i have a question about traffic going through my wireless modem/router
i see a bunch of IPs that are trying to access when i look at my logs on routerlogin.net
and they look to be from china and other bad places
how do i know what they are doing and if i am part of a botnet?
i am on windows 7
malwarebytes, spybot, avg and adaware all clean

please go easy on me, i am a mac guy

You can use wireshark to analyze traffic.

Traffic attacks from China, Russia, etc happens daily.  Nothing you can do about that but just make sure your router's firewall is not opened up.

With spybot, malware, avg, adaware saying all clean means you are *probably* good to go.

Any unsual stuff that might indicate you are part of a botnet?

nothing unusual
modem lights not even blinking send/receive (which scares me if i'm not doing anything and it's blinking like crazy)
only thing that is different is that i cannot access ONE website i always go to
none of the computers attached to the modem/router can get on the site (2 windows 7, one mac)
(even my iphone when on wifi- if i turn off wifi and go 3g/4g, it works)
i didn't make any changes to my modem settings or parental controls
i guess it is possible that road runner/time warner is blocking that site, but it works on rr at home

Traffic attacks from China, Russia, etc happens daily.  Nothing you can do about that but just make sure your router's firewall is not opened up.

With spybot, malware, avg, adaware saying all clean means you are *probably* good to go.

Any unsual stuff that might indicate you are part of a botnet?

ok, so this shows up in the router logs

[LAN access from remote] from 124.158.45.19:64915 to 192.168.1.3:54303, Friday, Mar 15,2013 10:25:31

124.185.45.19 is the phillippines

and i found a whole bunch more
[LAN access from remote] from 218.212.162.102:58271 to 192.168.1.3:38888, Friday, Mar 15,2013 09:35:47
[LAN access from remote] from 82.155.242.55:15940 to 192.168.1.3:38888, Friday, Mar 15,2013 09:35:47
[LAN access from remote] from 202.160.16.141:6315 to 192.168.1.3:38888, Friday, Mar 15,2013 09:35:46
[LAN access from remote] from 92.113.78.48:50425 to 192.168.1.3:38888, Friday, Mar 15,2013 09:35:46
[LAN access from remote] from 187.65.188.203:15421 to 192.168.1.3:38888, Friday, Mar 15,2013 09:35:46
[LAN access from remote] from 203.113.146.236:45682 to 192.168.1.3:38888, Friday, Mar 15,2013 09:35:45
[LAN access from remote] from 221.127.196.214:49521 to 192.168.1.3:38888, Friday, Mar 15,2013 09:35:45
[LAN access from remote] from 75.95.234.210:56921 to 192.168.1.3:38888, Friday, Mar 15,2013 09:35:45
[LAN access from remote] from 99.74.251.81:62282 to 192.168.1.3:38888, Friday, Mar 15,2013 09:35:45
[LAN access from remote] from 1.170.47.173:14757 to 192.168.1.3:38888, Friday, Mar 15,2013 09:35:45
[LAN access from remote] from 111.242.195.248:22957 to 192.168.1.3:38888, Friday, Mar 15,2013 09:35:44
[LAN access from remote] from 37.106.46.88:18448 to 192.168.1.3:38888, Friday, Mar 15,2013 09:35:44
[LAN access from remote] from 2.27.193.210:27341 to 192.168.1.3:38888, Friday, Mar 15,2013 09:35:43
[LAN access from remote] from 79.50.239.141:34991 to 192.168.1.3:38888, Friday, Mar 15,2013 09:35:43
[LAN access from remote] from 123.243.167.133:48250 to 192.168.1.3:38888, Friday, Mar 15,2013 09:35:42

is this bad?

nothing unusual
modem lights not even blinking send/receive (which scares me if i'm not doing anything and it's blinking like crazy)
only thing that is different is that i cannot access ONE website i always go to
none of the computers attached to the modem/router can get on the site (2 windows 7, one mac)
(even my iphone when on wifi- if i turn off wifi and go 3g/4g, it works)
i didn't make any changes to my modem settings or parental controls
i guess it is possible that road runner/time warner is blocking that site, but it works on rr at home

That looks like peer-to-peer traffic above. If it is, there's nothing to worry about.

As far as I know, RR/TW doesn't block any sites, but who knows, they may have a misconfiguration some where or actually be blocking the site.

not doing peer-to-peer at that time
and logs show the same activity from the philippines

i am going to shut down my modem for a bit, but i would appreciate someone telling me what i should do

mahalos

That looks like peer-to-peer traffic above. If it is, there's nothing to worry about.

As far as I know, RR/TW doesn't block any sites, but who knows, they may have a misconfiguration some where or actually be blocking the site.

rr/twc claims not to block any sites
i am suspicious that it is my router (since the site does not work on my iPhone if on wireless, but does on celluar data), but i have never changed any settings on it

That looks like peer-to-peer traffic above. If it is, there's nothing to worry about.

As far as I know, RR/TW doesn't block any sites, but who knows, they may have a misconfiguration some where or actually be blocking the site.

what about this?
i shut off my modem/router for a while and rebooted it after work

[DoS attack: IP Spoof] attack packets in last 20 sec from ip [192.168.1.9], Friday, Mar 15,2013 19:43:37
[DHCP IP: (192.168.1.3)] to MAC address E8:40:F2:68:F1:95, Friday, Mar 15,2013 19:07:01
[Time synchronized with NTP server] Friday, Mar 15,2013 19:06:58
[Internet connected] IP address: 74.87.49.83, Friday, Mar 15,2013 19:06:58
[Internet disconnected] Friday, Mar 15,2013 19:06:54
[DHCP IP: (192.168.1.2)] to MAC address 58:55:CA:F3:17:4F, Friday, Mar 15,2013 19:06:50
[Initialized, firmware version: V1.0.0.4_1.0.3] Friday, Mar 15,2013 19:06:48

rr/twc claims not to block any sites
i am suspicious that it is my router (since the site does not work on my iPhone if on wireless, but does on celluar data), but i have never changed any settings on it

what about this?
i shut off my modem/router for a while and rebooted it after work

[DoS attack: IP Spoof] attack packets in last 20 sec from ip [192.168.1.9], Friday, Mar 15,2013 19:43:37
[DHCP IP: (192.168.1.3)] to MAC address E8:40:F2:68:F1:95, Friday, Mar 15,2013 19:07:01
[Time synchronized with NTP server] Friday, Mar 15,2013 19:06:58
[Internet connected] IP address: 74.87.49.83, Friday, Mar 15,2013 19:06:58
[Internet disconnected] Friday, Mar 15,2013 19:06:54
[DHCP IP: (192.168.1.2)] to MAC address 58:55:CA:F3:17:4F, Friday, Mar 15,2013 19:06:50
[Initialized, firmware version: V1.0.0.4_1.0.3] Friday, Mar 15,2013 19:06:48

The bottom 6 lines are normal boot messages.

The top line appears to be coming from inside your own network. What device has the IP address 192.168.1.9 Whatever has this address was already on and assigned an IP address (Either manually or thru DHCP by your router) earlier and was already on when you booted the router. It could be a printer on the network or another computer. It is hard to determine what it is doing that is making your router think it is getting a DoS attack from within your own network.

ok thanks
makes sense
i noticed after i posted that the first three numbers were the same, so it could be from my network
just paranoid when i saw DoS

The bottom 6 lines are normal boot messages.

The top line appears to be coming from inside your own network. What device has the IP address 192.168.1.9 Whatever has this address was already on and assigned an IP address (Either manually or thru DHCP by your router) earlier and was already on when you booted the router. It could be a printer on the network or another computer. It is hard to determine what it is doing that is making your router think it is getting a DoS attack from within your own network.

1. Re traffic logs, what machine has ip 192.168.1.3?

The traffic does look like p2p traffic. Could 192.168.1.3 be running BT or perhaps playing some kind of multiplayer game?

Another remote possibility is stray BT traffic from someone else that had your external IP before?

2. Inability to access a website from your network can be caused by several things:

   2.1. blocked by anti malware software?  Not likely as your iPhone is unable to connect.

   2.2. bad DNS server or entry?  Try open up a command prompt window and type:

     nslookup <website domain>
    (Example: nslookup google.com)

     You can check the resulting IP against an online nslookup such as http://www.kloth.net/services/nslookup.php and see if you get the same IP address.  If the results are different, then you have a DNS problem somewhere.

   2.3. blocked by your firewall?  Have you done customization of your firewall settings or is it factory default?  It sounds like you may have. Any chance something done on the firewall might be blocking it?

thanks a bunch
i am guessing it is my router somehow, despite the fact that i have not changed the settings EVER
but no blocks are apparent on routerlogin.net
and i haven't downloaded and installed the parental controls software

i think i am going to research how to do a "return to factory settings" on my wireless router
but i will try the nslookup suggestion first

1. Re traffic logs, what machine has ip 192.168.1.3?

The traffic does look like p2p traffic. Could 192.168.1.3 be running BT or perhaps playing some kind of multiplayer game?

Another remote possibility is stray BT traffic from someone else that had your external IP before?

2. Inability to access a website from your network can be caused by several things:

   2.1. blocked by anti malware software?  Not likely as your iPhone is unable to connect.

   2.2. bad DNS server or entry?  Try open up a command prompt window and type:

     nslookup <website domain>
    (Example: nslookup google.com)

     You can check the resulting IP against an online nslookup such as http://www.kloth.net/services/nslookup.php and see if you get the same IP address.  If the results are different, then you have a DNS problem somewhere.

   2.3. blocked by your firewall?  Have you done customization of your firewall settings or is it factory default?  It sounds like you may have. Any chance something done on the firewall might be blocking it?

nope, not DNS problem
both IPs are the same

thanks for the assistance

1. Re traffic logs, what machine has ip 192.168.1.3?

The traffic does look like p2p traffic. Could 192.168.1.3 be running BT or perhaps playing some kind of multiplayer game?

Another remote possibility is stray BT traffic from someone else that had your external IP before?

2. Inability to access a website from your network can be caused by several things:

   2.1. blocked by anti malware software?  Not likely as your iPhone is unable to connect.

   2.2. bad DNS server or entry?  Try open up a command prompt window and type:

     nslookup <website domain>
    (Example: nslookup google.com)

     You can check the resulting IP against an online nslookup such as http://www.kloth.net/services/nslookup.php and see if you get the same IP address.  If the results are different, then you have a DNS problem somewhere.

   2.3. blocked by your firewall?  Have you done customization of your firewall settings or is it factory default?  It sounds like you may have. Any chance something done on the firewall might be blocking it?

There should be lots of instructions on google on how to get your router back to factory default.

if you get your router back to factory default, make sure to at least secure your wireless network if it is a wireless router.

If you have an unsecured wireless network, for all you know, your neighbor may be doing p2p using your network.

Good luck!

yeah, thanks found some instructions
just have to remember to write down all my settings and IPs just in case the autoconnect does not work

router is secure from the factory- password is not PASSWORD

There should be lots of instructions on google on how to get your router back to factory default.

if you get your router back to factory default, make sure to at least secure your wireless network if it is a wireless router.

If you have an unsecured wireless network, for all you know, your neighbor may be doing p2p using your network.

Good luck!

aw crap
modem reset to factory settings and site is still blocked
don't know what it could be now
other than rr/twc blocked it
i should go on an unsecured wireless connection and see if it works

yeah, thanks found some instructions
just have to remember to write down all my settings and IPs just in case the autoconnect does not work

router is secure from the factory- password is not PASSWORD