Thomson 585v6

I have just recently got this router from my isp, however i have noticed a lot of ip address's showing as logged out of my router. I am not showing any logins though. However if i try to log in myself and enter an incorrect password, the router shows a failed attempt to log in. I have never had this with any of my neatgears, buffalo or origo routers i have owned in the past.

Can anyone shed some light on this.







Jan 30 16:05:01 LOGOUT User logged out on TELNET (192.168.1.66)


Jan 30 16:01:48 LOGIN User logged in on TELNET (192.168.1.66)


Jan 30 15:24:34 LOGOUT User logged out on TELNET (115.74.177.225)



Jan 30 14:23:01 LOGOUT User logged out on TELNET (41.234.76.204)


Jan 30 09:43:04 LOGOUT User logged out on TELNET (192.168.1.66)


Jan 30 09:43:04 SESSION TIMEOUT Timeout! (after 600 sec)


Jan 30 09:32:43 LOGIN User logged in on TELNET (192.168.1.66)


Jan 30 09:32:31 LOGIN User tried to log in on TELNET (192.168.1.66)


Jan 30 09:32:23 LOGOUT TELNET session of user killed (212.220.96.165)



Jan 30 04:38:17 LOGOUT User logged out on TELNET (116.71.178.171)


Jan 30 04:38:11 LOGOUT User logged out on TELNET (116.71.178.171)


Jan 30 04:29:45 LOGOUT User logged out on TELNET (60.54.98.131)


Jan 30 04:29:39 LOGOUT User logged out on TELNET (60.54.98.131)


Jan 30 04:24:50 LOGOUT User logged out on TELNET (66.178.153.145)


Jan 30 04:04:59 LOGOUT User logged out on TELNET (64.122.15.187)


Jan 30 03:47:23 LOGOUT User logged out on TELNET (220.233.126.108)


Jan 30 03:47:17 LOGOUT User logged out on TELNET (220.233.126.108)


Jan 30 03:40:27 LOGOUT User logged out on TELNET (201.240.173.41)


Jan 30 03:32:13 LOGOUT User logged out on TELNET (190.94.71.197)


Jan 30 03:23:06 LOGOUT User logged out on TELNET (190.94.71.197)


Jan 30 01:02:06 LOGOUT User logged out on TELNET (96.230.100.37)


Jan 30 00:56:47 LOGOUT User logged out on TELNET (190.42.179.83)


Jan 30 00:56:26 LOGOUT User logged out on TELNET (71.171.139.15)

I just tried to log in locally to my router and i got the following.

Session 1 in use by '' on 202.61.37.231:4758
Session 2 in use by '' on 203.99.175.55:3293

Hit Return to list sessions & scan for a free one
Or type the number of the session you want to kill


I am going to have to shut down my router. I am a little upset as i do like to log in via my dyndns account. I hae a very secure username and password for my router.

Is the router firewall set to standard?
Disable UPnp
Disable Remote Assistance

Do a factory reset and change the password from the default setting,
take a note of your ISP username and password before you do this incase
you have to re-enter it for setup.

Connect router to PC by ethernet cable and see if problem persists,
if you go wireless make sure you have WPA setup with a new password.

Some info on wireless security worth a read.

BTW who's the ISP? Edit 2 >>> is it AOL LLU (from your profile?)



Edit- missed your second post had to answer the doorbell

Edited by Apprentice (Fri 30-Jan-09 21:52:19)

My current settings that have not been changed for a while.

Firewall is set to ---> Security Level: Standard
Remote Assistance ---> Disabled
Use UPnP ---> Yes

Again, the username & password are very secure.

I have just changed the ip address range to just my isp, this will reduce the log outs, however i stil do not understand why i am not seeing any log in's & failed log in's, but seeing loads of log outs.

In reply to:

---

i stil do not understand why i am not seeing any log in's & failed log in's, but seeing loads of log outs.

---

I would guess they are removing the log in messages from the log but obviously can't remove the log outs since they have logged out.

I thought it might be your ISP (Be/O2 supply the same router with hidden accounts for their tech support staff to use) but those IP addresses are all over the place.

I would suggest a factory reset of the router to clear whatever settings they have changed. If you do a backup of the router config then open the file with notepad you might find something in there.

In reply to a post by Mitchy_mitch:

however i stil do not understand why i am not seeing any log in's & failed log in's, but seeing loads of log outs.

My explanation (particularly if you are seeing a lot of

LOGOUT User logged out on TELNET (201.230.xxx.xxx)

is that these are attempted logins where the client (a botnet) has broken the connection. It doesn't mean they actually have successfully logged in. You can try it yourself: telnet to port 23 or 21 on the router and then escape and quit. It appears in the logs as a logout although there was no earlier corresponding login.

So it may not be that worrying, but these ports (80, 8080, 443, 23, 21) should be closed to the internet so the botnet can't even connect to the management services. There's discussion about how to do that here: http://forum.kitz.co.uk/index.php?topic=5099.0 - basically telnet to the router and do

ifdelete name=TELNET group=wan