Member Avatar for PcPro12

OK, So I was using Qwest DSL internet...that only provided a speed of 1.5mbps, which for running 2 desktops and sometimes 2 laptops at the same time was real slow...So I switched to Comcast with 12mbps, and bought a D-Link DIR-628 wireless router. That is the best I've seen so far.

But, after setting it up, I checked the logs and noticed a lot of blocked incoming packets...some connection requests to ports that were blocked...I've traced some of these IP's to the UK and China....I've looked them up and found the ISP of them...but not sure what to do...

Here is a list...

[INFO] Tue Jul 14 12:04:04 2009 Blocked incoming UDP packet from to my-ip:port
[INFO] Tue Jul 14 12:04:03 2009 Blocked incoming UDP packet from to my-ip:port
[INFO] Tue Jul 14 12:04:02 2009 Blocked incoming UDP packet from to my-ip:port
[INFO] Tue Jul 14 12:03:29 2009 Blocked incoming UDP packet from to my-ip:port
[INFO] Tue Jul 14 12:03:26 2009 Blocked incoming UDP packet from to my-ip:port

every port is the same...and occasionally, I would get one of these...

[INFO] Tue Jul 14 12:00:52 2009 Blocked incoming TCP connection request from to my-ip:port

and I've got one of these so far...that I saw at least...

[INFO] Tue Jul 14 12:01:41 2009 Blocked incoming ICMP packet (ICMP type 8) from to my-ip

they are non-ending...just keep coming every few minutes...

so any suggestions? mail their ISP or abuse email to stop pinging or sending packets to my IP...? Any programs to monitor or analyze the packets and see if they are attack attempts?

Thanks for reading...

-PcPro12

  • 1 Contributor
  • 1 Reply
  • 449 Views
  • 6 Hours Discussion Span
  • Latest Post Latest Post by PcPro12

Dani AI

Generated

Brief assessment: the DIR‑628 log of repeated unsolicited UDP probes with the occasional TCP connect and ICMP echo is a common symptom of background Internet scanning and peer-to-peer chatter. The router’s NAT + firewall is already blocking those attempts, which means the public IP is being probed but internal hosts are not necessarily compromised. ’s suspicion that an internal program could be trying to reach a host is valid only if there are active port‑forwards, UPnP openings, or a DMZ host configured.

Practical hardening checklist (DIR‑628 / typical SOHO router):

  • Confirm Remote Management is disabled on the WAN side and disable WAN ping/ICMP response.
  • Turn off UPnP unless specifically needed; remove any automatic port mappings.
  • Remove any DMZ host and close unused manual port forwards.
  • Enable SPI/stateful firewall and set a strong admin password; apply the latest router firmware.
  • Ensure Wi‑Fi uses WPA2/WPA3 and that no unknown devices are on the LAN.

Investigation steps (non-invasive, correlating router logs with hosts):

  • Inspect router’s Port Forward and DMZ pages for rules opened previously (P2P, game servers).

  • On Windows, collect a short snapshot of active connections and associated PIDs:

    netstat -ano

    Cross‑reference PIDs in Task Manager or Process Explorer. On Linux use ss -tulpn or netstat -tunap.

  • Do a short packet capture on a desktop with Wireshark to confirm whether packets ever reach the LAN (router drops often prevent arrival). Useful quick filters: udp and icmp.

  • Run up‑to‑date AV + anti‑malware scans (Malwarebytes, Windows Defender) if any suspicious outbound connections appear.

When to report or escalate: isolated probes are usually automated and filing abuse reports rarely helps. If traffic becomes sustained, saturates bandwidth, or targets specific forwarded services, collect timestamps and logs and contact the ISP/abuse contact with evidence. Geolocation of IPs is imperfect; avoid blocking large address ranges without clear reason.

Member Avatar for PcPro12

Also...I wouldn't rule out the possibility of a program or a virus requesting download information from it's host, that has been blocked by the new wireless router with the advanced firewall...but how can I found out?

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.