Strange entries in my routing table

[LH626]

Hi all,

I have a Linksys RT31P2 VoIP router that connects to our cable modem. Since there are sometimes several computers at once connected for repair or update, I connect one of the three ports on the router to a Netgear FS105 4 port switch which my computer and my wifes computer connect to. I occasionally log on to the router from my machine and check things out or make changes depending on the situation. One of the areas I frequent is the routing table. Usually, it only shows the WAN and the LAN computer connected (mine) but in the last two days, there has been numerous supposedly LAN connected ip's with high hop counts (165) which resolve to either various national ISP's or to the DoD Network Information Center. I have changed the password on the router but is there anything else I can do to prevent this or most importantly, can anyone tell me what the heck this is. They go away if I reset the router or turn it off but it's come back twice in 2 days. Help!

[johnwill]

I'd scan the computer for malware, because being a wired router, I can't imagine anyone cracking in any other way. As you say, you've changed the password.

I'm not familiar with that specific router, can you post a screen shot of the entries in question?

[LH626]

I will when it happens again. I should have made a copy of it but I think I might know the source of the problem. I've checked my wifes computer and there's nothing there. Same for mine. But my daughter connects her laptop to check mail and whatnot and both times she was connected when I noticed the list of ip's in there. I'm going to check her computer when she gets home. Question, are those ip's brought upon by some sort of trojan?

[johnwill]

It's really impossible to say where they're coming from, but I suspect a malware scan of the machine in question is at the top of the list.

[LH626]

Ok, here it is again and this time I have an image of the routing table. I also scanned all computers that are always or even sometimes connected including my daughters laptop with nothing found out of the usual tracking cookies. No malware on any of the machines. This is fricking wierd and I feel like I'm being spied on by a hacker. This is a wired router and switch. What gives? I notice though that when this condition exists, my connection acts goofy, pages take longer to load, links will revert back to the page I started from instead of the link itself and so on.



Turning the router off resets the table back to normal. Anybody ever seen this before and if so, can you tell me how this is being accomplished?

[krishananda]

looks like someone or something poisoned your routing table or maybe even malfunction on the router. have you tried to update the firmware?

[LH626]

Thanks for the response,
The firmware was updated to the latest update at the time which was about 2-3 years ago. Any other updates from then on would not work as this particular router was created and built by Linksys but is under the control and license of Vonage so Linksys firmware updates don't work. But it has been working fine ever since then up until just recently. Interesting idea about the table being poisoned though. What/who could do this? How was it done? Is there a fix/work around for it?

[Ryan133]

I'm getting similar entries. Do you have a Tivo on your network?

[LH626]

No. No tivo installed. This has gone away as mysteriously as it has appeared. It has been working fine since the last reboot of the router which was sometime in August. I still feel like I've been spied upon by some outside source but those entries were listed as LAN, not WAN. It's gone now though so unless it comes back, I'm just going to forget all about it. All passwords on all systems here have been reset to random 12 digit alpha numerics which is a pain since I had to read off a cheat sheet for a while just to log on all of our computers or the router itself.

[johnwill]

The weird subnet mask almost makes this look like a hardware malfunction in the router. Maybe it's time for a new router?