Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a NetGear RangeMax Dual Band Wireless-N Gigabit Router, model number WNDR3700.
It's been working fine, but I recently logged into it by pointing my web browser towards and typing in my username and password.

I took a look at the security logs, and noticed several entries like:

[LAN access from remote] from to, Wednesday, September 14,2011 18:00:40
[LAN access from remote] from to, Wednesday, September 14,2011 12:34:00
[LAN access from remote] from to, Friday, September 09,2011 22:43:25
[LAN access from remote] from to, Friday, September 09,2011 22:07:16
[LAN access from remote] from to, Friday, September 09,2011 21:45:59

The log is full of other entries like this too.

Does this mean LAN access was attempted or that LAN access was successful?

Should I be concerned? If so, what do I do now?

share|improve this question
Note that the connections you list above were to devices on your local network, not to the router itself. – kpozin Feb 1 '14 at 20:52
@kpozin thanks for pointing that out – Zach Feb 2 '14 at 16:17

Just to be safe you should follow guides to ensure your router is secured to prevent possible future access even if these turn out to be failed attempts. Especially if you had a weak password.

One of the important ones being to disable remote administration and require only physical connection to administer. Then follow more steps to ensure it's securely configured.


Secure setup of home wireless network

As for your actual question if it's attempts or success, I believe that would be more difficult to diagnose for anyone not very familiar with how detailed Netgear logging is.

If you want to be paranoid I would further advise you reset the router to factory defaults, upgrade firmware and configure it as securely as possible.

share|improve this answer
I have remote admin disabled – Zach Sep 15 '11 at 3:39

According to the netgear forum, if you have a torrent or a number of other valid applications, you may see traffic like this. See here

share|improve this answer
I didn't have any torrents open at the times in the logs – Zach Sep 15 '11 at 3:40

[LAN access from remote] is triggered anytime an external connection is routed into the internal network via a forwarded port. This can be either an explicit (ie: a specific port or range of ports set with port forwarding/port triggering) or automatic (ie: UPNP) route. Most of the time, this message indicates success, but if you have invalid port forwarding rules, this message will still appear even though the connection was not successful.

Using a P2P application, such as Bittorrent or Skype, will result in many of these logs if you have UPNP enabled - this is normal.

If you have common ports forwarded, you will see logs from port scanners.

share|improve this answer

Try getting a tool like TCPView and check which program is using the local port in question (8085 and 59850 in your logs above).

In my case, whenever I've seen these remote connections, the local port was being used by Skype, which I suppose makes sense since Skype uses P2P connections to other Skype clients.

share|improve this answer

In my case too these logs were caused by Skype. From the Skype docs:

When you install Skype, a port above 1024 is chosen at random as the port for incoming connections.

This explains why I couldn't find anything about the port on Google!

Full Skype Article here:

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .