[Trebor901]

Hi last night i checked my routers "Security Log" and i found this line appearing every sort of 10 minutes:

kernel: Intrusion -> IN=ppp_0_38_1 OUT= MAC= SRC=219.148.119.6 DST=172.141.192.159 LEN=40 TOS=0x00 PREC=0x00 TTL=104 ID=256 DF PROTO=TCP SPT=12200 DPT=7212 WINDOW=8192 RES=0x00 SYN URGP=0

Is this something i should be worried about or is it just something that happens when having a router.

[Frank4d]

It looks like a computer in China: http://isc.incidents.org/ipinfo.html?ip=219.148.119.006 trying to access your AOL IP. It's ok as long as they don't actually get in, happens all the time. If they are getting past the router, well that is different.

[Trebor901]

Well i havent got the network setup so you can access files from the pc's on the network so they wouldnt be able to do anything if they did get past the router anyway would they?

[Trebor901]

Sometimes i get this aswell : kernel: eth1 Link UP.

[Tritone]

Hi Trebor,

Basically, SPT=12200 DPT=7212 means "source port 12000 and destination port 7212".

It means something scanned your IP to see if you were open on port 7212.

This is a pretty normal thing to see in a firewall log anywhere. It is very common. There are bots and people who can ports looking for open proxies. 7212 is a tcp port used by a well known open proxy - meaning someone could surf the Internet, send spam, etc through your proxy IF it was open and you didn't have a firewall.

This is simply your firewall telling you it did it's job. You'll see similar entries for other ports, especially ports in the 1020-1030 range which are old Microsoft pop up ports that would let you send pop up messages to people on your local LAN. (or let spammers send you pop up ads).

The other line is just your firewall router telling you it's inside Ethernet interface is up.

This is all normal activity and you don't have anything to worry about. Your firewall is doing it's job and it is good you are monitoring the logs.

If you don't already monitor and keep historical logs, you should. Install something like Kiwi Syslog and set your PC up to receive the logs from your firewall.

Cheers,

T