Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have been getting weird network issues on my ADSL router the last few days, seemingly getting flooded.

My ISP-assigned IP is 105.x.x.x.

I have noted the following entries in ip_conntrack:

tcp 6   359405  ESTABLISHED src=    dst=  sport=36444 dport=5228  [UNREPLIED] src=  dst=    sport=5228  dport=36444 use=2
tcp 6   426547  ESTABLISHED src=   dst=   sport=33318 dport=443   [UNREPLIED] src=   dst=   sport=443   dport=33318 use=2
tcp 6   362658  ESTABLISHED src=    dst=   sport=58660 dport=443   [UNREPLIED] src=   dst=    sport=443   dport=58660 use=2

The destinations seems to point to Google and Facebook, and the sources are unreachable from me.

Why would this appear on my router?

Why would a private network IP appear there? (My local network is Also a trace to shows it going over some routers in the range.

Is this due to wrongly configured routers on my ISP and/or their backbone?

Sorry if these questions are stupid :)

(I have forwarded the info to my ISP, but still awaiting a response).

share|improve this question

migrated from Oct 3 '13 at 5:58

This question came from our site for system and network administrators.

The [UNREPLIED] strongly indicates that these entries are crap coming from some kind of botnet style traffic. – Zoredache Oct 3 '13 at 6:55
@Zoredache: Thanks, I did not know that :) – leppie Oct 3 '13 at 7:06

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.