[Dshield] incoming traffic from 192.168.0.1 ????

Marty Keane mkeane89 at pacbell.net
Tue Jul 24 19:49:17 GMT 2001


Hello all,

I'm new to the list so I hope I'm on target with my question. I'm using
the linksys
router with the latest firmware with a windows 98 machine. I just
started logging my incoming
traffic to the firewall and recently found something very disturbing.
Hopefully there's a simple
explanation. Here are the entries AM (PST)

remote addr
remote port                local port
----------------------------------------------------------------------------------------

11:26:51  (first three entries)

169.254.61.126
137                            137
192.168.0.1
137                            137
adsl-64-160-96-149.dsl.bkfd14.pacbell.net
137                            137

11:27:19 (remaining entries)

169.254.61.126
137                            137
192.168.0.1
137                            137
adsl-64-160-96-149.dsl.bkfd14.pacbell.net
137                            137
192.168.0.1
137                            137
169.254.61.126
137                            137

My apologies if there is some other formal way of raising this issue,
but the fact that it's
an internal looking address has me concerned. I'm aware of the net-bios
issue with windows
machines and I've cloaked my router. One last note is that 192.168.0.1
is neither
my router's ip nor an ip of a machine on my LAN.

Any insight would be greatly appreciated! Right now I've got my LAN down
and I
am afraid to bring it up until I know what's going on :-/


Marty




More information about the list mailing list