Intrusion -> IN=atm8 OUT= SRC=(random ip) DST=(my ip) PROTO=UDP SPT=123 DPT=80

I'm seeing multiple of these in my router's firewall log, I replaced the actual ip from the example given above. For over a week now my internet cuts in and out, and it's quite annoying. I've called my ISP, Centurylink. They say everything's fine, and we've had multiple people come out here. We've even replaced the router.

  • 1
    Any device connected to the internet will see incoming traffic blocked. There are millions of compromised PCs out there that do nothing but scan IPs for ways in. Next time it cuts out, do a traceroute to to see if the block is at the router or further out. – Paul Jun 16 '15 at 3:04
  • you aren't checking the time from an app on udp80, right? udp/123 is Network Time Protocol. UDP traffic is easier to force through a stateful firewall than tcp, and udp/123 is often opened on routers to allow time synch. that said, most people don't run services on udp\80. make sure the random IP isn't a time server being advertised by pool.ntp.org. – Frank Thomas Jun 16 '15 at 4:12

Probably malware from other customers/subscribers (beyond your local network). Run wireshark on your computer to see if the packets get through. If not, the firewall is doing its job and you should stop worrying. If yes, report it to your ISP and see how they respond. You may also want to scan all your local computers for malware, just in case.

  • I play a lot of games and get major packet loss. – user459251 Jun 16 '15 at 3:13

I had the same problem:
unknown open ports/services 54409 and 16808

You can check what ports are opened on your PC.
Open CMD as Admin and write netstat -abno.
Look for the port from the log and check in CMD what service uses the same port. If You find it, than You can identify the service after the PID.

In my case it was only Skype that caused this little confusion.

The internet disconnects might just be another issue.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.