Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have been getting weird network issues on my ADSL router the last few days, seemingly getting flooded.

My ISP-assigned IP is 105.x.x.x.

I have noted the following entries in ip_conntrack:

tcp 6   359405  ESTABLISHED src=10.196.65.25    dst=173.194.70.188  sport=36444 dport=5228  [UNREPLIED] src=173.194.70.188  dst=10.196.65.25    sport=5228  dport=36444 use=2
tcp 6   426547  ESTABLISHED src=197.71.78.221   dst=74.125.233.87   sport=33318 dport=443   [UNREPLIED] src=74.125.233.87   dst=197.71.78.221   sport=443   dport=33318 use=2
tcp 6   362658  ESTABLISHED src=41.5.152.197    dst=69.171.245.49   sport=58660 dport=443   [UNREPLIED] src=69.171.245.49   dst=41.5.152.197    sport=443   dport=58660 use=2

The destinations seems to point to Google and Facebook, and the sources are unreachable from me.

Why would this appear on my router?

Why would a private network IP appear there? (My local network is 192.168.1.0/24). Also a trace to 197.71.78.221 shows it going over some routers in the 10.0.0.0/8 range.

Is this due to wrongly configured routers on my ISP and/or their backbone?

Sorry if these questions are stupid :)

(I have forwarded the info to my ISP, but still awaiting a response).

share|improve this question

migrated from serverfault.com Oct 3 '13 at 5:58

This question came from our site for professional system and network administrators.

2  
The [UNREPLIED] strongly indicates that these entries are crap coming from some kind of botnet style traffic. –  Zoredache Oct 3 '13 at 6:55
    
@Zoredache: Thanks, I did not know that :) –  leppie Oct 3 '13 at 7:06
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.