Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I get a lot of "kernel intrusion" messages in my router's error log. Each one always shows the source IP, the destination IP (mine) and other details of the TCP connection.

My Internet link has been dropping a lot lately, and quite often the log shows several of these "intrusions" immediately beforehand. (Note that I don't have any P2P software installed.)

What are kernel intrusions, exactly? Are they a problem?

share|improve this question
add comment

3 Answers 3

up vote 16 down vote accepted

When I first read this I thought it didn't make sense because something cannot 'intrude' in a kernel. However Googling it I found similar posts (which also give the answer), but also list that the message was something like:

kernel: Intrusion detected from ...

which means something quite different.

The kernel (software) on your router is letting you know that somebody tried to connect ('intrude') to your WAN IP address.

This happens all the time, entire botnets are dedicated to trying to connect to random IP addresses at certain ports to try default user/password combinations to see if they can find weak security somewhere. However because the router denies this, there is no problem.

Summarizing: the 'intrusions' being detected are harmless, you should worry more about the ones that are not logged ;)

share|improve this answer
    
Awesome answer for unraveling what the actual problem was. –  Itai Sep 1 '11 at 14:01
add comment

This is your router letting you know that it's doing its job.

It's not really an intrusion but rather an intrusion attempt.

This sort of thing happens all the time.

Don't worry, you're fine.

share|improve this answer
add comment

I also got a lot of these messages. I did some research and eventually disabled the IGMP setting in the WAN setup on my router. Apparently it is used to establish multicast group memberships and your router will listen and respond to such messages. That's my simple interpretation.

It's been turned off now for about 10 minutes and not a sign of an intrusion message; and as you can see, my internet access appears to be OK...

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.