What do these security entries mean?

[acidman1]

Hi

Could anyone tell me what these entries in my router security log means ans what I can do about them? Are these attempts at my router or pc's on the network?

IP Spoofing Attack: IN=ppp1.1 OUT=n/a MAC= SRC=31.13.90.34 DST=169.0.60.224 LEN=89 TOS=0x00 PREC=0x00 TTL=77 DF PROTO=TCP SPT=443 DPT=39247 WINDOW=70 RES=0x00 ACK PSH FIN URGP=0 MARK=0x8000000

IP Spoofing Attack: IN=ppp1.1 OUT=n/a MAC= SRC=31.13.90.34 DST=169.0.60.224 LEN=89 TOS=0x00 PREC=0x00 TTL=77 DF PROTO=TCP SPT=443 DPT=39247 WINDOW=70 RES=0x00 ACK PSH FIN URGP=0 MARK=0x8000000

IP Spoofing Attack: IN=ppp1.1 OUT=n/a MAC= SRC=31.13.90.34 DST=169.0.60.224 LEN=52 TOS=0x00 PREC=0x00 TTL=77 DF PROTO=TCP SPT=443 DPT=39247 WINDOW=70 RES=0x00 ACK FIN URGP=0 MARK=0x8000000

 

[SauRoNZA]

Hi

Could anyone tell me what these entries in my router security log means ans what I can do about them? Are these attempts at my router or pc's on the network?

IP Spoofing Attack: IN=ppp1.1 OUT=n/a MAC= SRC=31.13.90.34 DST=169.0.60.224 LEN=89 TOS=0x00 PREC=0x00 TTL=77 DF PROTO=TCP SPT=443 DPT=39247 WINDOW=70 RES=0x00 ACK PSH FIN URGP=0 MARK=0x8000000

IP Spoofing Attack: IN=ppp1.1 OUT=n/a MAC= SRC=31.13.90.34 DST=169.0.60.224 LEN=89 TOS=0x00 PREC=0x00 TTL=77 DF PROTO=TCP SPT=443 DPT=39247 WINDOW=70 RES=0x00 ACK PSH FIN URGP=0 MARK=0x8000000

IP Spoofing Attack: IN=ppp1.1 OUT=n/a MAC= SRC=31.13.90.34 DST=169.0.60.224 LEN=52 TOS=0x00 PREC=0x00 TTL=77 DF PROTO=TCP SPT=443 DPT=39247 WINDOW=70 RES=0x00 ACK FIN URGP=0 MARK=0x8000000

It's coming from the outside (IN=ppp as in your pppoe connection) and it's basically detecting that someone/something is pretending to be someone/something else.

SPT = Source Post 443 (HTTPS)
DPT = Destination Port

Not much you can do about it but ignore them. Ultimately if you are seeing it in the logs then it means your Router's security protocols are actually working...so in reality you want them to be there.

 

[acidman1]

Excellent, I thought as much but wanted to double check. No real way of blocking them as I see the ip changes and my 169 ip is not static either.