Oct 4 17:54:02 user alert kernel: Intrusion -> IN=ppp_0_0_35_1 OUT= MAC= SRC=31.23.26.160 DST=31.23.13.230 LEN=48 TOS=0x00 PREC=0x00 TTL=127 ID=61828 DF PROTO=TCP SPT=2677 DPT=135 WINDOW=65535 RES=0x00 SYN URGP=0
Oct 4 17:54:17 user notice igmp[2383]: setsockopt IP_MSFILTER
Oct 4 17:55:21 syslog info -- MARK --
Oct 4 17:56:22 user notice igmp[2383]: setsockopt IP_MSFILTER
Oct 4 17:58:27 user notice igmp[2383]: setsockopt IP_MSFILTER
Oct 4 18:00:32 user notice igmp[2383]: setsockopt IP_MSFILTER
Oct 4 18:02:37 user notice igmp[2383]: setsockopt IP_MSFILTER
Oct 4 18:03:47 user alert kernel: Intrusion -> IN=ppp_0_0_35_1 OUT= MAC= SRC=178.178.47.2 DST=31.23.13.230 LEN=52 TOS=0x00 PREC=0x00 TTL=114 ID=16699 DF PROTO=TCP SPT=56174 DPT=11272 WINDOW=8192 RES=0x00 SYN URGP=0
Oct 4 18:04:42 user notice igmp[2383]: setsockopt IP_MSFILTER
Oct 4 18:06:47 user notice igmp[2383]: setsockopt IP_MSFILTER
Oct 4 18:08:52 user notice igmp[2383]: setsockopt IP_MSFILTER
Oct 4 18:10:57 user notice igmp[2383]: setsockopt IP_MSFILTER
Oct 4 18:13:02 user notice igmp[2383]: setsockopt IP_MSFILTER
Oct 4 18:15:07 user notice igmp[2383]: setsockopt IP_MSFILTER
Oct 4 18:15:16 user crit kernel: eth0 Link DOWN.
Oct 4 18:15:16 user info kernel: br0: port 2(eth0) entering disabled state
Oct 4 18:15:18 user crit kernel: eth0 Link UP.
Oct 4 18:15:19 user info kernel: br0: port 2(eth0) entering learning state
Oct 4 18:15:19 user info kernel: br0: topology change detected, propagating
Oct 4 18:15:19 user info kernel: br0: port 2(eth0) entering forwarding state
Oct 4 18:16:07 user alert kernel: Intrusion -> IN=ppp_0_0_35_1 OUT= MAC= SRC=31.23.117.140 DST=31.23.13.230 LEN=48 TOS=0x00 PREC=0x00 TTL=127 ID=48286 DF PROTO=TCP SPT=2527 DPT=135 WINDOW=65535 RES=0x00 SYN URGP=0
Oct 4 18:19:27 user debug igmp[2952]: iptables -t filter -I FORWARD 1 -i ppp_0_0_35_1 -d 239.255.255.250 -j DROP 2>/dev/null
Oct 4 18:19:27 user debug igmp[2954]: iptables -t filter -D FORWARD -i ppp_0_0_35_1 -d 239.255.255.250 -j ACCEPT 2>/dev/null
Oct 4 18:19:27 user notice igmp[2383]: setsockopt- MRT_DEL_MFC
Oct 4 18:19:27 user notice igmp[2383]: perror:setsockopt - IP_DROP_MEMBERSHIP
Oct 4 18:19:27 user debug igmp[2956]: iptables -t filter -I FORWARD 1 -i ppp_0_0_35_1 -d 224.0.0.252 -j DROP 2>/dev/null
Oct 4 18:19:27 user debug igmp[2958]: iptables -t filter -D FORWARD -i ppp_0_0_35_1 -d 224.0.0.252 -j ACCEPT 2>/dev/null
Oct 4 18:19:27 user notice igmp[2383]: setsockopt- MRT_DEL_MFC
Oct 4 18:19:53 user alert kernel: Intrusion -> IN=ppp_0_0_35_1 OUT= MAC= SRC=31.23.23.72 DST=31.23.13.230 LEN=48 TOS=0x00 PREC=0x00 TTL=127 ID=62089 DF PROTO=TCP SPT=47076 DPT=445 WINDOW=65535 RES=0x00 SYN URGP=0
Oct 4 18:19:56 user alert kernel: Intrusion -> IN=ppp_0_0_35_1 OUT= MAC= SRC=31.23.23.72 DST=31.23.13.230 LEN=48 TOS=0x00 PREC=0x00 TTL=127 ID=62198 DF PROTO=TCP SPT=47076 DPT=445 WINDOW=65535 RES=0x00 SYN URGP=0
Oct 4 18:20:39 user alert kernel: Intrusion -> IN=ppp_0_0_35_1 OUT= MAC= SRC=31.23.46.109 DST=31.23.13.230 LEN=48 TOS=0x00 PREC=0x00 TTL=127 ID=50408 DF PROTO=TCP SPT=2429 DPT=135 WINDOW=65535 RES=0x00 SYN URGP=0
Oct 4 18:20:40 user alert kernel: Intrusion -> IN=ppp_0_0_35_1 OUT= MAC= SRC=31.23.46.109 DST=31.23.13.230 LEN=48 TOS=0x00 PREC=0x00 TTL=127 ID=50595 DF PROTO=TCP SPT=2692 DPT=445 WINDOW=65535 RES=0x00 SYN URGP=0
Oct 4 18:21:04 user alert kernel: Intrusion -> IN=ppp_0_0_35_1 OUT= MAC= SRC=31.23.114.25 DST=31.23.13.230 LEN=48 TOS=0x00 PREC=0x00 TTL=127 ID=43218 DF PROTO=TCP SPT=2819 DPT=135 WINDOW=65535 RES=0x00 SYN URGP=0
Oct 4 18:31:45 user alert kernel: Intrusion -> IN=ppp_0_0_35_1 OUT= MAC= SRC=31.23.63.90 DST=31.23.13.230 LEN=48 TOS=0x00 PREC=0x00 TTL=127 ID=36595 DF PROTO=TCP SPT=3826 DPT=135 WINDOW=65535 RES=0x00 SYN URGP=0
Oct 4 18:41:56 user alert kernel: Intrusion -> IN=ppp_0_0_35_1 OUT= MAC= SRC=95.78.150.194 DST=31.23.13.230 LEN=40 TOS=0x00 PREC=0x00 TTL=114 ID=256 PROTO=TCP SPT=6000 DPT=1433 WINDOW=16384 RES=0x00 SYN URGP=0
Oct 4 18:50:04 user alert kernel: Intrusion -> IN=ppp_0_0_35_1 OUT= MAC= SRC=31.23.46.109 DST=31.23.13.230 LEN=48 TOS=0x00 PREC=0x00 TTL=127 ID=38514 DF PROTO=TCP SPT=2115 DPT=135 WINDOW=65535 RES=0x00 SYN URGP=0
Oct 4 18:54:59 daemon info pppd[730]: No response to 5 echo-requests
Oct 4 18:54:59 daemon notice pppd[730]: Serial link appears to be disconnected.
Oct 4 18:54:59 daemon info pppd[730]: Connect time 6184494.1 minutes.
Oct 4 18:54:59 daemon info pppd[730]: Sent 10778189 bytes, received 253800576 bytes.
Oct 4 18:54:59 daemon warn pppd[730]: Couldn't increase MRU to 1500
Oct 4 18:55:05 daemon notice pppd[730]: Connection terminated....
Oct 4 18:55:08 daemon info pppd[730]: Sent PADT
Oct 4 18:55:18 daemon info pppd[730]: PPP session is 15018
Oct 4 18:55:18 daemon info pppd[730]: Using interface ppp0_0_35_1
Oct 4 18:55:18 daemon notice pppd[730]: Connect: ppp_0_0_35_1 <--> nas_0_0_35
Oct 4 18:55:18 daemon warn pppd[730]: Couldn't increase MRU to 1500
Oct 4 18:55:21 syslog info -- MARK --
Oct 4 18:55:25 daemon notice pppd[730]: PAP authentication succeeded
Oct 4 18:55:25 daemon notice pppd[730]: peer from calling number 00:90:1A:A3:42:A1 authorized
Oct 4 18:55:38 daemon notice pppd[730]: local IP address 109.165.124.201
Oct 4 18:55:38 daemon notice pppd[730]: remote IP address 83.221.214.195
Oct 4 18:55:38 daemon notice pppd[730]: primary DNS address 80.254.108.198
Oct 4 18:55:38 daemon notice pppd[730]: secondary DNS address 80.254.108.206
Oct 4 18:55:38 user debug tr64[7266]: route add default gw 83.221.214.195 2>/dev/null
Oct 4 18:55:38 user debug tr64[7268]: iptables -A FORWARD -o ppp_0_0_35_1 -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
Oct 4 18:55:38 user debug tr64[7270]: iptables -A FORWARD -i ppp_0_0_35_1 -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
Oct 4 18:55:38 user debug tr64[7272]: iptables -t nat -D POSTROUTING -o ppp_0_0_35_1 -s 10.0.0.0/255.255.255.0 -j MASQUERADE 2>/dev/null
Oct 4 18:55:38 user debug tr64[7274]: iptables -t nat -A POSTROUTING -o ppp_0_0_35_1 -s 10.0.0.0/255.255.255.0 -j MASQUERADE
Oct 4 18:55:39 user debug tr64[7290]: iptables -I INPUT 1 -j ACCEPT -i ppp_0_0_35_1 -p tcp --dport 30005
Oct 4 18:55:39 user alert kernel: Intrusion -> IN=ppp_0_0_35_1 OUT= MAC= SRC=77.93.20.76 DST=109.165.124.201 LEN=60 TOS=0x00 PREC=0x00 TTL=117 ID=3944 DF PROTO=TCP SPT=57898 DPT=19396 WINDOW=8192 RES=0x00 SYN URGP=0
Oct 4 18:55:39 user debug tr64[7292]: iptables -I FORWARD 1 -j ACCEPT -i ppp_0_0_35_1 -p tcp --dport 30005
Oct 4 18:55:39 user debug tr64[7294]: iptables -I INPUT 1 -j ACCEPT -i ppp_0_0_35_1 -p udp -s 10.0.0.138/24 --dport 30006
Oct 4 18:55:39 user debug tr64[7296]: iptables -I FORWARD 1 -j ACCEPT -i ppp_0_0_35_1 -p udp -s 10.0.0.138/24 --dport 30006
Oct 4 18:55:41 user debug tr64[7300]: kill -SIGTERM 2383
Oct 4 18:55:41 user debug tr64[7302]: /bin/igmp ppp_0_0_35_1 &
Oct 4 18:55:41 user notice igmp[7303]: igmp started!
Oct 4 18:55:41 user notice igmp[7303]: setsockopt - MRT_ADD_VIF
Oct 4 18:55:45 user alert kernel: Intrusion -> IN=ppp_0_0_35_1 OUT= MAC= SRC=85.232.130.153 DST=109.165.124.201 LEN=48 TOS=0x00 PREC=0x00 TTL=118 ID=60487 DF PROTO=TCP SPT=2795 DPT=19396 WINDOW=65535 RES=0x00 SYN URGP=0
Oct 4 18:55:47 user alert kernel: Intrusion -> IN=ppp_0_0_35_1 OUT= MAC= SRC=77.108.110.162 DST=109.165.124.201 LEN=48 TOS=0x00 PREC=0x00 TTL=119 ID=29148 DF PROTO=TCP SPT=53192 DPT=19396 WINDOW=65535 RES=0x00 SYN URGP=0
Oct 4 18:55:48 user alert kernel: Intrusion -> IN=ppp_0_0_35_1 OUT= MAC= SRC=77.93.20.76 DST=109.165.124.201 LEN=56 TOS=0x00 PREC=0x00 TTL=117 ID=9973 DF PROTO=TCP SPT=57898 DPT=19396 WINDOW=8192 RES=0x00 SYN URGP=0
Oct 4 18:55:51 user alert kernel: Intrusion -> IN=ppp_0_0_35_1 OUT= MAC= SRC=85.232.130.153 DST=109.165.124.201 LEN=48 TOS=0x00 PREC=0x00 TTL=118 ID=60582 DF PROTO=TCP SPT=2795 DPT=19396 WINDOW=65535 RES=0x00 SYN URGP=0
Oct 4 18:55:52 user alert kernel: Intrusion -> IN=ppp_0_0_35_1 OUT= MAC= SRC=77.52.120.140 DST=109.165.124.201 LEN=48 TOS=0x00 PREC=0x00 TTL=116 ID=9804 DF PROTO=TCP SPT=1840 DPT=42264 WINDOW=64380 RES=0x00 SYN URGP=0
Oct 4 18:56:00 daemon debug user: found route to name ppp_0_0_35_1 ipAdress 109.165.124.201
Oct 4 18:56:00 daemon debug user: dns_lookup(acs.bezek.com) = 147.235.246.93
Oct 4 19:00:01 user notice igmp[7303]: setsockopt- MRT_DEL_MFC
Oct 4 19:00:01 user notice igmp[7303]: setsockopt- MRT_DEL_MFC
Oct 4 19:00:01 user notice igmp[7303]: setsockopt- MRT_DEL_MFC
Oct 4 19:00:01 user notice igmp[7303]: setsockopt- MRT_DEL_MFC
Oct 4 19:03:19 daemon info pppd[730]: No response to 5 echo-requests
Oct 4 19:03:19 daemon notice pppd[730]: Serial link appears to be disconnected.
Oct 4 19:03:19 daemon info pppd[730]: Connect time 7.7 minutes.
Oct 4 19:03:19 daemon info pppd[730]: Sent 1727 bytes, received 25427 bytes.
Oct 4 19:03:19 daemon warn pppd[730]: Couldn't increase MRU to 1500
Oct 4 19:03:25 daemon notice pppd[730]: Connection terminated....
Oct 4 19:03:28 daemon info pppd[730]: Sent PADT
Oct 4 19:03:43 daemon info pppd[730]: PPP session is 13024
Oct 4 19:03:43 daemon info pppd[730]: Using interface ppp0_0_35_1
Oct 4 19:03:43 daemon notice pppd[730]: Connect: ppp_0_0_35_1 <--> nas_0_0_35
Oct 4 19:03:43 daemon warn pppd[730]: Couldn't increase MRU to 1500
Oct 4 19:03:46 daemon notice pppd[730]: PAP authentication succeeded
Oct 4 19:03:46 daemon notice pppd[730]: peer from calling number 00:90:1A:A4:49:E0 authorized
Oct 4 19:03:55 daemon notice pppd[730]: local IP address 31.23.107.127
Oct 4 19:03:55 daemon notice pppd[730]: remote IP address 83.221.214.193
Oct 4 19:03:55 daemon notice pppd[730]: primary DNS address 80.254.108.194
Oct 4 19:03:55 daemon notice pppd[730]: secondary DNS address 80.254.108.202
Oct 4 19:03:56 user debug tr64[11436]: route add default gw 83.221.214.193 2>/dev/null
Oct 4 19:03:56 user debug tr64[11438]: iptables -A FORWARD -o ppp_0_0_35_1 -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
Oct 4 19:03:56 user debug tr64[11440]: iptables -A FORWARD -i ppp_0_0_35_1 -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
Oct 4 19:03:56 user debug tr64[11442]: iptables -t nat -D POSTROUTING -o ppp_0_0_35_1 -s 10.0.0.0/255.255.255.0 -j MASQUERADE 2>/dev/null
Oct 4 19:03:56 user debug tr64[11444]: iptables -t nat -A POSTROUTING -o ppp_0_0_35_1 -s 10.0.0.0/255.255.255.0 -j MASQUERADE
Oct 4 19:03:56 user debug tr64[11460]: iptables -I INPUT 1 -j ACCEPT -i ppp_0_0_35_1 -p tcp --dport 30005
Oct 4 19:03:56 user debug tr64[11462]: iptables -I FORWARD 1 -j ACCEPT -i ppp_0_0_35_1 -p tcp --dport 30005
Oct 4 19:03:56 user debug tr64[11464]: iptables -I INPUT 1 -j ACCEPT -i ppp_0_0_35_1 -p udp -s 10.0.0.138/24 --dport 30006
Oct 4 19:03:56 user debug tr64[11466]: iptables -I FORWARD 1 -j ACCEPT -i ppp_0_0_35_1 -p udp -s 10.0.0.138/24 --dport 30006
Oct 4 19:03:59 daemon info pppd[730]: Connect time 0.1 minutes.
Oct 4 19:03:59 daemon info pppd[730]: Sent 0 bytes, received 10 bytes.
Oct 4 19:03:59 daemon notice pppd[730]: local IP address 31.23.107.127
Oct 4 19:03:59 daemon notice pppd[730]: remote IP address 83.221.214.193
Oct 4 19:03:59 daemon notice pppd[730]: primary DNS address 80.254.108.194
Oct 4 19:03:59 daemon notice pppd[730]: secondary DNS address 80.254.108.202
Oct 4 19:06:09 user warn dnsprobe[2346]: dns query failed
Oct 4 19:06:11 user warn dnsprobe[2346]: dns query failed
Oct 4 19:06:13 user warn dnsprobe[2346]: dns query failed
Oct 4 19:06:13 user notice dnsprobe[2346]: Primary DNS server Is Down... Switching To Secondary DNS server
Oct 4 19:07:21 user alert kernel: Intrusion -> IN=ppp_0_0_35_1 OUT= MAC= SRC=2.92.51.219 DST=31.23.107.127 LEN=48 TOS=0x00 PREC=0x00 TTL=120 ID=27713 DF PROTO=TCP SPT=1898 DPT=6881 WINDOW=65535 RES=0x00 SYN URGP=0
Oct 4 19:07:24 user alert kernel: Intrusion -> IN=ppp_0_0_35_1 OUT= MAC= SRC=31.23.117.140 DST=31.23.107.127 LEN=48 TOS=0x00 PREC=0x00 TTL=127 ID=15516 DF PROTO=TCP SPT=1460 DPT=135 WINDOW=65535 RES=0x00 SYN URGP=0
Oct 4 19:08:37 user crit kernel: eth0 Link DOWN.
Oct 4 19:08:37 user info kernel: br0: port 2(eth0) entering disabled state
Oct 4 19:08:40 user crit kernel: eth0 Link UP.
Oct 4 19:08:40 user info kernel: br0: port 2(eth0) entering learning state
Oct 4 19:08:40 user info kernel: br0: topology change detected, propagating
Oct 4 19:08:40 user info kernel: br0: port 2(eth0) entering forwarding state
Oct 4 19:08:43 user notice igmp[7303]: setsockopt IP_MSFILTER
Oct 4 19:08:43 user notice igmp[7303]: setsockopt IP_MSFILTER
Oct 4 19:08:43 user notice igmp[7303]: setsockopt IP_MSFILTER
Oct 4 19:08:43 user notice igmp[7303]: setsockopt IP_MSFILTER
Oct 4 19:08:43 user notice igmp[7303]: igmp:IP_ADD_MEMBERSHIP Failed
Oct 4 19:08:43 user debug igmp[11722]: iptables -D FORWARD -i ppp_0_0_35_1 -d 239.255.255.250 -j DROP 2>/dev/null
Oct 4 19:08:43 user debug igmp[11724]: iptables -t filter -I FORWARD 1 -i ppp_0_0_35_1 -d 239.255.255.250 -j ACCEPT 2>/dev/null
Oct 4 19:08:43 user notice igmp[7303]: setsockopt IP_MSFILTER
Oct 4 19:08:43 user notice igmp[7303]: setsockopt IP_MSFILTER
Oct 4 19:08:43 user notice igmp[7303]: setsockopt IP_MSFILTER
Oct 4 19:08:46 user notice igmp[7303]: setsockopt IP_MSFILTER
Oct 4 19:08:46 user notice igmp[7303]: setsockopt IP_MSFILTER
Oct 4 19:08:46 user notice igmp[7303]: setsockopt IP_MSFILTER
Oct 4 19:08:53 user debug tr64[11726]: wlctl -i wl0 phytype > /var/wl0
Oct 4 19:08:53 user debug tr64[11728]: wlctl -i wl0 revinfo > /var/wl0
Oct 4 19:08:53 user debug tr64[11730]: wlctl -i wl0 bands > /var/wl0bands
Oct 4 19:08:53 user debug tr64[11732]: wlctl -i wl0 phytype > /var/wl0
Oct 4 19:08:53 user debug tr64[11734]: wlctl -i wl0 revinfo > /var/wl0
Oct 4 19:08:53 user debug tr64[11736]: wlctl -i wl0 bands > /var/wl0bands
Oct 4 19:08:53 user debug tr64[11738]: wlctl -i wl0 phytype > /var/wl0
Oct 4 19:08:53 user debug tr64[11740]: wlctl -i wl0 revinfo > /var/wl0
Oct 4 19:08:53 user debug tr64[11742]: wlctl -i wl0 bands > /var/wl0bands
Oct 4 19:08:53 user debug tr64[11744]: wlctl -i wl0 phytype > /var/wl0
Oct 4 19:08:53 user debug tr64[11746]: wlctl -i wl0 revinfo > /var/wl0
Oct 4 19:08:53 user debug tr64[11748]: wlctl -i wl0 bands > /var/wl0bands
Oct 4 19:08:53 user debug tr64[11750]: wlctl -i wl0 phytype > /var/wl0
Oct 4 19:08:54 user debug tr64[11752]: wlctl -i wl0 revinfo > /var/wl0
Oct 4 19:08:54 user debug tr64[11754]: wlctl -i wl0 bands > /var/wl0bands