log errors, what is this?

[Gregh]

I'm seeing many errors like this in my logs. I can post more but this is a small snippet. I have a gt-ac5300 router running firmware 3.0.0.4.384.81686



May 5 19:18:00 kernel: DROP IN=eth0 OUT= MAC=0c:9d:92:ab:69:a0:00:01:5c:ab:62:46:08:00 SRC=198.255.6.34 DST=73.129.208.175 LEN=44 TOS=0x00 PREC=0x20 TTL=47 ID=36497 DF PROTO=UDP SPT=53049 DPT=1047 LEN=24 MARK=0x8000000
May 5 19:18:00 kernel: DROP IN=eth0 OUT= MAC=0c:9d:92:ab:69:a0:00:01:5c:ab:62:46:08:00 SRC=198.16.76.130 DST=73.129.208.175 LEN=44 TOS=0x00 PREC=0x20 TTL=51 ID=3302 DF PROTO=UDP SPT=26457 DPT=1047 LEN=24 MARK=0x8000000
May 5 19:18:00 kernel: DROP IN=eth0 OUT= MAC=0c:9d:92:ab:69:a0:00:01:5c:ab:62:46:08:00 SRC=50.7.114.59 DST=73.129.208.175 LEN=44 TOS=0x00 PREC=0x20 TTL=53 ID=60346 DF PROTO=UDP SPT=34003 DPT=1047 LEN=24 MARK=0x8000000
May 5 19:18:00 kernel: DROP IN=eth0 OUT= MAC=0c:9d:92:ab:69:a0:00:01:5c:ab:62:46:08:00 SRC=198.16.70.106 DST=73.129.208.175 LEN=44 TOS=0x00 PREC=0x20 TTL=51 ID=11105 DF PROTO=UDP SPT=39002 DPT=1047 LEN=24 MARK=0x800000

 

[ColinTaylor]

You have configured your router's firewall to log dropped packets. Change it to "None".

 

[Gregh]

You have configured your router's firewall to log dropped packets. Change it to "None".

yes thats true but why i am seeing these?

 

[ColinTaylor]

It's background noise from the internet. All IP addresses are constantly being scanned and catalogued. For example, SHODAN knows that you have enabled web and VPN access on your router.

 

[Gregh]

It's background noise from the internet. All IP addresses are constantly being scanned and catalogued. For example, SHODAN knows that you have enabled web and VPN access on your router.

what is SHODAN?

 

[ColinTaylor]

what is SHODAN?

https://en.wikipedia.org/wiki/Shodan_(website)

Basically it's a global port scanner.

 

[Gregh]

https://en.wikipedia.org/wiki/Shodan_(website)

Basically it's a global port scanner.

ok interesting, how did you use it for my router based on the snippet from my logs?

 

[ColinTaylor]

ok interesting, how did you use it for my router based on the snippet from my logs?

Because your logs include your public IP address and I asked SHODAN to tell me what it knew about it.