My firewall log

Dec 23, 2004 2 Replies

Hi



Just had a quick look at my netgear router logs and have a question.



Thu, 2004-12-23 14:15:56 - TCP packet dropped - Source:81.178.122.168 ,4750 WAN - Destination:81.178.151.34,445 LAN - [Inbound Default rule match] Thu, 2004-12-23 14:17:13 - TCP packet dropped - Source:81.178.95.110 ,3054 WAN - Destination:81.178.151.34,445 LAN - [Inbound Default rule match] Thu, 2004-12-23 14:17:17 - TCP packet dropped - Source:81.178.81.154 ,4427 WAN - Destination:81.178.151.34,445 LAN - [Inbound Default rule match] Thu, 2004-12-23 14:17:53 - TCP packet dropped - Source:81.178.236.48 ,1965 WAN - Destination:81.178.151.34,445 LAN - [Inbound Default rule match] Thu, 2004-12-23 14:21:24 - TCP packet dropped - Source:81.178.240.19 ,4465 WAN - Destination:81.178.151.34,135 LAN - [Inbound Default rule match]


81.178.151.34 = me (Dynamic IP, changes when I reboot)

The above is just a small part but 99% of the rest shows the same IP range (Pipex) my ISP being blocked on ports 135 and 445.



Whats happening? Surely I shouldn't be getting so may hits from my own ISP range?



Thanks.



Rich



If I compare your log with my own logs then I'd say that the above is perfectly normal.

formatting link
similar for 135. You might add the word 'worm' to the search.

Jason

Dont be surprised, its the same with every other ISP.

Personally I would recommend blocking but not logging NBT chatter on the outside interface.

Otherwise you'll fill logs up with ream upon ream of NBT crap and miss more important items.

greg

Join the Discussion

Have something to add? Share your thoughts — no account required.

Didn't find your answer?

Ask the community — no account required