cancel
Showing results for 
Search instead for 
Did you mean: 

1000s of suspicious incoming network connection

1. sitting behind a router which I thought did all the firewall "work"

2. on a Windows10 client; how do I check whether these suspcious connections are a problem or not please.   I cannot find the full log.  pic of a sample. Thanks for any clues...

bt1.JPG

2 Replies
Highlighted

Re: 1000s of suspicious incoming network connection

Hi,

 

the 192.168.0.0-192.168.255.255 are reserved for private address space. those IP's are not routable via the internet.

https://www.arin.net/knowledge/address_filters.html

 

those connections are most likely coming from a device on the LAN side of your network since you have said ytour behind a NAt router that does the WAN firewall.

 

You could use the Home Network Scanner/Protect My Home Network in your McAfee product to see if you can identify the devices in question that match the IP's in your firewall log?

Re: 1000s of suspicious incoming network connection

Thanks for your reply.  One of the devices was a wifi repeater/booster thingy.   Anybody know if these can be/are hacked?  The McAfee report indicated a SSDP remote installation on UDP port 1900?  Normal stuff do you think?

Secondly, the screen print was a bad example. Lots of connection attempts were from the WAN.

As a precaution the router in question is being replaced (a factory reset would have sufficed but owner is adamant that a previous attack may have left traces all over.)