Advice on router security alert?

It means that a host at BBC, a host presumably owned by a Mr. McElvana, and a third host sent a couple UDP packets to your netgear router (to ports that seem to be closed). And that your netgear router thinks that it might be a Denial-of-Service attack, for whatever reason.

With the given information that's all we can say.

cu

59cobalt

NOTE: Posting from groups.google.com (or some web-forums) dramatically reduces the chance of your post being seen. Find a real news server.

Missing timestamps, so it's hard to say. However the list was produced in this post, it makes it hard to read, but that's OK because there is virtually nothing interesting. There are six repeats of a UDP packet from some unidentified servers that may be in Chicago, destined for an ephemeral port often used by windoze for messaging. The fact that the first six alternate between two source addresses but use the same source port is interesting. UDP itself is stateless, so the source address could easily be spoofed (normal in messenger spam). The seventh packet is from a different host - perhaps rmclip4.rbsov.bbc.co.uk as the lookup implies. Pretty useless information, don't you think?

I've no idea what "tool" you attempted to use, but it's nearly worthless. It appears to be querying the ARIN whois server, which is a _step_ in the right direction, but there is no followup to the leads. "FCC Servers.net" has a referral server, but it returns nothing useful. Likewise, a hostname lookup shows rather clueless results.

67.159.44.179 alwayz.wazted.com.ar 67.159.44.180 is.lost.in.the.kingdom-of-anime.org 67.159.44.181 will.tradesex.net

Looking up other hosts (67.159.44.105 through 67.159.44.107, and

67.159.44.170) returns only the in-addr.arpa name which implies that fdcservers.net doesn't want you to know the actual name, or that they are to st00pid to be running a computer - your call.

Doing a search for the name 'fdcservers.net' in the Usenet newsgroups news.admin.net-abuse.* turns up lots of hits in 2003-2005, but not much of interest to me. You _are_ using a search engine to post - did you try using it for it's intended purpose of searching the web?

Totally useless tool. See

hints. There are five "Regional Internet Registry" - AFRINIC which handles Africa, APNIC which handles Asia and the Pacific, LACNIC which handles Central and South America, RIPE for Europe, and ARIN for North America and crumbs. Asking the wrong server will result in a hint (as here) to ask the right one. Here, the range 212.0.0.0 - 213.255.255.255 is delegated to RIPE (although there are some residual AFRINIC registrations from when RIPE was still doing registry for Africa).

Old guy