Base Station Log (MN-500)

Can anyone tell me what these entries mean?:


2004/06/04 13:14:04 DeletePortMapping: ExternalPort:12772, UDP
2004/06/04 13:14:04 DeletePortMapping: ExternalPort:43243, TCP
2004/06/04 13:14:05 AddPortMapping: ExternalPort:36089, UDP,
InternalPort:15164, InternalClient:XXX.XXX.X.XX
2004/06/04 13:14:05 AddPortMapping: ExternalPort:63726, TCP,
InternalPort:11336, InternalClient:XXX.XXX.X.XX

I've replaced my ip with X's.

2004/06/04 13:25:22 Client filtering settings blocked connection from IP
address <68.146.73.150>


Are these all a concern? If so, why and how do I correct them?

Thanks
--
-----<snip>-----
Cut the snippy to reply in email.

The port mappings are added by software running on your
computer (could be a regular program or spyware, although
spyware is typically not that well behaved). I get TCP
port mappings for Outlook. Are you running a program that
uses TCP and UDP? Try shutting down the software you are
running (e.g. Messenger, etc.) one by one, and look at
the logs after each program terminates -- you should see
a DeletePort mapping coming.

The InternalClient appears when a PC within the LAN gets
assigned an IP through DHCP. You can lookup the name of
the PC in the Home page of the router under DHCP Client
List

The Client Filtering is an ICMP port scan (a Ping) -- it
appears when Discard Pings is selected (the message is
mislabeled). It just states that someone pinged your IP
and the Ping was discarded by the router.

>-----Original Message-----
>Can anyone tell me what these entries mean?:
>
>
>2004/06/04 13:14:04 DeletePortMapping:
ExternalPort:12772, UDP
>2004/06/04 13:14:04 DeletePortMapping:
ExternalPort:43243, TCP
>2004/06/04 13:14:05 AddPortMapping: ExternalPort:36089,
UDP,
>InternalPort:15164, InternalClient:XXX.XXX.X.XX
>2004/06/04 13:14:05 AddPortMapping: ExternalPort:63726,
TCP,
>InternalPort:11336, InternalClient:XXX.XXX.X.XX
>
>I've replaced my ip with X's.
>
>2004/06/04 13:25:22 Client filtering settings blocked
connection from IP
>address <68.146.73.150>
>
>
>Are these all a concern? If so, why and how do I correct
them?
>
>Thanks
>--
>-----<snip>-----
>Cut the snippy to reply in email.
>.
>

Dear Seymour,

This looks like the footprint of MSFT Messenger pre-5.0.
Upgrade to 5.0x and this wiill not occur.

>-----Original Message-----
>Can anyone tell me what these entries mean?:
>
>
>2004/06/04 13:14:04 DeletePortMapping:
ExternalPort:12772, UDP
>2004/06/04 13:14:04 DeletePortMapping:
ExternalPort:43243, TCP
>2004/06/04 13:14:05 AddPortMapping: ExternalPort:36089,
UDP,
>InternalPort:15164, InternalClient:XXX.XXX.X.XX
>2004/06/04 13:14:05 AddPortMapping: ExternalPort:63726,
TCP,
>InternalPort:11336, InternalClient:XXX.XXX.X.XX
>
>I've replaced my ip with X's.
>
>2004/06/04 13:25:22 Client filtering settings blocked
connection from IP
>address <68.146.73.150>
>
>
>Are these all a concern? If so, why and how do I correct
them?
>
>Thanks
>--
>-----<snip>-----
>Cut the snippy to reply in email.
>.
>

<(E-Mail Removed)> wrote in news:1812c01c44a71
$3030a230$(E-Mail Removed):

> The port mappings are added by software running on your
> computer (could be a regular program or spyware, although
> spyware is typically not that well behaved). I get TCP
> port mappings for Outlook. Are you running a program that
> uses TCP and UDP? Try shutting down the software you are
> running (e.g. Messenger, etc.) one by one, and look at
> the logs after each program terminates -- you should see
> a DeletePort mapping coming.
>
> The InternalClient appears when a PC within the LAN gets
> assigned an IP through DHCP. You can lookup the name of
> the PC in the Home page of the router under DHCP Client
> List
>
> The Client Filtering is an ICMP port scan (a Ping) -- it
> appears when Discard Pings is selected (the message is
> mislabeled). It just states that someone pinged your IP
> and the Ping was discarded by the router.

Great reply. Thanks. I am not running anything out of the usual. Just
started looking at the logs in the last few days and started noticing
things like I posted. I scan everyday for spyware etc. As long as it is
nothing to worry about, then I am happy. I guess I should learn more
about this internal stuff.

--
-----<snip>-----
Cut the snippy to reply in email.

This link will tell you more about what the entries you are seeing mean.

http://www.microsoft.com/hardware/br..._log_file.mspx

Seymour Butts wrote:

> Can anyone tell me what these entries mean?:
>
>
> 2004/06/04 13:14:04 DeletePortMapping: ExternalPort:12772, UDP
> 2004/06/04 13:14:04 DeletePortMapping: ExternalPort:43243, TCP
> 2004/06/04 13:14:05 AddPortMapping: ExternalPort:36089, UDP,
> InternalPort:15164, InternalClient:XXX.XXX.X.XX
> 2004/06/04 13:14:05 AddPortMapping: ExternalPort:63726, TCP,
> InternalPort:11336, InternalClient:XXX.XXX.X.XX
>
> I've replaced my ip with X's.
>
> 2004/06/04 13:25:22 Client filtering settings blocked connection from IP
> address <68.146.73.150>
>
>
> Are these all a concern? If so, why and how do I correct them?
>
> Thanks

joker <no-(E-Mail Removed)> wrote:

> http://www.microsoft.com/hardware/br...concept_log_fi
> le.mspx

Perfect, thankyou.

--
-----<snip>-----
Cut the snippy to reply in email.