RT-N12HP_B1 Hacked??

[Uniqorn]

Is there any one understand what the system log mean?


Aug 3 08:09:01 kernel: free:68 slab:2691 mapped:452 pagetables:68 bounce:0
Aug 3 08:09:01 kernel: Normal free:272kB min:720kB low:900kB high:1080kB active:6616kB inactive:7660kB present:32512kB pages_scanned:0 all_unreclaimable? no
Aug 3 08:09:01 kernel: lowmem_reserve[]: 0 0
Aug 3 08:09:01 kernel: Normal: 0*4kB 0*8kB 1*16kB 0*32kB 0*64kB 0*128kB 1*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 272kB
Aug 3 08:09:01 kernel: Swap cache: add 0, delete 0, find 0/0, race 0+0
Aug 3 08:09:01 kernel: Free swap = 0kB
Aug 3 08:09:01 kernel: Total swap = 0kB
Aug 3 08:09:01 kernel: Free swap: 0kB
Aug 3 08:09:01 kernel: 8192 pages of RAM
Aug 3 08:09:01 kernel: 0 pages of HIGHMEM
Aug 3 08:09:01 kernel: 919 reserved pages
Aug 3 08:09:01 kernel: 2447 pages shared
Aug 3 08:09:01 kernel: 0 pages swap cached
Aug 3 08:09:01 kernel: osl_ctfpool_add: skb alloc of len 1968 failed
Aug 3 08:09:01 kernel: swapper: page allocation failure. order:0, mode:0x20
Aug 3 08:09:01 kernel: Call Trace:
Aug 3 08:09:01 kernel: [<8000f1c0>] dump_stack+0x8/0x34
...

..
Aug 3 08:09:05 kernel: [<802e1bc8>] start_kernel+0x2fc/0x35c
Aug 3 08:09:05 kernel: Mem-info:
Aug 3 08:09:06 kernel: Normal per-cpu:
Aug 3 08:09:06 kernel: CPU 0: Hot: hi: 0, btch: 1 usd: 0 Cold: hi: 0, btch: 1 usd: 0
Aug 3 08:09:06 kernel: Active:1654 inactive:1915 dirty:0 writeback:0 unstable:0
Aug 3 08:09:06 kernel: free:68 slab:2691 mapped:452 pagetables:68 bounce:0
Aug 3 08:09:06 kernel: Normal free:272kB min:720kB low:900kB high:1080kB active:6616kB inactive:7660kB present:32512kB pages_scanned:0 all_unreclaimable? no
Aug 3 08:09:06 kernel: lowmem_reserve[]: 0 0
Aug 3 08:09:06 kernel: Normal: 0*4kB 0*8kB 1*16kB 0*32kB 0*64kB 0*128kB 1*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 272kB
Aug 3 08:09:06 kernel: Swap cache: add 0, delete 0, find 0/0, race 0+0
Aug 3 08:09:06 kernel: Free swap = 0kB
Aug 3 08:09:06 kernel: Total swap = 0kB
Aug 3 08:09:06 kernel: Free swap: 0kB
Aug 3 08:09:06 kernel: 8192 pages of RAM
Aug 3 08:09:06 kernel: 0 pages of HIGHMEM
Aug 3 08:09:06 kernel: 919 reserved pages
Aug 3 08:09:06 kernel: 2447 pages shared
Aug 3 08:09:06 kernel: 0 pages swap cached
Aug 3 08:09:06 kernel: osl_ctfpool_add: skb alloc of len 1968 failed
Aug 3 08:09:06 kernel: swapper: page allocation failure. order:0, mode:0x20
Aug 3 08:09:06 kernel: Call Trace:
Aug 3 08:09:06 kernel: [<8000f1c0>] dump_stack+0x8/0x34
...
Aug 3 08:09:06 kernel: 2447 pages shared
Aug 3 08:09:06 kernel: 0 pages swap cached
Aug 3 08:09:06 kernel: osl_ctfpool_add: skb alloc of len 1968 failed
...
Aug 3 08:09:07 kernel: osl_ctfpool_add: skb alloc of len 1968 failed
Aug 3 08:09:07 kernel: osl_ctfpool_add: skb alloc of len 1968 failed
Aug 3 20:03:51 kernel: printk: 47 messages suppressed.
Aug 3 20:03:51 kernel: eth1: received packet with own address as source address
Aug 3 23:08:34 kernel: eth1: received packet with own address as source address
Aug 3 23:38:56 kernel: eth1: received packet with own address as source address
Aug 3 23:39:31 kernel: eth1: received packet with own address as source address
Aug 3 23:40:41 kernel: eth1: received packet with own address as source address
Aug 3 23:41:49 kernel: eth1: received packet with own address as source address
Aug 4 02:45:29 kernel: eth1: received packet with own address as source address

Many thanks

 

[RMerlin]

At a quick glance it seems your router ran out of free RAM.

 

[Uniqorn]

Thanks a lot for your quick answer.

Yet, I'm still wondering… If it ran out of free RAM, what has triggered the processes which generated all the logs? Can these processes being seen as a reboot?

If so, why it reboot so many times?
If not, how to explain the following logs at 20:03:51?

Aug 3 20:03:51 kernel: printk: 47 messages suppressed.
Aug 3 20:03:51 kernel: eth1: received packet with own address as source address
Aug 3 23:08:34 kernel: eth1: received packet with own address as source address
…
Aug 3 23:41:49 kernel: eth1: received packet with own address as source address
Aug 4 02:45:29 kernel: eth1: received packet with own address as source address

Why these processes stopped at 20:03:51?
Moreover, what does "received packet with own address as source address" mean?

Much appreciated

 

[RMerlin]

Most likely cause of these error messages is either you have a loop in your network, or a client connected both through wifi and Ethernet.

Your log does not show any reboot, the datestamp never reverted back to the default boot time timestamp.

 

[Uniqorn]

I see.

Let's say that I supposed be the only one person have the access to the router. I am very sure that I have done nothing to the router during the time shown as the timestamp. Here are the further questions:

1. What do you mean for the "these error messages is either you have a loop in your network, or a client connected both through wifi and Ethernet"?

2. As you addressed, all the error messages does not show any reboot, while the router seems to be ran out of free RAM, can you identify that this is caused by the router itself, or someone else have logged in the router?

Your answer have enlightened me and may save my life!!!

 

[ColinTaylor]

1. Something like a wireless laptop that is also connected by Ethernet. Or you have other network equipment that creates multiple paths to the router. Examples of this would be a network switch that's cross-connected, or things like WiFi extenders or access points.

 

[RMerlin]

What do you mean for the "these error messages is either you have a loop in your network, or a client connected both through wifi and Ethernet"?

The "kernel: eth1: received packet with own address as source address" message indicates that.

As you addressed, all the error messages does not show any reboot, while the router seems to be ran out of free RAM, can you identify that this is caused by the router itself, or someone else have logged in the router?

It's unrelated to someone accessing the router. One common cause may be if you have a USB disk plugged into the router, and you are using file sharing off it (through SMB, or DLNA media serving). Another possible reason could be a bug in the router's firmware causing memory to gradually leak, that might be more common if the router hasn't been rebooted in multiple months. Try rebooting it, and also check for any available firmware update.