Whats is Router Logs

4pr3nd1z · 10-19-2023, 06:07 PM

Hi guys,
I have a question, I'm not sure this is the place for my concern. Please excuse me.
It turns out that I have an Arris model HFC modem, the same one that the operator provides.
Entering the administration panel: -> Utilities -> System Logs
I find the following record somewhat intriguing, I want to know its meaning.

Specifically about the lines that are marked in bold

Code:

2023-10-19 18:38:18.00 [DOS]UDP Packet - Source:192.168.254.254,652 Destination:192.168.254.253,59446
2023-10-19 18:38:20.00 [PRIV TCP packet: ]TCP Packet - Source:222.103.170.183,56597 Destination:[IpPublic],23
2023-10-19 18:38:22.00 [UNPRIV TCP packet: ]TCP Packet - Source:95.214.55.244,44965 Destination:[IpPublic],3629
2023-10-19 18:38:27.00 [DOS]UDP Packet - Source:192.168.254.254,707 Destination:192.168.254.253,111
2023-10-19 18:38:30.00 [UNPRIV TCP packet: ]TCP Packet - Source:162.142.125.133,42575 Destination:[IpPublic],21872
2023-10-19 18:38:35.00 [DOS]UDP Packet - Source:192.168.254.254,756 Destination:192.168.254.253,59446
2023-10-19 18:38:42.00 [DOS]UDP Packet - Source:192.168.254.254,806 Destination:192.168.254.253,59446
2023-10-19 18:38:50.00 [DOS]UDP Packet - Source:192.168.254.254,857 Destination:192.168.254.253,111

Searching on Google, I found similar cases but without a positive resolution result.

In advance, very grateful for your help.

I leave as a reference links of blogs consulted:
- https://www.reddit.com/r/Network/com...ntermittently/
- https://linustechtips.com/topic/1416...ernal-~-modem/

Apparently it has to do with one of my devices that works on the 5G network.
- https://forums.tomshardware.com/thre...-time.3486503/

GlennsPref · 10-19-2023, 06:46 PM

Hi I'm no expert...

whois , a command that shows who an ip address belongs.

Code:

whois 192.168.254.253

and an article on ddos attacks

udp packets...https://www.cloudflare.com/en-gb/lea...-protocol-udp/

it looks to me as though your router is continually searching for systems on your network.

I'm pretty sure 192.168.254.254 is on a private network address. ref. https://en.wikipedia.org/wiki/Reserved_IP_addresses

Code:

192.168.0.0/16 	192.168.0.0–192.168.255.255 	65536 	Private network 	Used for local communications within a private network.[3]

I hope this helps you.

pan64 · 10-20-2023, 12:57 AM

I guess 192.168.254.254 is your router, but you need to know it.

allend · 10-21-2023, 12:44 AM

Without knowing the capabilities of the modem, my guess is the DOS indicates discovery of service, looking for attached network storage using NFS (portmap uses port 111) or Xsan (proprietary protocol reported to use ports 49152-65535).