My RT-N66U logs are filled with these. Looks like two things are happening. One seems like an intrusion attempts where DST=75.x.x.x which is my WAN IP. Almost all src ip are from china.
And the other to 224.0.0.1 seems like a multicast thing from my modem (10.0.0.1).
First of all is my interpretation of these logs correct ? If so is it ok to block the multicast ? ISP is comcast. Anything else I need to check or worry about the intrusion attempts ?
Nov 13 19:45:08 kernel: DROP <4>DROP IN=eth0 OUT= MAC=01:00:5e:00:00:01:14:ab:f0:11:ed:71:08:00 <1>SRC=10.0.0.1 DST=224.0.0.1 <1>LEN=36 TOS=0x00 PREC=0x00 TTL=1 ID=0 DF OPT (94040000) PROTO=2
Nov 13 19:47:14 kernel: DROP <4>DROP IN=eth0 OUT= MAC=01:00:5e:00:00:01:14:ab:f0:11:ed:71:08:00 <1>SRC=10.0.0.1 DST=224.0.0.1 <1>LEN=36 TOS=0x00 PREC=0x00 TTL=1 ID=0 DF OPT (94040000) PROTO=2
Nov 13 19:49:19 kernel: DROP <4>DROP IN=eth0 OUT= MAC=01:00:5e:00:00:01:14:ab:f0:11:ed:71:08:00 <1>SRC=10.0.0.1 DST=224.0.0.1 <1>LEN=36 TOS=0x00 PREC=0x00 TTL=1 ID=0 DF OPT (94040000) PROTO=2
Nov 13 19:49:29 kernel: DROP <4>DROP IN=eth0 OUT= MAC=e0:3f:49:6a:38:88:00:14:f1:e8:a9:e2:08:00 <1>SRC=222.89.64.178 DST=75.73.92.101 <1>LEN=299 TOS=0x00 PREC=0x20 TTL=47 ID=0 DF PROTO=UDP <1>SPT=53 DPT=61687 LEN=279
Nov 13 19:51:24 kernel: DROP <4>DROP IN=eth0 OUT= MAC=01:00:5e:00:00:01:14:ab:f0:11:ed:71:08:00 <1>SRC=10.0.0.1 DST=224.0.0.1 <1>LEN=36 TOS=0x00 PREC=0x00 TTL=1 ID=0 DF OPT (94040000) PROTO=2
Nov 13 19:53:29 kernel: DROP <4>DROP IN=eth0 OUT= MAC=01:00:5e:00:00:01:14:ab:f0:11:ed:71:08:00 <1>SRC=10.0.0.1 DST=224.0.0.1 <1>LEN=36 TOS=0x00 PREC=0x00 TTL=1 ID=0 DF OPT (94040000) PROTO=2
Nov 13 19:55:34 kernel: DROP <4>DROP IN=eth0 OUT= MAC=01:00:5e:00:00:01:14:ab:f0:11:ed:71:08:00 <1>SRC=10.0.0.1 DST=224.0.0.1 <1>LEN=36 TOS=0x00 PREC=0x00 TTL=1 ID=0 DF OPT (94040000) PROTO=2
Nov 13 19:56:30 kernel: DROP <4>DROP IN=eth0 OUT= MAC=e0:3f:49:6a:38:88:00:14:f1:e8:a9:e2:08:00 <1>SRC=222.186.21.209 DST=75.73.92.101 <1>LEN=40 TOS=0x00 PREC=0x20 TTL=101 ID=256 PROTO=TCP <1>SPT=6000 DPT=8088 SEQ=931266560 ACK=0 WINDOW=16384 RES=0x00 SYN URGP=0
Nov 13 19:57:39 kernel: DROP <4>DROP IN=eth0 OUT= MAC=01:00:5e:00:00:01:14:ab:f0:11:ed:71:08:00 <1>SRC=10.0.0.1 DST=224.0.0.1 <1>LEN=36 TOS=0x00 PREC=0x00 TTL=1 ID=0 DF OPT (94040000) PROTO=2
Nov 13 19:59:44 kernel: DROP <4>DROP IN=eth0 OUT= MAC=01:00:5e:00:00:01:14:ab:f0:11:ed:71:08:00 <1>SRC=10.0.0.1 DST=224.0.0.1 <1>LEN=36 TOS=0x00 PREC=0x00 TTL=1 ID=0 DF OPT (94040000) PROTO=2
Nov 13 20:00:10 kernel: DROP <4>DROP IN=eth0 OUT= MAC=e0:3f:49:6a:38:88:00:14:f1:e8:a9:e2:08:00 <1>SRC=95.211.168.135 DST=75.73.92.101 <1>LEN=40 TOS=0x00 PREC=0x20 TTL=241 ID=42776 PROTO=TCP <1>SPT=30598 DPT=80 SEQ=1866770201 ACK=0 WINDOW=3036 RES=0x00 SYN URGP=0
Nov 13 20:00:10 kernel: DROP <4>DROP IN=eth0 OUT= MAC=e0:3f:49:6a:38:88:00:14:f1:e8:a9:e2:08:00 <1>SRC=95.211.168.135 DST=75.73.92.101 <1>LEN=40 TOS=0x00 PREC=0x20 TTL=241 ID=42777 PROTO=TCP <1>SPT=30598 DPT=80 SEQ=1866770202 ACK=0 WINDOW=3036 RES=0x00 SYN URGP=0
Nov 13 20:00:55 kernel: DROP <4>DROP IN=eth0 OUT= MAC=e0:3f:49:6a:38:88:00:14:f1:e8:a9:e2:08:00 <1>SRC=23.24.131.164 DST=75.73.92.101 <1>LEN=44 TOS=0x00 PREC=0x20 TTL=49 ID=7544 PROTO=TCP <1>SPT=34242 DPT=3389 SEQ=3197230408 ACK=0 WINDOW=3072 RES=0x00 SYN URGP=0 OPT (020405B4)
Nov 13 20:00:55 kernel: DROP <4>DROP IN=eth0 OUT= MAC=e0:3f:49:6a:38:88:00:14:f1:e8:a9:e2:08:00 <1>SRC=23.24.131.164 DST=75.73.92.101 <1>LEN=44 TOS=0x00 PREC=0x20 TTL=45 ID=15204 PROTO=TCP <1>SPT=34243 DPT=3389 SEQ=3197164873 ACK=0 WINDOW=3072 RES=0x00 SYN URGP=0 OPT (020405B4)
And the other to 224.0.0.1 seems like a multicast thing from my modem (10.0.0.1).
First of all is my interpretation of these logs correct ? If so is it ok to block the multicast ? ISP is comcast. Anything else I need to check or worry about the intrusion attempts ?
Nov 13 19:45:08 kernel: DROP <4>DROP IN=eth0 OUT= MAC=01:00:5e:00:00:01:14:ab:f0:11:ed:71:08:00 <1>SRC=10.0.0.1 DST=224.0.0.1 <1>LEN=36 TOS=0x00 PREC=0x00 TTL=1 ID=0 DF OPT (94040000) PROTO=2
Nov 13 19:47:14 kernel: DROP <4>DROP IN=eth0 OUT= MAC=01:00:5e:00:00:01:14:ab:f0:11:ed:71:08:00 <1>SRC=10.0.0.1 DST=224.0.0.1 <1>LEN=36 TOS=0x00 PREC=0x00 TTL=1 ID=0 DF OPT (94040000) PROTO=2
Nov 13 19:49:19 kernel: DROP <4>DROP IN=eth0 OUT= MAC=01:00:5e:00:00:01:14:ab:f0:11:ed:71:08:00 <1>SRC=10.0.0.1 DST=224.0.0.1 <1>LEN=36 TOS=0x00 PREC=0x00 TTL=1 ID=0 DF OPT (94040000) PROTO=2
Nov 13 19:49:29 kernel: DROP <4>DROP IN=eth0 OUT= MAC=e0:3f:49:6a:38:88:00:14:f1:e8:a9:e2:08:00 <1>SRC=222.89.64.178 DST=75.73.92.101 <1>LEN=299 TOS=0x00 PREC=0x20 TTL=47 ID=0 DF PROTO=UDP <1>SPT=53 DPT=61687 LEN=279
Nov 13 19:51:24 kernel: DROP <4>DROP IN=eth0 OUT= MAC=01:00:5e:00:00:01:14:ab:f0:11:ed:71:08:00 <1>SRC=10.0.0.1 DST=224.0.0.1 <1>LEN=36 TOS=0x00 PREC=0x00 TTL=1 ID=0 DF OPT (94040000) PROTO=2
Nov 13 19:53:29 kernel: DROP <4>DROP IN=eth0 OUT= MAC=01:00:5e:00:00:01:14:ab:f0:11:ed:71:08:00 <1>SRC=10.0.0.1 DST=224.0.0.1 <1>LEN=36 TOS=0x00 PREC=0x00 TTL=1 ID=0 DF OPT (94040000) PROTO=2
Nov 13 19:55:34 kernel: DROP <4>DROP IN=eth0 OUT= MAC=01:00:5e:00:00:01:14:ab:f0:11:ed:71:08:00 <1>SRC=10.0.0.1 DST=224.0.0.1 <1>LEN=36 TOS=0x00 PREC=0x00 TTL=1 ID=0 DF OPT (94040000) PROTO=2
Nov 13 19:56:30 kernel: DROP <4>DROP IN=eth0 OUT= MAC=e0:3f:49:6a:38:88:00:14:f1:e8:a9:e2:08:00 <1>SRC=222.186.21.209 DST=75.73.92.101 <1>LEN=40 TOS=0x00 PREC=0x20 TTL=101 ID=256 PROTO=TCP <1>SPT=6000 DPT=8088 SEQ=931266560 ACK=0 WINDOW=16384 RES=0x00 SYN URGP=0
Nov 13 19:57:39 kernel: DROP <4>DROP IN=eth0 OUT= MAC=01:00:5e:00:00:01:14:ab:f0:11:ed:71:08:00 <1>SRC=10.0.0.1 DST=224.0.0.1 <1>LEN=36 TOS=0x00 PREC=0x00 TTL=1 ID=0 DF OPT (94040000) PROTO=2
Nov 13 19:59:44 kernel: DROP <4>DROP IN=eth0 OUT= MAC=01:00:5e:00:00:01:14:ab:f0:11:ed:71:08:00 <1>SRC=10.0.0.1 DST=224.0.0.1 <1>LEN=36 TOS=0x00 PREC=0x00 TTL=1 ID=0 DF OPT (94040000) PROTO=2
Nov 13 20:00:10 kernel: DROP <4>DROP IN=eth0 OUT= MAC=e0:3f:49:6a:38:88:00:14:f1:e8:a9:e2:08:00 <1>SRC=95.211.168.135 DST=75.73.92.101 <1>LEN=40 TOS=0x00 PREC=0x20 TTL=241 ID=42776 PROTO=TCP <1>SPT=30598 DPT=80 SEQ=1866770201 ACK=0 WINDOW=3036 RES=0x00 SYN URGP=0
Nov 13 20:00:10 kernel: DROP <4>DROP IN=eth0 OUT= MAC=e0:3f:49:6a:38:88:00:14:f1:e8:a9:e2:08:00 <1>SRC=95.211.168.135 DST=75.73.92.101 <1>LEN=40 TOS=0x00 PREC=0x20 TTL=241 ID=42777 PROTO=TCP <1>SPT=30598 DPT=80 SEQ=1866770202 ACK=0 WINDOW=3036 RES=0x00 SYN URGP=0
Nov 13 20:00:55 kernel: DROP <4>DROP IN=eth0 OUT= MAC=e0:3f:49:6a:38:88:00:14:f1:e8:a9:e2:08:00 <1>SRC=23.24.131.164 DST=75.73.92.101 <1>LEN=44 TOS=0x00 PREC=0x20 TTL=49 ID=7544 PROTO=TCP <1>SPT=34242 DPT=3389 SEQ=3197230408 ACK=0 WINDOW=3072 RES=0x00 SYN URGP=0 OPT (020405B4)
Nov 13 20:00:55 kernel: DROP <4>DROP IN=eth0 OUT= MAC=e0:3f:49:6a:38:88:00:14:f1:e8:a9:e2:08:00 <1>SRC=23.24.131.164 DST=75.73.92.101 <1>LEN=44 TOS=0x00 PREC=0x20 TTL=45 ID=15204 PROTO=TCP <1>SPT=34243 DPT=3389 SEQ=3197164873 ACK=0 WINDOW=3072 RES=0x00 SYN URGP=0 OPT (020405B4)