Hacked or Not

[leehebs]

Hi all
a little advice please, over the last few weeks I have been using a lot of bandwith, on checking with my isp Hebrides.net I was told I had a signal going back and forwards from my router to there mast ( its wireless internet) yesterday, I supposedly used nearly 8 gb when I would normally use a couple if that. I was told to reset my router and upgrade the firmware which I have. so my question is does this log look abnormal. we only have 30gb monthly limit and this killing it

its a asus rt-n56u




Jan 1 00:00:29 kernel: Channel 36 : Dirty = 0, False CCA = 0, Busy Time = 0, Skip Channel = FALSE
Jan 1 00:00:29 kernel: Channel 40 : Dirty = 0, False CCA = 1, Busy Time = 55, Skip Channel = FALSE
Jan 1 00:00:29 kernel: Channel 44 : Dirty = 0, False CCA = 0, Busy Time = 0, Skip Channel = FALSE
Jan 1 00:00:29 kernel: Channel 48 : Dirty = 0, False CCA = 0, Busy Time = 0, Skip Channel = FALSE
Jan 1 00:00:29 kernel: Channel 52 : Dirty = 0, False CCA = 0, Busy Time = 0, Skip Channel = FALSE
Jan 1 00:00:29 kernel: Channel 56 : Dirty = 0, False CCA = 0, Busy Time = 0, Skip Channel = FALSE
Jan 1 00:00:29 kernel: Channel 60 : Dirty = 0, False CCA = 0, Busy Time = 0, Skip Channel = FALSE
Jan 1 00:00:29 kernel: Channel 64 : Dirty = 0, False CCA = 0, Busy Time = 0, Skip Channel = FALSE
Jan 1 00:00:29 kernel: Channel 100 : Dirty = 0, False CCA = 0, Busy Time = 0, Skip Channel = FALSE
Jan 1 00:00:29 kernel: Channel 104 : Dirty = 0, False CCA = 0, Busy Time = 0, Skip Channel = FALSE
Jan 1 00:00:29 kernel: Channel 108 : Dirty = 0, False CCA = 0, Busy Time = 0, Skip Channel = FALSE
Jan 1 00:00:29 kernel: Channel 112 : Dirty = 0, False CCA = 0, Busy Time = 0, Skip Channel = FALSE
Jan 1 00:00:29 kernel: Channel 116 : Dirty = 0, False CCA = 0, Busy Time = 0, Skip Channel = FALSE
Jan 1 00:00:29 kernel: Channel 120 : Dirty = 0, False CCA = 0, Busy Time = 0, Skip Channel = FALSE
Jan 1 00:00:29 kernel: Channel 124 : Dirty = 0, False CCA = 0, Busy Time = 0, Skip Channel = FALSE
Jan 1 00:00:29 kernel: Channel 128 : Dirty = 0, False CCA = 0, Busy Time = 0, Skip Channel = FALSE
Jan 1 00:00:29 kernel: Channel 132 : Dirty = 0, False CCA = 0, Busy Time = 0, Skip Channel = FALSE
Jan 1 00:00:29 kernel: Channel 136 : Dirty = 0, False CCA = 0, Busy Time = 0, Skip Channel = FALSE
Jan 1 00:00:29 kernel: Channel 140 : Dirty = 0, False CCA = 0, Busy Time = 0, Skip Channel = FALSE
Jan 1 00:00:29 kernel: Channel 149 : Dirty = 0, False CCA = 0, Busy Time = 0, Skip Channel = FALSE
Jan 1 00:00:29 kernel: Channel 153 : Dirty = 0, False CCA = 0, Busy Time = 0, Skip Channel = FALSE
Jan 1 00:00:29 kernel: Channel 157 : Dirty = 0, False CCA = 18, Busy Time = 988, Skip Channel = FALSE
Jan 1 00:00:29 kernel: Channel 161 : Dirty = 0, False CCA = 0, Busy Time = 0, Skip Channel = FALSE
Jan 1 00:00:29 kernel: Channel 165 : Dirty = 0, False CCA = 0, Busy Time = 0, Skip Channel = TRUE
Jan 1 00:00:29 kernel: Channel 0 : Dirty = 0, False CCA = 0, Busy Time = 0, Skip Channel = FALSE
Jan 1 00:00:29 kernel: Channel 0 : Dirty = 0, False CCA = 0, Busy Time = 0, Skip Channel = FALSE
Jan 1 00:00:29 kernel: =====================================================
Jan 1 00:00:29 kernel: Rule 1 CCA value : Min Dirtiness (Include extension channel) ==> Select Channel 36
Jan 1 00:00:29 kernel: Min Dirty = 0
Jan 1 00:00:29 kernel: ExChannel = 0 , 0
Jan 1 00:00:29 kernel: BW = 40
Jan 1 00:00:29 kernel: Main bssid = 00:0c:43:43:60:40
Jan 1 00:00:29 kernel: <==== rt28xx_init, Status=0
Jan 1 00:00:29 kernel: 0x1300 = 00064380
Jan 1 00:00:29 stop_nat_rules: apply the redirect_rules!
Jan 1 00:00:29 WAN Connection: Ethernet link down.
Jan 1 00:00:29 WAN Connection: Fail to connect with some issues.
Jan 1 00:00:30 dnsmasq[382]: warning: interface ppp1* does not currently exist
Jan 1 00:00:30 RT-N56U: start httpd
Jan 1 00:00:30 kernel: set watchdog pid as: 398
Jan 1 00:00:30 kernel: set watchdog pid as: 398
Jan 1 00:00:30 miniupnpd[413]: HTTP listening on port 60033
Jan 1 00:00:30 miniupnpd[413]: Listening for NAT-PMP traffic on port 5351
Jan 1 00:00:31 kernel: GDMA2_MAC_ADRH -- : 0x00005404
Jan 1 00:00:31 kernel: GDMA2_MAC_ADRL -- : 0xa6d2c688
Jan 1 00:00:31 kernel: eth3: ===> VirtualIF_open
Jan 1 00:00:41 pppd[424]: pppd 2.4.7 started by clachannet, uid 0
Jan 1 00:00:41 pppd[424]: Connected to 00:1a:e3:1e:54:1b via interface eth3
Jan 1 00:00:41 pppd[424]: Connect: ppp0 <--> eth3
Jan 1 00:00:43 pppd[424]: CHAP authentication succeeded
Jan 1 00:00:43 pppd[424]: peer from calling number 00:1A:E3:1E:54:1B authorized
Jan 1 00:00:43 pppd[424]: local IP address 80.80.190.86
Jan 1 00:00:43 pppd[424]: remote IP address 192.168.191.103
Jan 1 00:00:43 pppd[424]: primary DNS address 80.80.180.254
Jan 1 00:00:43 pppd[424]: secondary DNS address 217.16.223.201
Jan 1 00:00:43 start_nat_rules: apply the nat_rules(/tmp/nat_rules_ppp0_eth3)!
Jan 1 00:00:44 kernel: nf_conntrack_rtsp v0.6.21 loading
Jan 1 00:00:44 kernel: nf_nat_rtsp v0.6.21 loading
Jan 1 00:00:45 wan: finish adding multi routes
Jan 1 00:00:45 rc_service: ip-up 436:notify_rc stop_upnp
Jan 1 00:00:45 miniupnpd[413]: received signal 15, good-bye
Jan 1 00:00:45 rc_service: ip-up 436:notify_rc start_upnp
Jan 1 00:00:45 miniupnpd[484]: HTTP listening on port 38466
Jan 1 00:00:45 miniupnpd[484]: Listening for NAT-PMP traffic on port 5351
Jan 1 00:00:50 WAN Connection: WAN was restored.
Jan 1 00:00:51 ntp: start NTP update
Feb 2 19:33:30 rc_service: ntp 485:notify_rc restart_upnp
Feb 2 19:33:30 miniupnpd[484]: received signal 15, good-bye
Feb 2 19:33:30 miniupnpd[493]: HTTP listening on port 37762
Feb 2 19:33:30 miniupnpd[493]: Listening for NAT-PMP traffic on port 5351
Feb 2 19:33:38 disk monitor: re-mount partition
Feb 2 19:33:38 kernel: ufsd: use builtin utf8 instead of kernel utf8
Feb 2 19:33:39 kernel: ufsd: sda1 without journal
Feb 2 19:33:39 disk monitor: done
Feb 2 19:33:43 clachannet: sh /opt/S50aicloud.1 start
Feb 2 19:33:44 clachannet: sh /opt/S50asuslighttpd.1 start
Feb 2 19:33:49 clachannet: sh /opt/S50mediaserver.1 start
Feb 2 19:33:55 clachannet: sh /opt/S50smartsync.1 start
Feb 2 19:33:56 rc_service: hotplug 262:notify_rc restart_nasapps
Feb 2 19:33:56 FTP Server: daemon is stoped
Feb 2 19:33:56 Samba Server: smb daemon is stoped
Feb 2 19:34:07 Samba Server: daemon is started
Feb 2 19:36:03 rc_service: httpd 389:notify_rc stop_samba
Feb 2 19:36:03 Samba Server: smb daemon is stoped
Feb 2 19:36:40 rc_service: httpd 389:notify_rc restart_ftpsamba
Feb 2 19:36:40 FTP Server: daemon is stoped
Feb 2 19:36:40 Samba Server: smb daemon is stoped
Feb 2 19:41:54 rc_service: httpd 389:notify_rc restart_firewall
Feb 2 19:41:54 start_nat_rules: apply the nat_rules(/tmp/nat_rules_ppp0_eth3)!
Feb 2 19:41:55 clachannet: sh /opt/S50aicloud.1 firewall-start
Feb 2 19:41:56 clachannet: sh /opt/S50asuslighttpd.1 firewall-start
Feb 2 19:41:56 clachannet: sh /opt/S50mediaserver.1 firewall-start
Feb 2 19:41:58 clachannet: sh /opt/S50smartsync.1 firewall-start

 

[pete y testing]

logs look fine

excessive usage can be for many reasons , check things ike icloud or onedrive are not constantly trying to upload or download

check torrents arnt stuck running in the background

check anything else running that could using bandwidth

 

[leehebs]

Thanks was not sure what the logs were showing. Went around the house whilst on the phone to isp tech switching machine and logging off, even down to the smart tv and blue ray, until there was just the router running. There were still packets which they ID as Linux owing in and out. these problems only seem to have occurred after our isp ungraded there systems.

 

[wardog]

AiCloud

You or another family member streaming movies or music from AiCloud?

Or possibly not have it, AiCloud, password protected so that someone who stumbled onto whatever is there helping themselves at your expense?

 

[Zirescu]

Windows 10 downloading in the background?

 

[wardog]

Windows 10 downloading in the background?

That crossed my mind too, but not considering the GB's he mentioning being in such a short time.

 

[leehebs]

Thanks again all. Since resetting the router and adding the newest firmware, my sip says there are not strange signals going backwards and forwards to the mast and that I have only used . 2 of a gb since I reset it yesterday at 3pm. All a little strange