> ___________________________________________________________________________
> Philadelphia Linux Users Group         --        http://www.phillylinux.org
> Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce
> General Discussion  --   http://lists.phillylinux.org/mailman/listinfo/plug

Thank you for your time.

--

Regards,
Robert


Smile, it increases your face value.........


___________________________________________________________________________
Philadelphia Linux Users Group         --        http://www.phillylinux.org
Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce
General Discussion  --   http://lists.phillylinux.org/mailman/listinfo/plug