TechSpot

Am I being hacked? IP Spoofing

By rusta
Apr 25, 2006
  1. This is the log from my Belkin F5D6231-4 Router.

    Can someone tell me:

    Am I being hacked?
    Where it says "IP Spoofing". Is my router blocking this?
    If not, what can I do?


    Log File
    Mon Apr 24 22:31:44 2006 : Enable DayLight Saving : 01/01 ~ 12/31
    Mon Apr 24 21:31:44 2006 : Disable DayLight Saving : 01/01 ~ 12/31
    Mon Apr 24 22:24:09 2006 : 125.125.125.59 login successfully
    Mon Apr 24 22:10:10 2006 : 140.6.20.0 login successfully
    Mon Apr 24 22:08:55 2006 : 140.6.20.0 login successfully
    Mon Apr 24 22:07:39 2006 : 140.6.20.0 login successfully
    Mon Apr 24 22:06:24 2006 : 125.125.125.46 login successfully
    Mon Apr 24 08:48:58 2006 : **IP Spoofing** Source IP:125.27.39.154 Port:0 Dest IP:68.160.0.74 Port:1026
    Sat Apr 22 11:51:27 2006 : **IP Spoofing** Source IP:125.93.175.142 Port:50244 Dest IP:x.x.x.x Port:1029
    Sat Apr 22 11:51:27 2006 : **IP Spoofing** Source IP:125.93.175.142 Port:50244 Dest IP:x.x.x.x Port:1028
    Sat Apr 22 11:51:27 2006 : **IP Spoofing** Source IP:125.93.175.142 Port:50244 Dest IP:x.x.x.x Port:1027
    Sat Apr 22 11:51:27 2006 : **IP Spoofing** Source IP:125.93.175.142 Port:50244 Dest IP:x.x.x.x Port:1026
    Sat Apr 22 11:51:27 2006 : **IP Spoofing** Source IP:125.93.175.142 Port:50244 Dest IP:x.x.x.x Port:1025
    Thu Jan 01 00:00:16 1970 : Secondary DNS address 151.203.0.84
    Thu Jan 01 00:00:16 1970 : Primary DNS address 141.154.0.68
    Thu Jan 01 00:00:16 1970 : local Secondary DNS address 151.203.0.84
    Thu Jan 01 00:00:16 1970 : local Primary DNS address 141.154.0.68
    Thu Jan 01 00:00:16 1970 : local IP address x.x.x.x
    Thu Jan 01 00:00:16 1970 : PPPoE starts PPP...
    Thu Jan 01 00:00:16 1970 : PPPoE receive PADS
    Thu Jan 01 00:00:16 1970 : PPPoE send PADR
    Thu Jan 01 00:00:16 1970 : PPPoE receive PADS
    Thu Jan 01 00:00:16 1970 : PPPoE send PADI
    Thu Jan 01 00:00:08 1970 : PPPoE send PADI
    Thu Jan 01 00:00:00 1970 : PPPoE send PADI
    Thu Jan 01 00:00:00 1970 : PPPoE Start...
     
  2. Nodsu

    Nodsu TS Rookie Posts: 5,837   +6

    I would be more worried about the "login succesfully" messages. No one should be able to log in to your router from the internet. Are you sure you have disabled remote administration from the web?

    I edited out your IP address.. If you think you have security issues, then it is not a good idea to let everyone know where a security hole is.
     
  3. Coolmatt

    Coolmatt TS Rookie Posts: 66

    I h4x0r$ 1n70 y0ur$ c0mpu73r! Hahahahah, now all your base are belong to us!!!...:p

    I agree with Nodsu, if you see a "Login Successfully" message from another IP address other than yours you need to be aware of that. Turn on your Firewall and protect your system.
     
  4. rusta

    rusta TS Rookie Topic Starter

    Thanks for editing out ip.
    My ip is dynamic, so I did not think it was issue.
    My router and pc has firewall enabled, remote admin is disabled and those login entries are from me.

    I want to know if I should worry about "Ip spoofing". Am I being spoofed?
     
  5. Nodsu

    Nodsu TS Rookie Posts: 5,837   +6

    Your router thinks you are.. Can't really say without knowing your exact network setup.

    If you have enabled intrusion detection or suchlike in the router config, then the "spoofed" datagrams are dropped, so nothing to worry about there.
     
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...