Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I get a lot of "kernel intrusion" messages in my router's error log. Each one always shows the source IP, the destination IP (mine) and other details of the TCP connection.

My Internet link has been dropping a lot lately, and quite often the log shows several of these "intrusions" immediately beforehand. (Note that I don't have any P2P software installed.)

What are kernel intrusions, exactly? Are they a problem?

share|improve this question
up vote 23 down vote accepted

When I first read this I thought it didn't make sense because something cannot 'intrude' in a kernel. However Googling it I found similar posts (which also give the answer), but also list that the message was something like:

kernel: Intrusion detected from ...

which means something quite different.

The kernel (software) on your router is letting you know that somebody tried to connect ('intrude') to your WAN IP address.

This happens all the time, entire botnets are dedicated to trying to connect to random IP addresses at certain ports to try default user/password combinations to see if they can find weak security somewhere. However because the router denies this, there is no problem.

Summarizing: the 'intrusions' being detected are harmless, you should worry more about the ones that are not logged ;)

share|improve this answer
Awesome answer for unraveling what the actual problem was. – Itai Sep 1 '11 at 14:01

This is your router letting you know that it's doing its job.

It's not really an intrusion but rather an intrusion attempt.

This sort of thing happens all the time.

Don't worry, you're fine.

share|improve this answer

I also got a lot of these messages. I did some research and eventually disabled the IGMP setting in the WAN setup on my router. Apparently it is used to establish multicast group memberships and your router will listen and respond to such messages. That's my simple interpretation.

It's been turned off now for about 10 minutes and not a sign of an intrusion message; and as you can see, my internet access appears to be OK...

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .