What does this mean please?

On looking at router stats I seem to have a lot of messages :

91.125.xxx xxx Type: Destination Unreachable Code: Communication with Destination Host is Administratively Prohibited

They appear with a red light in the traffic signal and some of them are from when I know that the computer is switched off.

The router is a Thompson.

Thanks for any information.

Pete

Edited by deleted (Wed 04-May-11 10:59:52)

The reverse DNS ( http://remote.12dt.com/lookup.php ) of 91.125.xxx.xxx shows xxx.xxx.125.91.rb5.adsl.brightview.com

Is brightview your ISP?

Edited by deleted (Wed 04-May-11 11:12:52)

Thanks for the reply.

Plusnet is ISP.

Is the message any thing to worry about?

I know very little regarding computers ie could be written on back of a postage stamp!!

Pete

Without context it's a bit hard to say. Brightview like Plusnet are now owned by BT.

For all I know that IP address ( 91.125.xxx.xxx ) could be the address of your router. If it is you should probably edit the address to read 91.125.xxx.xxx for privacy reasons.

You can check your IP address by going to http://www.thinkbroadband.com/ip.html

Edited by deleted (Wed 04-May-11 11:13:33)

Done as you suggested thanks. Does it matter that in your replies it is written in full. Sorry to be a pain but I'm a computerphobe.

On checking the link it comes up as brightview.

Pete

I've edited the address also.

However was the address your IP address? i.e. is is it the address shown if you click here?

Thanks.

Yes it is the same address as in the link.

Pete

Did you mean the stats from your router; orr the log file from your router, or the log file of the program called RouterStats?

I ask as I'm trying to think what is causing the message.

What OS are you using on the computer, Windows XP, Vista or Win 7?

(Edit - Plusnet bought Brightview a long time ago so that is fine. Then as john says, BT bought Plusnet. Brightview is integrated into Plusnet, but they are run separately from BT).

Edited by RobertoS (Wed 04-May-11 12:35:04)

Hi RobertoS

They are from the Events Log from my router.There have been 10 of them since midnight.
My OS is Win 7 and I have Norton IS. Two weeks ago I was changed to 21CN from 20 CN.

Thanks for your time.

Pete

Not sure how much it helps, but it is No.10 on this list.

What isn't clear from the message or that lis is which is the source and which the destination.

As john suggested, before all the edits so I haven't seen the full address, it looks from your replies to him that is the visible-from-outside address of your router. Which makes the message useless for finding out anything, in particular where it is coming from.

It's almost as though it is trying to talk to itself and telling itself it can't.

Is there a separate firewall log in the router? If so, see what that has to say.

I got that list by googling the message and picking the best-looking in the first few on the list. Three others all suggest that codes 9 and 10 are reserved for the US military .

Very wierd.

One suggests it can be rival gamers trying to ping your router and mess up your latency, or something like that, but I have my doubts about that.

Or do you run a game server/host a game sometimes and someone is trying to access it legitimately?

Edited by RobertoS (Wed 04-May-11 16:25:58)

Thanks.

I have never done any gaming. Only use computer for shopping, browsing or email in the main.

On my router settings for wireless I have hidden SSID and set "allow no new devices" Don't think that these have any effect though.

At same time as original message is this FIREWALL icmp check (1 of 1): Protocol: ICMP Src ip: xxx xxx xxx.xxx Dst ip.

Pete

Edited by deleted (Wed 04-May-11 16:57:34)

So is that source IP yours again, or something totally different?

If it's different, PM it to john2007 and myself. One or other of us will find out where it belongs. I'm going out soon for the evening so probably won't look for a while.

Or the place I use is this site. Put the IP address in and see what it tells you about the ownership.

Sounds like someone is trying to port scan your router or ping it. Your firewall is doing its job and blocking the request, so nothing to worry about.

It happens all the time; nothing you can do about it, but no cause for concern.

Pasted the numbers in the site Roberto suggested and it came up with :
United States Providence Hosting Services Inc.

Later my IP address changed and a different set of numbers appeared which the site gives as United States New York Network Operations Center Inc

I will try and find out something about them.

Thanks

Pete

Edited by deleted (Wed 04-May-11 21:47:20)

As AEP says, it looks a bit like potential hackers just looking at random for routers they can get through to, and the built-in firewall in yours is just rejecting it.

The ownership doesn't really mean much, as your IP address is owned by Brightview/Plusnet, so if you were a hacker and a simple check like the one I gave you was used by your "victim", it would point to them not you.

Only your ISP can trace who they have allocated a particular IP address to at any given time. Which is what all the stuff spouted about detecting illegal downloaders and so on is about, as even for them to guarantee getting this right is debatable.