Date/Time     Facility     Severity     Message
Jan 1 00:00:17    syslog    emerg    BCM96345 started: BusyBox v1.00 (2008.05.28-04:24+0000)
Jan 1 00:00:16    user    notice    kernel: klogd started: BusyBox v1.00 (2008.05.28-04:24+0000)
Jan 1 00:00:16    user    warn    kernel: Linux version 2.6.8.1 (kevin@BS5) (gcc version 3.4.2) #1 Wed May 28 12:23:02 CST 2008
Jan 1 00:00:16    user    warn    kernel: Serial flash device: name S25FL016A, id 0x0114, size 2048KB
Jan 1 00:00:16    user    warn    kernel: 96332CG prom init
Jan 1 00:00:16    user    warn    kernel: CPU revision is: 00029010
Jan 1 00:00:16    user    warn    kernel: Determined physical RAM map:
Jan 1 00:00:16    user    warn    kernel: memory: 007a0000 @ 00000000 (usable)
Jan 1 00:00:16    user    debug    kernel: On node 0 totalpages: 1952
Jan 1 00:00:16    user    debug    kernel: DMA zone: 1952 pages, LIFO batch:1
Jan 1 00:00:16    user    debug    kernel: Normal zone: 0 pages, LIFO batch:1
Jan 1 00:00:16    user    debug    syslog: sntp -s clock.via.net -s clock.fmt.he.net -t "Almaty, Novosibirsk" &
Jan 1 00:00:17    user    debug    syslog: echo > /var/snmpd.conf
Jan 1 00:00:16    user    debug    kernel: HighMem zone: 0 pages, LIFO batch:1
Jan 1 00:00:17    user    warn    kernel: Built 1 zonelists
Jan 1 00:00:17    user    warn    kernel: Kernel command line: root=31:0 ro noinitrd console=ttyS0,115200
Jan 1 00:00:17    user    warn    kernel: brcm mips: enabling icache and dcache...
Jan 1 00:00:17    user    warn    kernel: Primary instruction cache 16kB, physically tagged, 2-way, linesize 16 bytes.
Jan 1 00:00:17    user    warn    kernel: Primary data cache 8kB 2-way, linesize 16 bytes.
Jan 1 00:00:17    user    warn    kernel: PID hash table entries: 32 (order 5: 256 bytes)
Jan 1 00:00:17    user    warn    kernel: Using 120.000 MHz high precision timer.
Jan 1 00:00:17    user    warn    kernel: Dentry cache hash table entries: 2048 (order: 1, 8192 bytes)
Jan 1 00:00:17    user    warn    kernel: Inode-cache hash table entries: 1024 (order: 0, 4096 bytes)
Jan 1 00:00:17    user    info    kernel: Memory: 5688k/7808k available (1510k kernel code, 2100k reserved, 225k data, 76k init, 0k highmem)
Jan 1 00:00:17    user    warn    kernel: Calibrating delay loop... 239.20 BogoMIPS
Jan 1 00:00:17    user    warn    kernel: Mount-cache hash table entries: 512 (order: 0, 4096 bytes)
Jan 1 00:00:17    user    warn    kernel: Checking for 'wait' instruction... unavailable.
Jan 1 00:00:17    user    info    kernel: NET: Registered protocol family 16
Jan 1 00:00:17    user    warn    kernel: Total Flash size: 2048K with 32 sectors
Jan 1 00:00:17    user    warn    kernel: File system address: 0xbfc10100
Jan 1 00:00:17    user    warn    kernel: Can't analyze prologue code at 80188344
Jan 1 00:00:17    user    info    kernel: Initializing Cryptographic API
Jan 1 00:00:17    user    info    kernel: PPP generic driver version 2.4.2
Jan 1 00:00:17    user    info    kernel: PPP Deflate Compression module registered
Jan 1 00:00:17    user    info    kernel: PPP BSD Compression module registered
Jan 1 00:00:17    user    info    kernel: MPPE/MPPC encryption/compression module registered
Jan 1 00:00:17    user    info    kernel: NET: Registered protocol family 24
Jan 1 00:00:17    user    warn    kernel: Using noop io scheduler
Jan 1 00:00:17    user    warn    kernel: bcm963xx_mtd driver v1.0
Jan 1 00:00:17    user    warn    kernel: brcmboard: brcm_board_init entry
Jan 1 00:00:17    user    warn    kernel:
Jan 1 00:00:17    user    warn    kernel: ======= GPIO CONFIG_BCM96338 inited ========
Jan 1 00:00:17    user    info    kernel: Serial: BCM63XX driver $Revision: 3.00 $
Jan 1 00:00:17    user    warn    kernel: ttyS0 at MMIO 0xfffe0300 (irq = 10) is a BCM63XX
Jan 1 00:00:17    user    info    kernel: NET: Registered protocol family 2
Jan 1 00:00:17    user    info    kernel: IP: routing cache hash table of 512 buckets, 4Kbytes
Jan 1 00:00:17    user    info    kernel: TCP: Hash tables configured (established 512 bind 1024)
Jan 1 00:00:17    user    warn    kernel: ip_conntrack version 2.1 (61 buckets, 0 max) - 376 bytes per conntrack
Jan 1 00:00:17    user    warn    kernel: ip_tables: (C) 2000-2002 Netfilter core team
Jan 1 00:00:17    user    info    kernel: Initializing IPsec netlink socket
Jan 1 00:00:17    user    info    kernel: NET: Registered protocol family 1
Jan 1 00:00:17    user    info    kernel: NET: Registered protocol family 17
Jan 1 00:00:17    user    info    kernel: NET: Registered protocol family 15
Jan 1 00:00:17    user    notice    kernel: Ebtables v2.0 registered
Jan 1 00:00:17    user    info    kernel: NET: Registered protocol family 8
Jan 1 00:00:17    user    info    kernel: NET: Registered protocol family 20
Jan 1 00:00:17    user    info    kernel: 802.1Q VLAN Support v1.8 Ben Greear
Jan 1 00:00:17    user    info    kernel: All bugs added by David S. Miller
Jan 1 00:00:17    user    warn    kernel: VFS: Mounted root (squashfs filesystem) readonly.
Jan 1 00:00:17    user    info    kernel: Freeing unused kernel memory: 76k freed
Jan 1 00:00:17    user    warn    kernel: Algorithmics/MIPS FPU Emulator v1.5
Jan 1 00:00:17    user    warn    kernel: atmapi: module license 'Proprietary' taints kernel.
Jan 1 00:00:17    user    warn    kernel: adsl: adsl_init entry
Jan 1 00:00:17    user    warn    kernel: blaadd: blaa_detect entry
Jan 1 00:00:17    user    info    kernel: Broadcom BCMPROCFS v1.0 initialized
Jan 1 00:00:17    user    warn    kernel: Broadcom BCM6338A2 Ethernet Network Device v0.3 May 28 2008 12:22:14
Jan 1 00:00:17    user    warn    kernel: Config Internal PHY Through MDIO
Jan 1 00:00:17    user    info    kernel: BCM63xx_ENET: 100 MB Full-Duplex (auto-neg)
Jan 1 00:00:17    user    warn    kernel: eth0: MAC Address: 00:1C:F0:8E:E9:B4
Jan 1 00:00:17    user    crit    kernel: eth0 Link UP.
Jan 1 00:00:17    user    warn    kernel: BcmAdsl_Initialize=0xC00733F8, g_pFnNotifyCallback=0xC008BC64
Jan 1 00:00:17    user    warn    kernel: AnnexCParam=0x7FFF7EB8 AnnexAParam=0x00000980 adsl2=0x00000000
Jan 1 00:00:17    user    warn    kernel: pSdramPHY=0xA07FFFF8, 0x1B7777 0xDEADBEEF
Jan 1 00:00:17    user    warn    kernel: AdslCoreHwReset: AdslOemDataAddr = 0xA07FD3D4
Jan 1 00:00:17    user    warn    kernel: AnnexCParam=0x7FFF7EB8 AnnexAParam=0x00000980 adsl2=0x00000000
Jan 1 00:00:17    user    warn    kernel: dgasp: kerSysRegisterDyingGaspHandler: dsl0 registered
Jan 1 00:00:17    user    warn    kernel: ATM proc init !!!
Jan 1 00:00:17    user    crit    kernel: ADSL G.994 training
Jan 1 00:00:17    user    warn    kernel: ip_conntrack_pptp version 2.1 loaded
Jan 1 00:00:17    user    warn    kernel: ip_nat_pptp version 2.0 loaded
Jan 1 00:00:17    user    crit    kernel: ADSL G.992 started
Jan 1 00:00:17    user    info    kernel: device eth0 entered promiscuous mode
Jan 1 00:00:17    user    info    kernel: br0: port 1(eth0) entering learning state
Jan 1 00:00:17    user    info    kernel: br0: topology change detected, propagating
Jan 1 00:00:17    user    info    kernel: br0: port 1(eth0) entering forwarding state
Jan 1 00:00:17    user    info    kernel: device nas_0_0_35 entered promiscuous mode
Jan 1 00:00:17    user    info    kernel: br0: port 2(nas_0_0_35) entering learning state
Jan 1 00:00:17    user    info    kernel: br0: topology change detected, propagating
Jan 1 00:00:17    user    info    kernel: br0: port 2(nas_0_0_35) entering forwarding state
Jan 1 00:00:17    user    crit    kernel: ADSL G.992 channel analysis
Jan 1 00:00:17    user    debug    syslog: echo > /var/hosts
Jan 1 00:00:17    user    warn    kernel:
Jan 1 00:00:17    user    warn    kernel: ioctl, p_name=diapd
Jan 1 00:00:18    user    debug    syslog: pppd plugin pppoe rp_pppoe_service WebStream nas_0_0_35 nodetach user '60793@128' password ********** interface_name 0_0_35_1 usepeerdns refuse-eap persist lcp-echo-interval 30 holdoff 3 lcp-echo-failure 3
Jan 1 00:00:21    daemon    info    pppd[237]: Plugin pppoe loaded.
Jan 1 00:00:21    daemon    info    pppd[237]: RP-PPPoE plugin version 3.3 compiled against pppd 2.4.3
Jan 1 00:00:21    daemon    info    pppd[237]: Plugin pppoe called.
Jan 1 00:00:21    user    crit    kernel: ADSL link up, interleaved, us=1120, ds=11552
Jan 1 00:00:21    user    warn    kernel: ATM Soft SAR: ATM link connected.
Jan 1 00:00:23    daemon    notice    pppd[237]: pppd 2.4.3 started by admin, uid 0
Jan 1 00:00:24    daemon    info    pppd[237]: Using interface ppp0_0_35_1
Jan 1 00:00:24    daemon    warn    pppd[237]: Couldn't increase MRU to 1500
Jan 1 00:00:24    daemon    notice    pppd[237]: local IP address 10.64.68.161
Jan 1 00:00:24    daemon    notice    pppd[237]: remote IP address 10.112.116.209
Jan 1 00:00:29    user    debug    syslog: iptables -t nat -A PREROUTING -i br0 -d 192.168.0.100 -p udp --dport 53 -j DNAT --to 128.9.0.107
Jan 1 00:00:30    user    debug    syslog: iptables -t nat -A POSTROUTING -o ppp_0_0_35_1 -s 192.168.0.0/255.255.255.0 -j MASQUERADE
Jan 1 00:00:31    user    debug    syslog: route add default dev ppp_0_0_35_1 2>/dev/null
Jan 1 00:00:37    daemon    info    pppd[237]: Starting link
Jan 1 00:00:37    daemon    info    pppd[237]: PPP session is 12346
Jan 1 00:00:37    daemon    notice    pppd[237]: Connect: ppp_0_0_35_1 <--> nas_0_0_35
Jan 1 00:00:37    daemon    warn    pppd[237]: Couldn't increase MRU to 1500
Jan 1 00:00:37    daemon    warn    pppd[237]: Couldn't increase MRU to 1500
Jan 1 00:00:38    daemon    notice    pppd[237]: PAP authentication succeeded
Jan 1 00:00:38    daemon    notice    pppd[237]: peer from calling number 00:90:1A:42:B8:EF authorized
Jan 1 00:00:38    daemon    warn    pppd[237]: Local IP address changed to 92.125.71.156
Jan 1 00:00:38    daemon    warn    pppd[237]: Remote IP address changed to 213.228.116.68
Jan 1 00:00:40    user    debug    syslog: route add default gw 213.228.116.68 2>/dev/null
Jan 1 00:00:40    user    debug    syslog: iptables -A FORWARD -o ppp_0_0_35_1 -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
Jan 1 00:00:40    user    debug    syslog: iptables -A FORWARD -i ppp_0_0_35_1 -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
Jan 1 00:00:40    user    debug    syslog: echo > /proc/net/ip_conntrack
Jan 1 00:00:40    user    debug    syslog: echo "1000" > /proc/sys/net/ipv4/ip_conntrack_max
Jan 1 00:00:40    user    debug    syslog: iptables -t nat -D PREROUTING -i br0 -d 192.168.0.100 -p udp --dport 53 -j DNAT --to 128.9.0.107 2>/dev/null
Jan 1 00:00:40    user    debug    syslog: iptables -t nat -D POSTROUTING -o ppp_0_0_35_1 -s 192.168.0.0/255.255.255.0 -j MASQUERADE 2>/dev/null
Jan 1 00:00:40    user    debug    syslog: iptables -t nat -A POSTROUTING -o ppp_0_0_35_1 -s 192.168.0.0/255.255.255.0 -j MASQUERADE
Jan 1 00:00:41    user    debug    syslog: kill -9 231
Jan 1 00:00:41    user    debug    syslog: echo > /var/hosts
Jan 1 00:00:43    user    debug    syslog: iptables -I INPUT 1 -p icmp --icmp-type echo-request -i ppp_0_0_35_1 -j ACCEPT
Jun 11 02:22:08    user    alert    kernel: Intrusion -> IN=ppp_0_0_35_1 OUT= MAC= SRC=92.125.79.107 DST=92.125.71.156 LEN=48 TOS=0x00 PREC=0x00 TTL=127 ID=7465 DF PROTO=TCP SPT=1368 DPT=445 WINDOW=64800 RES=0x00 SYN URGP=0
Jun 11 02:22:10    user    alert    kernel: Intrusion -> IN=ppp_0_0_35_1 OUT= MAC= SRC=92.125.79.107 DST=92.125.71.156 LEN=48 TOS=0x00 PREC=0x00 TTL=127 ID=7549 DF PROTO=TCP SPT=1368 DPT=445 WINDOW=64800 RES=0x00 SYN URGP=0
Jun 11 02:24:33    user    debug    syslog: echo 0 > /var/isdft_cfg
Jun 11 02:24:38    user    alert    kernel: Intrusion -> IN=ppp_0_0_35_1 OUT= MAC= SRC=81.201.17.178 DST=92.125.71.156 LEN=48 TOS=0x00 PREC=0x00 TTL=117 ID=61989 DF PROTO=TCP SPT=1944 DPT=64213 WINDOW=65535 RES=0x00 SYN URGP=0
Jun 11 02:24:40    user    alert    kernel: Intrusion -> IN=ppp_0_0_35_1 OUT= MAC= SRC=81.201.17.178 DST=92.125.71.156 LEN=48 TOS=0x00 PREC=0x00 TTL=117 ID=62301 DF PROTO=TCP SPT=1944 DPT=64213 WINDOW=65535 RES=0x00 SYN URGP=0
Jun 11 02:24:46    user    alert    kernel: Intrusion -> IN=ppp_0_0_35_1 OUT= MAC= SRC=81.201.17.178 DST=92.125.71.156 LEN=48 TOS=0x00 PREC=0x00 TTL=117 ID=62749 DF PROTO=TCP SPT=1944 DPT=64213 WINDOW=65535 RES=0x00 SYN URGP=0
Jun 11 02:26:13    user    debug    syslog: echo 0 > /var/isdft_cfg
Jun 11 02:27:03    user    debug    syslog: echo 0 > /var/isdft_cfg
Jun 11 02:28:24    user    debug    syslog: echo 0 > /var/isdft_cfg
Jun 11 02:29:32    user    alert    kernel: Intrusion -> IN=ppp_0_0_35_1 OUT= MAC= SRC=64.252.1.179 DST=92.125.71.156 LEN=48 TOS=0x00 PREC=0x00 TTL=106 ID=55009 DF PROTO=TCP SPT=2317 DPT=5051 WINDOW=64512 RES=0x00 SYN URGP=0
Jun 11 02:29:35    user    alert    kernel: Intrusion -> IN=ppp_0_0_35_1 OUT= MAC= SRC=64.252.1.179 DST=92.125.71.156 LEN=48 TOS=0x00 PREC=0x00 TTL=106 ID=55095 DF PROTO=TCP SPT=2317 DPT=5051 WINDOW=64512 RES=0x00 SYN URGP=0
Jun 11 02:29:41    user    alert    kernel: Intrusion -> IN=ppp_0_0_35_1 OUT= MAC= SRC=64.252.1.179 DST=92.125.71.156 LEN=48 TOS=0x00 PREC=0x00 TTL=106 ID=55155 DF PROTO=TCP SPT=2317 DPT=5051 WINDOW=64512 RES=0x00 SYN URGP=0
Jun 11 02:30:10    user    debug    syslog: echo 0 > /var/isdft_cfg
Jun 11 02:30:16    user    warn    syslog: dns query failed
Jun 11 02:31:28    user    debug    syslog: echo 0 > /var/isdft_cfg

Jun 11 03:19:39     user     warn     syslog: dns query failed
Jun 11 03:20:52    user    alert    kernel: Intrusion -> IN=ppp_0_0_35_1 OUT= MAC= SRC=92.125.228.230 DST=92.125.71.156 LEN=48 TOS=0x00 PREC=0x00 TTL=122 ID=35473 DF PROTO=TCP SPT=4774 DPT=2967 WINDOW=65535 RES=0x00 SYN URGP=0
Jun 11 03:21:38    syslog    info    -- MARK --
Jun 11 03:28:36    user    warn    syslog: dns query failed
Jun 11 03:33:17    user    warn    syslog: dns query failed
Jun 11 03:35:36    user    alert    kernel: Intrusion -> IN=ppp_0_0_35_1 OUT= MAC= SRC=118.168.142.64 DST=92.125.71.156 LEN=52 TOS=0x00 PREC=0x00 TTL=47 ID=33889 DF PROTO=TCP SPT=4191 DPT=8080 WINDOW=65535 RES=0x00 SYN URGP=0
Jun 11 03:35:39    user    alert    kernel: Intrusion -> IN=ppp_0_0_35_1 OUT= MAC= SRC=118.168.142.64 DST=92.125.71.156 LEN=52 TOS=0x00 PREC=0x00 TTL=47 ID=34820 DF PROTO=TCP SPT=4191 DPT=8080 WINDOW=65535 RES=0x00 SYN URGP=0
Jun 11 03:42:50    user    alert    kernel: Intrusion -> IN=ppp_0_0_35_1 OUT= MAC= SRC=195.174.194.213 DST=92.125.71.156 LEN=52 TOS=0x00 PREC=0x00 TTL=108 ID=20088 DF PROTO=TCP SPT=1798 DPT=5051 WINDOW=65535 RES=0x00 SYN URGP=0
Jun 11 03:55:38    user    alert    kernel: Intrusion -> IN=ppp_0_0_35_1 OUT= MAC= SRC=80.70.23.14 DST=92.125.71.156 LEN=48 TOS=0x00 PREC=0x00 TTL=109 ID=39613 DF PROTO=TCP SPT=63023 DPT=64213 WINDOW=16384 RES=0x00 SYN URGP=0
Jun 11 04:09:32    user    warn    syslog: dns query failed
Jun 11 04:09:51    user    alert    kernel: Intrusion -> IN=ppp_0_0_35_1 OUT= MAC= SRC=80.70.23.14 DST=92.125.71.156 LEN=48 TOS=0x00 PREC=0x00 TTL=109 ID=28452 DF PROTO=TCP SPT=59739 DPT=64213 WINDOW=16384 RES=0x00 SYN URGP=0
Jun 11 04:14:43    user    warn    syslog: dns query failed
Jun 11 04:14:45    user    warn    syslog: dns query failed
Jun 11 04:21:00    user    warn    syslog: dns query failed
Jun 11 04:21:38    syslog    info    -- MARK --
Jun 11 04:23:37    user    warn    syslog: dns query failed
Jun 11 04:26:57    user    alert    kernel: Intrusion -> IN=ppp_0_0_35_1 OUT= MAC= SRC=118.168.142.64 DST=92.125.71.156 LEN=52 TOS=0x00 PREC=0x00 TTL=47 ID=58546 DF PROTO=TCP SPT=4617 DPT=8080 WINDOW=65535 RES=0x00 SYN URGP=0
Jun 11 04:27:00    user    alert    kernel: Intrusion -> IN=ppp_0_0_35_1 OUT= MAC= SRC=118.168.142.64 DST=92.125.71.156 LEN=52 TOS=0x00 PREC=0x00 TTL=47 ID=59933 DF PROTO=TCP SPT=4617 DPT=8080 WINDOW=65535 RES=0x00 SYN URGP=0
Jun 11 04:29:51    user    warn    syslog: dns query failed
Jun 11 04:30:24    user    warn    syslog: dns query failed
Jun 11 04:39:45    user    warn    syslog: dns query failed
Jun 11 04:51:09    user    warn    syslog: dns query failed
Jun 11 04:54:17    user    warn    syslog: dns query failed
Jun 11 04:58:27    user    warn    syslog: dns query failed
Jun 11 04:59:31    user    warn    syslog: dns query failed
Jun 11 05:04:43    user    warn    syslog: dns query failed
Jun 11 05:13:34    user    warn    syslog: dns query failed
Jun 11 05:19:45    user    alert    kernel: Intrusion -> IN=ppp_0_0_35_1 OUT= MAC= SRC=118.168.137.57 DST=92.125.71.156 LEN=52 TOS=0x00 PREC=0x00 TTL=47 ID=13403 DF PROTO=TCP SPT=3169 DPT=1080 WINDOW=65535 RES=0x00 SYN URGP=0
Jun 11 05:19:48    user    alert    kernel: Intrusion -> IN=ppp_0_0_35_1 OUT= MAC= SRC=118.168.137.57 DST=92.125.71.156 LEN=52 TOS=0x00 PREC=0x00 TTL=47 ID=14577 DF PROTO=TCP SPT=3169 DPT=1080 WINDOW=65535 RES=0x00 SYN URGP=0
Jun 11 05:19:50    user    warn    syslog: dns query failed
Jun 11 05:19:54    user    alert    kernel: Intrusion -> IN=ppp_0_0_35_1 OUT= MAC= SRC=118.168.137.57 DST=92.125.71.156 LEN=52 TOS=0x00 PREC=0x00 TTL=47 ID=16786 DF PROTO=TCP SPT=3169 DPT=1080 WINDOW=65535 RES=0x00 SYN URGP=0
Jun 11 05:21:25    user    warn    syslog: dns query failed
Jun 11 05:21:38    syslog    info    -- MARK --
Jun 11 05:31:16    user    warn    syslog: dns query failed
Jun 11 05:37:30    user    warn    syslog: dns query failed
Jun 11 05:39:36    user    warn    syslog: dns query failed
Jun 11 05:43:46    user    warn    syslog: dns query failed
Jun 11 06:03:59    user    warn    syslog: dns query failed
Jun 11 06:07:37    user    alert    kernel: Intrusion -> IN=ppp_0_0_35_1 OUT= MAC= SRC=92.125.71.132 DST=92.125.71.156 LEN=48 TOS=0x00 PREC=0x00 TTL=127 ID=24756 DF PROTO=TCP SPT=3667 DPT=135 WINDOW=64800 RES=0x00 SYN URGP=0
Jun 11 06:07:40    user    alert    kernel: Intrusion -> IN=ppp_0_0_35_1 OUT= MAC= SRC=92.125.71.132 DST=92.125.71.156 LEN=48 TOS=0x00 PREC=0x00 TTL=127 ID=24985 DF PROTO=TCP SPT=3667 DPT=135 WINDOW=64800 RES=0x00 SYN URGP=0
Jun 11 06:21:37    syslog    info    -- MARK --
Jun 11 06:30:03    user    alert    kernel: Intrusion -> IN=ppp_0_0_35_1 OUT= MAC= SRC=118.168.131.126 DST=92.125.71.156 LEN=52 TOS=0x00 PREC=0x00 TTL=47 ID=16205 DF PROTO=TCP SPT=4678 DPT=1080 WINDOW=62400 RES=0x00 SYN URGP=0
Jun 11 06:30:06    user    alert    kernel: Intrusion -> IN=ppp_0_0_35_1 OUT= MAC= SRC=118.168.131.126 DST=92.125.71.156 LEN=52 TOS=0x00 PREC=0x00 TTL=47 ID=17432 DF PROTO=TCP SPT=4678 DPT=1080 WINDOW=62400 RES=0x00 SYN URGP=0
Jun 11 06:30:12    user    alert    kernel: Intrusion -> IN=ppp_0_0_35_1 OUT= MAC= SRC=118.168.131.126 DST=92.125.71.156 LEN=52 TOS=0x00 PREC=0x00 TTL=47 ID=19904 DF PROTO=TCP SPT=4678 DPT=1080 WINDOW=62400 RES=0x00 SYN URGP=0
Jun 11 06:30:18    user    alert    kernel: Intrusion -> IN=ppp_0_0_35_1 OUT= MAC= SRC=118.168.131.126 DST=92.125.71.156 LEN=52 TOS=0x00 PREC=0x00 TTL=47 ID=22283 DF PROTO=TCP SPT=4067 DPT=8080 WINDOW=62400 RES=0x00 SYN URGP=0
Jun 11 06:30:21    user    alert    kernel: Intrusion -> IN=ppp_0_0_35_1 OUT= MAC= SRC=118.168.131.126 DST=92.125.71.156 LEN=52 TOS=0x00 PREC=0x00 TTL=47 ID=23551 DF PROTO=TCP SPT=4067 DPT=8080 WINDOW=62400 RES=0x00 SYN URGP=0
Jun 11 06:47:28    user    warn    syslog: dns query failed
Jun 11 06:56:49    user    alert    kernel: Intrusion -> IN=ppp_0_0_35_1 OUT= MAC= SRC=92.125.71.132 DST=92.125.71.156 LEN=48 TOS=0x00 PREC=0x00 TTL=127 ID=44720 DF PROTO=TCP SPT=3091 DPT=139 WINDOW=64800 RES=0x00 SYN URGP=0
Jun 11 06:56:52    user    alert    kernel: Intrusion -> IN=ppp_0_0_35_1 OUT= MAC= SRC=92.125.71.132 DST=92.125.71.156 LEN=48 TOS=0x00 PREC=0x00 TTL=127 ID=45000 DF PROTO=TCP SPT=3091 DPT=139 WINDOW=64800 RES=0x00 SYN URGP=0
Jun 11 07:18:01    user    warn    syslog: dns query failed
Jun 11 07:21:38    syslog    info    -- MARK --
Jun 11 07:25:25    user    alert    kernel: Intrusion -> IN=ppp_0_0_35_1 OUT= MAC= SRC=118.168.145.14 DST=92.125.71.156 LEN=52 TOS=0x00 PREC=0x00 TTL=47 ID=85 DF PROTO=TCP SPT=2931 DPT=8080 WINDOW=65535 RES=0x00 SYN URGP=0
Jun 11 07:25:28    user    alert    kernel: Intrusion -> IN=ppp_0_0_35_1 OUT= MAC= SRC=118.168.145.14 DST=92.125.71.156 LEN=52 TOS=0x00 PREC=0x00 TTL=47 ID=1190 DF PROTO=TCP SPT=2931 DPT=8080 WINDOW=65535 RES=0x00 SYN URGP=0
Jun 11 07:25:34    user    alert    kernel: Intrusion -> IN=ppp_0_0_35_1 OUT= MAC= SRC=118.168.145.14 DST=92.125.71.156 LEN=52 TOS=0x00 PREC=0x00 TTL=47 ID=3254 DF PROTO=TCP SPT=2931 DPT=8080 WINDOW=65535 RES=0x00 SYN URGP=0
Jun 11 07:40:05    user    alert    kernel: Intrusion -> IN=ppp_0_0_35_1 OUT= MAC= SRC=91.122.59.135 DST=92.125.71.156 LEN=48 TOS=0x00 PREC=0x00 TTL=117 ID=65095 DF PROTO=TCP SPT=2629 DPT=64213 WINDOW=65535 RES=0x00 SYN URGP=0
Jun 11 07:46:59    user    alert    kernel: Intrusion -> IN=ppp_0_0_35_1 OUT= MAC= SRC=92.125.75.144 DST=92.125.71.156 LEN=48 TOS=0x00 PREC=0x00 TTL=127 ID=13452 DF PROTO=TCP SPT=3825 DPT=1433 WINDOW=64800 RES=0x00 SYN URGP=0
Jun 11 07:49:06    user    warn    syslog: dns query failed
Jun 11 07:50:41    user    warn    syslog: dns query failed
Jun 11 07:54:35    user    alert    kernel: Intrusion -> IN=ppp_0_0_35_1 OUT= MAC= SRC=118.167.131.160 DST=92.125.71.156 LEN=40 TOS=0x00 PREC=0x00 TTL=111 ID=336 PROTO=TCP SPT=10327 DPT=1080 WINDOW=32 RES=0x00 SYN URGP=0
Jun 11 07:56:54    user    warn    syslog: dns query failed
Jun 11 08:00:16    user    alert    kernel: Intrusion -> IN=ppp_0_0_35_1 OUT= MAC= SRC=91.122.59.135 DST=92.125.71.156 LEN=48 TOS=0x00 PREC=0x00 TTL=117 ID=5428 DF PROTO=TCP SPT=3786 DPT=64213 WINDOW=65535 RES=0x00 SYN URGP=0
Jun 11 08:10:36    user    alert    kernel: Intrusion -> IN=ppp_0_0_35_1 OUT= MAC= SRC=91.122.59.135 DST=92.125.71.156 LEN=48 TOS=0x00 PREC=0x00 TTL=117 ID=44488 DF PROTO=TCP SPT=4240 DPT=64213 WINDOW=65535 RES=0x00 SYN URGP=0
Jun 11 08:21:38    syslog    info    -- MARK --