Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have a NetGear RangeMax Dual Band Wireless-N Gigabit Router, model number WNDR3700.
It's been working fine, but I recently logged into it by pointing my web browser towards 192.168.1.1 and typing in my username and password.

I took a look at the security logs, and noticed several entries like:

[LAN access from remote] from 58.218.199.147:12200 to 192.168.1.2:8085, Wednesday, September 14,2011 18:00:40
[LAN access from remote] from 221.194.46.176:12200 to 192.168.1.2:8085, Wednesday, September 14,2011 12:34:00
[LAN access from remote] from 31.7.59.152:12200 to 192.168.1.2:8085, Friday, September 09,2011 22:43:25
[LAN access from remote] from 68.4.59.247:46048 to 192.168.1.91:59850, Friday, September 09,2011 22:07:16
[LAN access from remote] from 72.152.89.147:52115 to 192.168.1.91:59850, Friday, September 09,2011 21:45:59

The log is full of other entries like this too.

Does this mean LAN access was attempted or that LAN access was successful?

Should I be concerned? If so, what do I do now?

share|improve this question
    
Note that the connections you list above were to devices on your local network, not to the router itself. –  kpozin Feb 1 at 20:52
    
@kpozin thanks for pointing that out –  Zach Feb 2 at 16:17

4 Answers 4

Just to be safe you should follow guides to ensure your router is secured to prevent possible future access even if these turn out to be failed attempts. Especially if you had a weak password.

One of the important ones being to disable remote administration and require only physical connection to administer. Then follow more steps to ensure it's securely configured.

See:

Secure setup of home wireless network

As for your actual question if it's attempts or success, I believe that would be more difficult to diagnose for anyone not very familiar with how detailed Netgear logging is.

If you want to be paranoid I would further advise you reset the router to factory defaults, upgrade firmware and configure it as securely as possible.

share|improve this answer
    
I have remote admin disabled –  Zach Sep 15 '11 at 3:39

According to the netgear forum, if you have a torrent or a number of other valid applications, you may see traffic like this. See here

share|improve this answer
    
I didn't have any torrents open at the times in the logs –  Zach Sep 15 '11 at 3:40

Do you have a HD HomeRun piece of equipment? I noticed the same traffic IP addresses to my HDHomeRun as soon as I installed My HDHomeRun tuner.

Try turning off any piece of equipment like this and see if the issue goes away.

share|improve this answer

Try getting a tool like TCPView and check which program is using the local port in question (8085 and 59850 in your logs above).

In my case, whenever I've seen these remote connections, the local port was being used by Skype, which I suppose makes sense since Skype uses P2P connections to other Skype clients.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.