|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Modems/Cable/DSL/Satellite Fixing your connection devices; Cisco, Intel, Zoom, Linksys |
 |
|
|
LinkBack | Thread Tools |
02-03-2008, 02:51 AM
|
#1 (permalink) | |
|
Moderator Hardware Team
Join Date: Oct 2006
Location: Brit living in Greece
Posts: 7,472
OS: WinME, WinXP Pro SP3, Win7 Beta, Ubuntu 9.04 & Netbook Remix & CD2USB, Mepis 6.5, Fedora 10
|
Attack detected / Firewall triggered
I was checking out my router log today .. and found this
Quote:
Can anyone shed light on what this is 0000-00-00 00:54:12 E |CWMP |CWMP is attempting to connect to the ACS named http://111.111.111.111:1111/ACS-INTF. Also this attack .. is it connected to the Firewall alarms from the two different sites? 0000-00-00 00:00:56 E |Attack Detected |TCP packet with only FIN flag set - 81.183.114.73:63706 -> 91.140.17.190:31246 len=40 id=15594 IS there any way to know if anything got through ??? IS there anything that I should be doing to tighten down my security ?? All advice gratefully recieved ..
__________________
.  . I'm not old!! I'm age impaired  .. D_F I DON'T PLAY GAMES How to mark your thread as solved  HDD DIAG UTILS TSF's Photographer's Corner |
|
|
     
|
| Important Information |
|
Join the #1 Tech Support Forum Today - It's Totally Free!
TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free. Join TechSupportforum.com Today - Click Here |
|
02-03-2008, 10:17 AM
|
#2 (permalink) |
|
Manager, Networking Forums
Join Date: Sep 2002
Location: S.E. Pennsylvania, US
Posts: 41,654
OS: Windows 7, XP-Pro, Vista, Linux
Blog Entries: 1
|
Re: Attack detected / Firewall triggered
If it got through, it wouldn't be in the log.
 This kind of stuff shows up all the time in the logs.
__________________
If TSF has helped you, Tell us about it! or Donate to help keep the site up! Microsoft MVP - Windows Desktop Experience |
|
|
|
02-03-2008, 12:14 PM
|
#3 (permalink) |
|
Moderator Hardware Team
Join Date: Oct 2006
Location: Brit living in Greece
Posts: 7,472
OS: WinME, WinXP Pro SP3, Win7 Beta, Ubuntu 9.04 & Netbook Remix & CD2USB, Mepis 6.5, Fedora 10
|
Re: Attack detected / Firewall triggered
any idea what http://111.111.111.111:1111/ACS-INTF means .. trued to google it but came up with nothing .. doesn't look like a proper address unless its in the 127 range or maybe it's IPv6
__________________
. . I'm not old!! I'm age impaired .. D_F I DON'T PLAY GAMES How to mark your thread as solved HDD DIAG UTILS TSF's Photographer's Corner |
|
|
|
|
02-04-2008, 08:52 AM
|
#4 (permalink) |
|
Manager, Networking Forums
Join Date: Sep 2002
Location: S.E. Pennsylvania, US
Posts: 41,654
OS: Windows 7, XP-Pro, Vista, Linux
Blog Entries: 1
|
Re: Attack detected / Firewall triggered
I have no idea, looks like a cryptic web address, since it's sitting behind an http://
__________________
If TSF has helped you, Tell us about it! or Donate to help keep the site up! Microsoft MVP - Windows Desktop Experience |
|
|
|
|
05-15-2009, 02:03 AM
|
#5 (permalink) | ||
|
Registered User
Join Date: May 2009
Posts: 1
OS: OS/2 Warp 4.51
|
Re: Attack detected / Firewall triggered
Quote:
You can read much more about CWMP at these links below. It is not an attack, and it is harmless as it your Modem checking in with your ISP trying to connect to a private firmware delivery/basic configuration server owned by the ISP to make sure you have their latest bug fixed/latest feature release Firmware along with the basic connection type info for the DSL's VC (Virtual Circuit) settings. That's basically it in a nut shell. It is becoming the de factor standard for ISPs and other service providers (Cell phones, Wi-Fi devices, Set Top Boxes, and much more) to keep their customers equipment updated and secured. http://www.carricksolutions.com/TR-069/ http://en.wikipedia.org/wiki/TR-069 Quote:
http://www.broadband-forum.org/techn...Amendment2.pdf You can disable the CWMP agent/process if you like. Details are in the linked article below: Disabling the CWMP agent from CLI http://shadow.sentry.org/~trev/adsl4...mp_config.html As to security, your log just shows packets it didn't like and dropped. Likely it was a late response to a Browser or DNS, or Email request and the NAPT Table entry had expired so the Router was not expecting a response since that port was closed recently by NAT/NAPT table timeout. Test your Routers security responses by using these two test sites below. Set your Firewall to Off in the Modem/Router, yes Off as that only allows pings on the Routers WAN Interface and does not reduce your true security level (trust me the scan sill confirm this and also I've been using and setting up these Speedstreams since late 1999, beta tested firmware for a while when Efficient still owned them before Siemens bought them out and I own 8+ different Models including Business Class versions which I can swap out quickly for testing and configuration issues). Pings are not a real security risk even though one site (GRC.com) wants you to think that they are, but as long as your results show all Green Blocks after running the "All Service Ports Test" that is a solid determination on the status of your Routers first 1056 ports (Green aka Stealth means no response, not even a this port is closed response, just no acknowledgment  ). Red Blocks are items to be concerned with as those represent a port or ports that when checked, have replied "port number x here and I am open ready to accept connections." 
Regards, Doctor Olds |
||
|
|
|
|
05-15-2009, 11:40 AM
|
#6 (permalink) |
|
Moderator Hardware Team
Join Date: Oct 2006
Location: Brit living in Greece
Posts: 7,472
OS: WinME, WinXP Pro SP3, Win7 Beta, Ubuntu 9.04 & Netbook Remix & CD2USB, Mepis 6.5, Fedora 10
|
Re: Attack detected / Firewall triggered
Many, many thanks for your knowledgeable help which has confirmed my suspicions about some of the points I had raised. I had forgotten all about this topic which I started over a year ago .. but I still use the same router and the update in information is more than welcome.
The all ones address is exactly as I see it, nothing changed or hidden .. It just seems that it's trying to connect but either not allowed or the host not found, which seemed strange .. why bother ? Why not cut it out ? unless perhaps it's just there to keep the line up & running, There is a term for it which I forget now .. but I think it was a problem going back into win95/98 days when the line would suddenly stop responding until a patch was introduced Thanks for those links , I will be investigating very shortly .
__________________
. . I'm not old!! I'm age impaired .. D_F I DON'T PLAY GAMES How to mark your thread as solved HDD DIAG UTILS TSF's Photographer's Corner |
|
|
|
|
| Thread Tools | |
|
|
