HomeHub 3 Confusing Logs

Hi guys, i've just had DLM reset on my line and have just logged into the router and noticed these funny logs.

16:50:06, 14 Jan. (86426.280000) CWMP: session completed successfully
16:50:05, 14 Jan. (86426.060000) CWMP: HTTP authentication success from https://pbthdm.bt.mo
16:50:03, 14 Jan. (86423.390000) CWMP: Server URL: https://pbthdm.bt.mo; Connecting as user: ACS username
16:50:03, 14 Jan. (86423.380000) CWMP: Session start now. Event code(s): '2 PERIODIC,4 VALUE CHANGE'
16:50:01, 14 Jan. (86421.930000) CWMP: Initializing transaction for event code 2 PERIODIC
16:09:14, 14 Jan. IN: BLOCK [16] Remote administration (TCP 184.154.42.194:55792->86.163.153.51:443 on ppp0)
16:09:13, 14 Jan. IN: BLOCK [16] Remote administration (TCP 184.154.42.194:55791->86.163.153.51:443 on ppp0)
15:23:42, 14 Jan. (81238.220000) NTP synchronization success!
13:34:47, 14 Jan. IN: BLOCK [16] Remote administration (ICMP type 8 code 0 110.138.140.207->86.163.153.51 on ppp0)
12:24:27, 14 Jan. IN: BLOCK [16] Remote administration (TCP 218.17.160.126:58875->86.163.153.51:22 on ppp0)
11:40:46, 14 Jan. IN: BLOCK [16] Remote administration (TCP 210.14.70.33:51832->86.163.153.51:22 on ppp0)
10:26:13, 14 Jan. IN: BLOCK [16] Remote administration (TCP 115.47.25.154:55989->86.163.153.51:22 on ppp0)
08:11:51, 14 Jan. IN: BLOCK [16] Remote administration (TCP 58.218.199.250:12200->86.163.153.51:8080 on ppp0)
07:31:49, 14 Jan. IN: BLOCK [16] Remote administration (TCP 141.212.121.52:37353->86.163.153.51:443 on ppp0)
07:28:34, 14 Jan. IN: BLOCK [16] Remote administration (TCP 202.47.177.64:47389->86.163.153.51:22 on ppp0)

Not noticing any loss of service just find it strange as it looks like someone is trying to connect to my router? I am on secured Wi-fi and only have one device connected and BT fon disabled.

That is actually BT connecting to the router.

thanks for that is there any reason BT would want to connect to my router?

It's actually http://motive.com trying to connect to your router to manage it.

In this case looks like maybe something changed on the router and the router itself started the connection.
The trigger was a value changing, which this was is unknown.

BT can do either incoming connections to manage router, or it can talk out to the BT management systems, all part of the TR-069 standard.

Andrew

In reply to a post by MrSaffron:

BT can do either incoming connections to manage router, or it can talk out to the BT management systems, all part of the TR-069 standard.

Glad I run my own router. I wouldn't want my ISP messing.

Hi,

I think it's a scheduled event as it also happened to me:

20:00:41, 14 Jan. (347454.470000) NTP synchronization success!
19:30:16, 14 Jan. (345629.350000) CWMP: session completed successfully
19:30:16, 14 Jan. (345629.080000) CWMP: HTTP authentication success from https://pbthdm.bt.mo
19:30:13, 14 Jan. (345625.770000) CWMP: Server URL: https://pbthdm.bt.mo; Connecting as user: ACS username
19:30:13, 14 Jan. (345625.760000) CWMP: Session start now. Event code(s): '2 PERIODIC,4 VALUE CHANGE'
19:30:12, 14 Jan. (345625.030000) CWMP: Initializing transaction for event code 2 PERIODIC
19:11:31, 14 Jan. IN: BLOCK [16] Remote administration (TCP 41.159.132.30:21781->86.129.221.129:22 on ppp0)
18:52:34, 14 Jan. (343367.430000) Lease requested
18:52:31, 14 Jan. IN: BLOCK [53] Defragmentation failed (Unknown protocol: 0)

Cheers

Also if I may ask does any one know what this means?

"(347472.250000) Port forwarding rule added via UPnP/TR064. Protocol: UDP, external ports: any->51160, internal ports: 16402, internal client: 192.168.1.64"

Since the new firmware upgrade to 4.7.5.1.83.8.94.1.11 the level of detail in which the eventlog records has increased though most the stuff it logs isn't made/changed/created by me but the tr-069 management console or by the homehub itself.

Cheers

Edited by cymru123 (Mon 14-Jan-13 20:52:11)

What ever device you own that is on ip 192.168.1.64 has UPnP enabled and wanted a port forwarding, e.g. xbox, Windows live messenger and a myriad of other software/devices

Ah ok, thanks.
It didn't used to report that much detail before :L

diolch yn fawr