Topic 'Re: Strange router log entries' in forum 'Verizon Fiber Optics' - dslreports.com http://www.dslreports.com/forum/Re-Strange-router-log-entries-22652619 en Sat, 11 Feb 2012 06:36:13 EDT Sat, 11 Feb 2012 06:36:13 EDT Re: Strange router log entries http://www.dslreports.com/forum/Re-Strange-router-log-entries-22653088
I changed the pass for admin

Since I just got the router it was probably just setting up for some of the stuff I use, when I used it
I forgot about UPnP

Im probably just worrying about nothing, but Ill keep a close eye on it

Thanks alot for all your help]]> http://www.dslreports.com/forum/Re-Strange-router-log-entries-22653088 Sat, 04 Jul 2009 08:51:02 EDT Re: Strange router log entries http://www.dslreports.com/forum/Re-Strange-router-log-entries-22652926 [northeast] Log From My Router - I'm Curious and Concerned It does not come to a conclusion, but it explains some things that might help you interpret what you see.

If it was me, I'd power off the router for a few seconds, then power back on. That will start the log fresh and you'll see every entry that you made happen. I'd also turn off UPnP, which is on by default. Unless you use applications which rely on it. It's not concluded in that thread, but I'd venture a good guess your log entry is what you'd get as a result of UPnP activity.

Changing your password is a great idea. Install tech probably set it to password1 as part of his SOP. You can change it in Advanced / Users / edit the entry

FWIW, this may be a slightly different version of your message.
Jul 3 20:13:51 2009 Firewall Setup Configuration change Internal application has changed security settings

[edit to add source]From a Rev.A Actiontec with 10.0.11.6 firmware.]]> http://www.dslreports.com/forum/Re-Strange-router-log-entries-22652926 Sat, 04 Jul 2009 06:12:31 EDT Strange router log entries http://www.dslreports.com/forum/Strange-router-log-entries-22652619 The TV service is great, and the internet is fast (much faster then cable), the install guy was nice

But today i decided to look through all the router settings, I needed to forward some ports that were forwarded on my old router

While looking through these settings, i found the security log, so i thought id take a look, and heres what i got:

quote:
Jul 4 00:22:01 2009 Firewall Info User authentication success Username: admin

Jul 4 00:21:51 2009 Firewall Info User authentication failure Invalid password. Username: admin

Jul 4 00:48:48 2009 Firewall Setup Configuration change WBM user Unknown (0.0.0.0) has changed security settings[repeated 3 times, last time on Jul 4 00:49:50 2009]

Jul 3 19:06:37 2009 Firewall Info User authentication success Username: admin

Jul 3 18:52:33 2009 Firewall Setup Configuration change WBM user Unknown (0.0.0.0) has changed security settings[repeated 3 times, last time on Jul 3 18:54:59 2009]

Jul 3 18:33:04 2009 Firewall Setup Configuration change WBM user admin (192.168.1.5) has changed security settings[repeated 6 times, last time on Jul 3 18:52:16 2009]

Jul 3 17:39:26 2009 Firewall Info User authentication success Username: admin[repeated 2 times, last time on Jul 3 18:28:15 2009]

Jul 3 16:25:11 2009 Firewall Setup Configuration change WBM user Unknown (0.0.0.0) has changed security settings[repeated 7 times, last time on Jul 3 17:34:10 2009]

Jul 3 15:31:05 2009 Firewall Info User authentication success Username: admin

Jul 3 14:10:44 2009 Firewall Setup Configuration change WBM user Unknown (0.0.0.0) has changed security settings[repeated 2 times, last time on Jul 3 15:01:42 2009]

Jul 3 14:09:35 2009 Firewall Info User authentication success Username: admin

Jul 3 14:07:17 2009 Firewall Setup Firewall status changed enabled

Jul 3 14:07:16 2009 System Log Message The system is UP!


The WBM user Uknown is what im worried about, the admin's are me (the failed pass was me to cause im so used to my old pass)

At first I thought it was the fios guy, using his special thing to configure stuff, but its on there after the fios guy left, including today, and the router hasnt been shut off since it was first started up yesterday, so there would be no reboot settings changes

Also i have another wireless user on the network, the name is new-host, today its new-host2, it was there when the fios guy was here (after he set up the first computer i looked at some of the router settings) so i assumed it was him, but it was still there even after he left, but since it was there almost as soon as the router was up i figured it was just part of the network some how

Device information doesnt give alot of info on it, and testing the connectivity to it fails every time, so i thought it was some sort of glitch, but now the security changes from an unknown user has me wondering

Is new-host and the unknown security changes normal?

Router Info-
Model: MI424WR-GEN2 (rev E)
Firmware: 20.9.0

Also, how can you change the admin pass, i looked every where but cant find it]]> http://www.dslreports.com/forum/Strange-router-log-entries-22652619 Sat, 04 Jul 2009 01:25:36 EDT