What does "unallowed access" mean in a router log?

Sep 04, 2006 4 Replies

Hello, all.



I am trying to decipher the following three lines from recent router logs of mine:



Thu Aug 31 10:31:35 2006 Unallowed access from 210.13.41.1:7799 to



192.168.1.151:22 protocol=6 rule=-1 Sun Sep 03 07:32:17 2006 Unallowed access from 88.116.151.228:35273 to
192.168.1.151:22 protocol=6 rule=-1 Sun Sep 03 07:32:20 2006 Unallowed access from 88.116.151.228:35273 to
192.168.1.151:22 protocol=6 rule=-1

Do these lines mean someone was able to get through my router on Port 22, or not?



Also, any idea what "protocol=6 rule=-1" means? Protocol 6 is TCP.



Thank you.


Someone tried to access your PC with ssh (port 22) I don't think that they got to the PC. You would have to look in the router manual what rule=-1 means.

That is about all i can tell without knowing what router model and software you have. (Even then i would have to try to find a manual ...)

Do you have a computer on your network with the address 192.168.1.151 ? If so; is that computer running Linux or *BSD? --> Check the logs on that PC! Is that computer running Windows? Firewall enabled? Good!

If you don't have a computer at that address: no damage done!

But most probaly that action got blocked in the router.

Rudy

Someone tried to access your PC with ssh (port 22) I don't think that they got to the PC. You would have to look in the router manual what rule=-1 means.

That is about all i can tell without knowing what router model and software you have. (Even then i would have to try to find a manual ...)

Do you have a computer on your network with the address 192.168.1.151 ? If so; is that computer running Linux or *BSD? --> Check the logs on that PC! Is that computer running Windows? Firewall enabled? Good!

If you don't have a computer at that address: no damage done!

But most probaly that action got blocked in the router.

Rudy

==

The 192.168.1.151 is an XP Pro box, with no firewall running. Not even the XP one.

Unfortunately, the router's manual is skimpy and doesn't explain what the "-1" rule is. Who knows?

The router is an Airlink101 AR504, a low-end replacement for my 2-year-old D-Link DI-604.

Had a quick look at the "User Manual"; Cold be better ...

I assume that "Rule -1" is the built in standard rule (default setting). But i'm not sure.

I'm still pretty sure that this connection attemp was blocked.

Rudy

Henrich wrote in news:44fc2c0a$0$19692$ snipped-for-privacy@free.teranews.com:

Its just telling you that it stopped someone from accessing your computer. So don tbe alaermed.

Join the Discussion

Have something to add? Share your thoughts — no account required.

Didn't find your answer?

Ask the community — no account required