A Broadband and ADSL forum. BroadbanterBanter

Welcome to BroadbanterBanter.

You are currently viewing as a guest which gives you limited access to view most discussions and other FREE features. By joining our free community you will have access to post topics, communicate privately with other members (PM), respond to polls, upload your own photos and access many other special features. Registration is fast, simple and absolutely free so please, join our community today.

Go Back   Home » BroadbanterBanter forum » Newsgroup Discussions » uk.telecom.broadband (UK broadband)
Site Map Home Register Authors List Search Today's Posts Mark Forums Read Web Partners

uk.telecom.broadband (UK broadband) (uk.telecom.broadband) Discussion of broadband services, technology and equipment as provided in the UK. Discussions of specific services based on ADSL, cable modems or other broadband technology are also on-topic. Advertising is not allowed.

Is my router under attack?



 
 
Thread Tools Display Modes
  #1  
Old May 26th 04, 09:07 PM posted to uk.telecom.broadband
Ian Burley
external usenet poster
 
Posts: 8
Default Is my router under attack?

I'm an NTL cable modem customer have also posted the following on an NTL
discussion group:

I am using a Netgear WGR614 wireless router connected to a Motorola
Surfboard cable modem. I'm connected to the 1MB service.

During the last few days I have noticed that the Internet activity light is
flickering away even when none of the networked PCs are switched on. I have
also had to reset (power cycle) the router occasionally - something that has
not been necessary before.

The wireless section of the router is set to maximum security (128bit WEP,
Mac addresses of connected machines required, etc.) and no unwanted wireless
guests are showing up on the status and log resources.

Maybe an unconnected problem, but I'll mention it anyway - I have noticed
that visiting one particular site (one that I visit routinely as part of my
work) now seems to co-incide with Internet access dying, requiring a router
reset.

Is this all a bit mysterious?

Any insight into the above would be very welcome. I'm based in the Hemel
Hempstead (NTL Luton?) area.

Thanks in advance,

Ian



  #2  
Old May 27th 04, 09:45 AM posted to uk.telecom.broadband
Tiny Ramsden
external usenet poster
 
Posts: 35
Default Is my router under attack?

Ian Burley wrote:

I'm an NTL cable modem customer have also posted the following on an NTL
discussion group:

I am using a Netgear WGR614 wireless router connected to a Motorola
Surfboard cable modem. I'm connected to the 1MB service.

During the last few days I have noticed that the Internet activity light
is flickering away even when none of the networked PCs are switched on. I
have also had to reset (power cycle) the router occasionally - something
that has not been necessary before.

The wireless section of the router is set to maximum security (128bit WEP,
Mac addresses of connected machines required, etc.) and no unwanted
wireless guests are showing up on the status and log resources.

Maybe an unconnected problem, but I'll mention it anyway - I have noticed
that visiting one particular site (one that I visit routinely as part of
my work) now seems to co-incide with Internet access dying, requiring a
router reset.

Is this all a bit mysterious?


If your running Linux there is a good diagnostic program to exam the
traffic, sorry can't remember the name it was in last month's linuc format.


Any insight into the above would be very welcome. I'm based in the Hemel
Hempstead (NTL Luton?) area.

Thanks in advance,

Ian


--
Lioncom adsl 4 port router, Nildram adsl running on Redhat 7.3. You can see
and hear me and my pal Joe Longthorne on uktalent.org.
  #3  
Old May 27th 04, 12:31 PM posted to uk.telecom.broadband
Julian Knight
external usenet poster
 
Posts: 56
Default Is my router under attack?

Ian Burley wrote:
I'm an NTL cable modem customer have also posted the following on an NTL
discussion group:

I am using a Netgear WGR614 wireless router connected to a Motorola
Surfboard cable modem. I'm connected to the 1MB service.

During the last few days I have noticed that the Internet activity light is
flickering away even when none of the networked PCs are switched on. I have
also had to reset (power cycle) the router occasionally - something that has
not been necessary before.

The wireless section of the router is set to maximum security (128bit WEP,
Mac addresses of connected machines required, etc.) and no unwanted wireless
guests are showing up on the status and log resources.

Maybe an unconnected problem, but I'll mention it anyway - I have noticed
that visiting one particular site (one that I visit routinely as part of my
work) now seems to co-incide with Internet access dying, requiring a router
reset.

Is this all a bit mysterious?

Any insight into the above would be very welcome. I'm based in the Hemel
Hempstead (NTL Luton?) area.

Thanks in advance,

I would have thought it more likely to be some spyware or trojan on a PC.
Try running AdAware AND Spybot Search & Destroy and see if anything turns up.

This is an area where a good personal firewall is useful as you can spot
such problems immediately.

--
Julian Knight, http://www.knightnet.org.uk/
Sheffield, United Kingdom
Security, Directory, Messaging, Network & PC Consultant
Instant , Yahoo!=knighjm
  #4  
Old May 27th 04, 05:11 PM posted to uk.telecom.broadband
Ian Burley
external usenet poster
 
Posts: 8
Default Is my router under attack?

No, it's inbound packets from NTL. The activity is intense even when no
local network PCs are switched on.

Ian

"Julian Knight" ] wrote in message
...
Ian Burley wrote:
I'm an NTL cable modem customer have also posted the following on an NTL
discussion group:

I am using a Netgear WGR614 wireless router connected to a Motorola
Surfboard cable modem. I'm connected to the 1MB service.

During the last few days I have noticed that the Internet activity light

is
flickering away even when none of the networked PCs are switched on. I

have
also had to reset (power cycle) the router occasionally - something that

has
not been necessary before.

The wireless section of the router is set to maximum security (128bit

WEP,
Mac addresses of connected machines required, etc.) and no unwanted

wireless
guests are showing up on the status and log resources.

Maybe an unconnected problem, but I'll mention it anyway - I have

noticed
that visiting one particular site (one that I visit routinely as part of

my
work) now seems to co-incide with Internet access dying, requiring a

router
reset.

Is this all a bit mysterious?

Any insight into the above would be very welcome. I'm based in the Hemel
Hempstead (NTL Luton?) area.

Thanks in advance,

I would have thought it more likely to be some spyware or trojan on a PC.
Try running AdAware AND Spybot Search & Destroy and see if anything turns

up.

This is an area where a good personal firewall is useful as you can spot
such problems immediately.

--
Julian Knight, http://www.knightnet.org.uk/
Sheffield, United Kingdom
Security, Directory, Messaging, Network & PC Consultant
Instant , Yahoo!=knighjm



  #5  
Old May 27th 04, 05:12 PM posted to uk.telecom.broadband
Ian Burley
external usenet poster
 
Posts: 8
Default Is my router under attack?

We've analysed the packets and around half of them aren't admitted past the
router's firewall.

Ian

"Tiny Ramsden" wrote in message
. ..
Ian Burley wrote:

I'm an NTL cable modem customer have also posted the following on an NTL
discussion group:

I am using a Netgear WGR614 wireless router connected to a Motorola
Surfboard cable modem. I'm connected to the 1MB service.

During the last few days I have noticed that the Internet activity light
is flickering away even when none of the networked PCs are switched on.

I
have also had to reset (power cycle) the router occasionally - something
that has not been necessary before.

The wireless section of the router is set to maximum security (128bit

WEP,
Mac addresses of connected machines required, etc.) and no unwanted
wireless guests are showing up on the status and log resources.

Maybe an unconnected problem, but I'll mention it anyway - I have

noticed
that visiting one particular site (one that I visit routinely as part of
my work) now seems to co-incide with Internet access dying, requiring a
router reset.

Is this all a bit mysterious?


If your running Linux there is a good diagnostic program to exam the
traffic, sorry can't remember the name it was in last month's linuc

format.


Any insight into the above would be very welcome. I'm based in the Hemel
Hempstead (NTL Luton?) area.

Thanks in advance,

Ian


--
Lioncom adsl 4 port router, Nildram adsl running on Redhat 7.3. You can

see
and hear me and my pal Joe Longthorne on uktalent.org.



  #6  
Old May 27th 04, 11:08 PM posted to uk.telecom.broadband
Julian Knight
external usenet poster
 
Posts: 56
Default Is my router under attack?

Ian Burley wrote:
No, it's inbound packets from NTL. The activity is intense even when no
local network PCs are switched on.

Ah, OK. Then it is possible that something is probing your address though
it may well be a misconfigured piece of network infrastructure somewhere
rather than an attack. The only real way to tell is to accept some of the
packets and do an analysis with Ethereal or something similar.

--
Julian Knight, http://www.knightnet.org.uk/
Sheffield, United Kingdom
Security, Directory, Messaging, Network & PC Consultant
Instant , Yahoo!=knighjm
  #7  
Old May 28th 04, 12:15 AM posted to uk.telecom.broadband
Mark McIntyre
external usenet poster
 
Posts: 1,835
Default Is my router under attack?

On Thu, 27 May 2004 16:11:50 +0100, "Ian Burley"
wrote:

No, it's inbound packets from NTL. The activity is intense even when no
local network PCs are switched on.


its just the usual ARP traffic. Forget about it.

  #8  
Old May 29th 04, 01:01 AM posted to uk.telecom.broadband
Lawrence Stromski
external usenet poster
 
Posts: 35
Default Is my router under attack?

Theres always a certain amount of background low-level traffic imho.

For example: if you use a P2P network or a network game and shut down your
PC, for a few minutes afterwards your router might be getting some UDP
traffic of other peers trying to contact your software.
Think of all the people on the net, imagine how many of them might be doing
pings, running port scanners, analysing IP addresses bla bla bla whatever
people get up to.
Then theres your ISP: may be checking your IP is still alive and there is a
device connected?
I don't know if any IM services do this: after you sign out of their network
or don't sign out gracefully do they attempt to contact your IP?
Are there any other users who know your IP address who are attempting to
contact services you run?
Does your router run any Dynamic DNS updater services? Does it use RIP? BGP?
NNTP?

There are billions and billions of possibilities. Just add up the traffic
from those above or a different combination of others. You get the picture
of how much background activity goes on. I frequently see my router blinking
late at night when all the computers are dark and silent. You could always
configure a disconnect-if-idle timeout if you don't like it.


--
-Lawrence Stromski.
http://www.wc3.co.uk
http://www.helpforce.com
"Mark McIntyre" wrote in message
...
On Thu, 27 May 2004 16:11:50 +0100, "Ian Burley"
wrote:

No, it's inbound packets from NTL. The activity is intense even when no
local network PCs are switched on.


its just the usual ARP traffic. Forget about it.



  #9  
Old May 29th 04, 10:58 AM posted to uk.telecom.broadband
SteveM
external usenet poster
 
Posts: 4
Default Is my router under attack?

I wouldn't worry about it. I use NTL broadband too and with a Limksys
Wireless Broadband Router and even if I power off all of my PCs the cable
modem still shows constant activity. Whatever it is, it's normal.

"Ian Burley" wrote in message
news:[email protected]
....
During the last few days I have noticed that the Internet activity light

is
flickering away even when none of the networked PCs are switched on. I

have
also had to reset (power cycle) the router occasionally - something that

has
not been necessary before.

....


 




Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)
 
Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Forum Jump

Similar Threads
Thread Thread Starter Forum Replies Last Post
Hack attack on ST 510v4? Pete Smith uk.telecom.broadband (UK broadband) 2 December 4th 03 12:36 AM


All times are GMT +1. The time now is 08:31 PM.


Powered by vBulletin® Version 3.6.4
Copyright ©2000 - 2019, Jelsoft Enterprises Ltd.Content Relevant URLs by vBSEO 2.4.0
Copyright 2004-2019 BroadbanterBanter.
The comments are property of their posters.