Help Reading Syslogs - Possible Hack - Logs Showing Ports Entering Promiscuous Mode

[zwitterion]

This would be the second time my router (info found below on signature) completely stopped receiving both wireless and wired connections. When looking at the syslog I found ethernet ports being set to Promiscuous Mode and Entered Listening State. When searching online I found "promiscuous mode means a packet sniffer instructed your ethernet device to listen to all traffic. This can be a benign or a malicious act." If this is a bug issue, then I can post this elsewhere as well to help with resolving the matter.

 

[Tech Junky]

Promiscuous mode is what happens when you engage tap/monitoring of the port/packet. I use ntopng and that's how you get the info. Are you using a package in the router for this purpose?

 

[zwitterion]

Promiscuous mode is what happens when you engage tap/monitoring of the port/packet. I use ntopng and that's how you get the info. Are you using a package in the router for this purpose?

I don't think so, I just have Diversion, Skynet, and scribe installed. I used to have Kiwi Syslog but that was setup before I moved to Merlin and the configs may have been transferred in the dirty firmware upgrade. I no longer use Kiwi syslog since I have Scribe installed

 

[Tech Junky]

I glanced at the attachment after replying and it looks like an 8 minute boot log. Looks like normal stuff with interfaces coming online. Maybe a hard reset and manual reconfiguration bis needed. It didn't show any obvious app being triggered. Maybe it did a soft reboot to trigger things due to an error?

 

[zwitterion]

I glanced at the attachment after replying and it looks like an 8 minute boot log. Looks like normal stuff with interfaces coming online. Maybe a hard reset and manual reconfiguration bis needed. It didn't show any obvious app being triggered. Maybe it did a soft reboot to trigger things due to an error?

Possibly, not sure what causes soft reboots. I am getting regular patterns of these syslogs:

Mar 30 21:12:22 GT-AXE11000-7220 kernel: FPM Pool 1: invalid token 0x205f0000 freed
Mar 30 21:12:22 GT-AXE11000-7220 kernel: FPM Pool 1: ISR timer is enabled. There could be multiple occurrences of the reported issue
Mar 30 22:09:46 GT-AXE11000-7220 kernel: httpds (2617): drop_caches: 1
and one of these:
Mar 30 22:19:44 GT-AXE11000-7220 kernel: htb: too many events!

if it becomes a bigger problem I can wipe everything and install clean firmware

 

[Tech Junky]

Httpds is the web server package for reporting something from an app. I also run pihole for monitoring dns traffic and it's bundled into that for the web GUI. There might be a conflict from the dirty upgrade between the two programs. A surefire way to figure it out would be a netstat to see what's listening / serving web stats from an ssh session.