- Review of my home broadband router logs (suspicious activity?) - 14 Updates
- Does a capital ship sinking actually SUCK a swimmer down to drown? - 2 Updates
- Marshall JCM 600 oscillating - 1 Update
- Fluke 73III fluke repair - 1 Update
Micky <NONONOmisc07@bigfoot.com>: Dec 23 10:16AM -0500 On Wed, 23 Dec 2015 10:06:04 -0500, "Paul M. Cook" <pmcook@gte.net> wrote: >Maybe. But is *that* what the error message says? >I guess I need to *experiment*, by asking the kid to play a few >games and then watch the router log file. Good idea. >What is worrisome is that some of the entries don't come from >what I'd expect an online game to come from, e.g., Brazil, >Mexico, Japan, France, etc. When I went to France in 1974, I thought I could impress girls with hershey bars and nylon stockings, but instead I couldnt' afford to eat in a real restaurant. (though I did eat in an expensive restaurant in Amsterdam before the flight home, rijstafel, and it was only meal I shared with a girl I met the previous day, and we were on the same plane the day after the meal and we were both sick. From the expensive meal) IOW, despite the impression we're oftren given, they have civilization in those places, and even infra-civilization like games. I'm sure there are gamers in all those countries, but there may also be hackers . |
"Mayayana" <mayayana@invalid.nospam>: Dec 23 10:17AM -0500 That's interesting. I didn't know routers kept logs. Did you find that by logging in to the "control panel"? I used to get a lot of attempts to get into my computer when I had dialup. That mostly stopped with cable, though I have caught my cable company, RCN, trying to get in. I have no idea why. Apparently they just go around snooping on customers, perhaps tracking how many machines are at each address, or some such. First, do you have a good, long password for your router? You should. Maybe 20 characters. You didn't mention what computers you have. Assuming Windows... It's important to understand that most Windows computers are full of holes. The default configuration has numerous unsafe services running. Many people now also enable remote Desktop functionality for tech support. You should have a firewall that blocks all incoming and asks permission for all outgoing processes. (In many cases it's also possible to block svchost from going out, which takes care of most or all Microsoft spyware.) Some may remember there was a problem with XP in the early days. A service called Messenger (not Windows Messenger) was running by default. It was intended for sys admin people in corporations to be able to pop up notices to employees on the network. (Like "Don't forget: Company picnic on Saturday.") It was being used to show people ads. The problem is that Windows NT (2000/XP/Vista/7/8/10) is designed to be a corporate workstation. It's a sieve, set up with the assumption that the network is safe while the users can't be trusted. If you want to set up reasonable security see here: http://www.blackviper.com/ You can use that site to adjust services. And get a firewall. I don't know much about Playstation, but that's a good example of increasing intrusion online. Online services and spyware operating systems are changing the norm. Most software is now designed to call home without asking. A few years ago that was known as spyware. Windows 10 is a new level of spyware. It now has a privacy policy and TOS that claim Microsoft has a legal right to spy on virtually everything you do. (I suspect Playstation is probably worse in that regard.) At the same time, more people want more of those services. Without selling out to Apple you can't get all those nifty apps. Without selling out to Adobe you can no longer use Photoshop without it spying on you. The latest version is still installed on your computer, but it's officially marketed as an online service. The difference is not so much in the software but in the fact that you have to accept it as spyware. MS Office and many other programs are going the same way. They want to steal your car and rent you a taxi. So there may be different, conflicting concerns for you. One concern is preventing malware/spyware intrusion by strengthening your security. But then there's also the issue of whether you're actually willing and able to do that in the context of how you want to use your connected devices. If you want to accept and use online services then you must accept that you're now in a shopping mall. The mall cameras, marketing data collectors and security guards will be watching. You're on their property, not your own. |
Micky <NONONOmisc07@bigfoot.com>: Dec 23 10:51AM -0500 On Wed, 23 Dec 2015 09:58:45 -0500, "Paul M. Cook" <pmcook@gte.net> wrote: >> Do you see just these sporadic accesses? >That's an excerpt only but those were the only messages listed with the >prefix of "[LAN access from remote]". I thought I'd look at my log, for the first time in 8 years. The only wireless device I use is a printer. Dec/21/2015 18:59:18 DHCP lease IP 192.168.0.106 to android-fce7fa4f93da6881 64-89-9A-6E-9C-85 Dec/21/2015 18:59:09 DHCP lease IP 192.168.0.106 to android-fce7fa4f93da6881 64-89-9A-6E-9C-85 Dec/21/2015 18:59:04 DHCP lease IP 192.168.0.106 to android-fce7fa4f93da6881 64-89-9A-6E-9C-85 Dec/20/2015 05:20:07 DHCP lease IP 192.168.0.102 to Dennis-Iphone-2 70-3E-AC-DE-14-94 Dec/20/2015 05:20:06 DHCP lease IP 192.168.0.102 to Dennis-Iphone-2 70-3E-AC-DE-14-94 So who is Dennis? 5 in the morning? That's my time, right? or GMT? Dec/20/2015 05:20:05 Wireless PC connected 70-3E-AC-DE-14-94 Dec/19/2015 23:51:38 Wireless PC connected A4-EE-57-E3-09-E4 Whose is this wireless PC? I have one, but haven't used it in weeks. Dec/19/2015 21:48:06 DHCP Request success 192.168.1.46 Dec/19/2015 21:48:06 DHCP Request 192.168.1.46 Dec/19/2015 15:16:58 DHCP lease IP 192.168.0.100 to EPSONE309E4 A4-EE-57-E3-09-E4 Dec/19/2015 10:13:04 DHCP lease IP 192.168.0.102 to Dennis-Iphone-2 70-3E-AC-DE-14-94 Dec/19/2015 10:13:02 DHCP lease IP 192.168.0.102 to Dennis-Iphone-2 70-3E-AC-DE-14-94 The Epson is my printer. I was probably printing the crossword puzzle. But more Dennis! Dec/19/2015 10:13:02 Wireless PC connected 70-3E-AC-DE-14-94 Dec/19/2015 07:51:01 DHCP lease IP 192.168.0.105 to android_a1d17253796b3c9c 14-7D-C5-A7-E9-5C I have a cell phone that runs android, but I don't think I've had it on in the house on the 19th. I haven't tried to connect to wifi with it for a year or more. Could something like this cause interruptions in my internet, which I get sometimes? The router light for the jack I use flickers all the time, but sometimes no data gets dl'd. I have DSL. Dec/16/2015 15:12:23 DHCP lease IP 192.168.0.103 to Tiyes-Iphone-2 20-A2-E4-E7-81-36 Dec/16/2015 08:49:25 Wireless PC connected A4-EE-57-E3-09-E4 Dec/16/2015 06:25:38 Wireless PC connected A4-EE-57-E3-09-E4 Dec/16/2015 05:27:09 Wireless PC connected A4-EE-57-E3-09-E4 Dec/16/2015 05:26:17 Wireless PC connected A4-EE-57-E3-09-E4 Dec/13/2015 20:22:09 Wireless PC connected A4-EE-57-E3-09-E4 Dec/13/2015 20:21:49 Wireless PC connected A4-EE-57-E3-09-E4 Dec/13/2015 12:27:17 DHCP lease IP 192.168.0.103 to Tiyes-Iphone-2 20-A2-E4-E7-81-36 Dec/13/2015 12:27:16 Wireless PC connected 20-A2-E4-E7-81-36 Dec/09/2015 08:06:17 DHCP lease IP 192.168.0.106 to Sharlenes-iPad 34-C0-59-19-F9-46 Hmmm.. To send myself the log it asks for SMTP Server / IP Address . Does that mean the smtp server is enough, or do I need its IP address too, which I don't know? Help says "SMTP Server - The address of the SMTP (Simple Mail Transfer Protocol) server that will be used to send the logs." but I haven't gotten the email I sent yet, and I should have by now. |
"Paul M. Cook" <pmcook@gte.net>: Dec 23 10:58AM -0500 On Wed, 23 Dec 2015 10:51:25 -0500, Micky wrote: > To send myself the log it asks for SMTP Server / IP Address . I saw the send-log command, but I just copy-and-pasted my router log into a text file on the computer. 1. While looking at the router log file from within your browser: Control-A to select all Control-C to copy 2. Then paste that into any open text file: Control-V to paste |
"Paul M. Cook" <pmcook@gte.net>: Dec 23 11:02AM -0500 On Wed, 23 Dec 2015 10:51:25 -0500, Micky wrote: > 70-3E-AC-DE-14-94 > So who is Dennis? 5 in the morning? > That's my time, right? or GMT? I just logged into my Netgear WNDR3400v2 router, and went to the advanced tab of Administration > Logs It says on top of the window what time it "thinks" it is: Current Time: Wednesday, Dec 23,2015 08:03:08 Looking at the clock, that's the local time in my time zone. |
"Paul M. Cook" <pmcook@gte.net>: Dec 23 11:07AM -0500 On Wed, 23 Dec 2015 10:51:25 -0500, Micky wrote: > 70-3E-AC-DE-14-94 > The Epson is my printer. I was probably printing the crossword > puzzle. But more Dennis! There is what appears to be an iPhone connecting to your router. You can look up the first half of the MAC address (the OUI) to see what kind of device it appears to be from: https://www.adminsub.net/mac-address-finder Denis' MAC address is the following: (70-3E-AC) (DE-14-94) The organizationally unique part is the first half: (70-3E-AC) That indeed is an Apple device OUI: 703EAC indeed resolves to "Apple, Inc." |
"Paul M. Cook" <pmcook@gte.net>: Dec 23 11:13AM -0500 On Wed, 23 Dec 2015 10:17:10 -0500, Mayayana wrote: > That's interesting. I didn't know routers kept logs. Did > you find that by logging in to the "control panel"? I don't know of *any* router that does *not* keep logs. Usually they start at reboot time, and go on forever from there. For my Netgear router, I log in and then go to: Advanced > Administration > Logs > in. I have no idea why. Apparently they just go around > snooping on customers, perhaps tracking how many > machines are at each address, or some such. Cable should be the worst, as I understand it, since anyone in your neighborhood on the same cable is essentially connected to you as I understand it. So, I'd be sure to have a router, but, as we all know, anyone who knows what they're doing can get past our cheap routers. > First, do you have a good, long password for > your router? You should. Maybe 20 characters. The thing is that most routers don't allow a password greater than 8 characters (from my experience). Sure, they'll *let* you type a long password - but they'll take anything (or nothing) after the first 8 characters. Try it. That's how "my" router works. > You didn't mention what computers you have. > Assuming Windows... Oh, I have everything. Windows. Linux. OS/X. iOS, Android. Printers. And other devices (like the playstation). |
"M. Stradbury" <mstradbury@example.com>: Dec 23 04:15PM On Wed, 23 Dec 2015 10:17:10 -0500, Mayayana wrote: > First, do you have a good, long password for > your router? You should. Maybe 20 characters Which router password are you talking about? 1. The Admin password? 2. The SSID WPA2/PSK passphrase? |
Micky <NONONOmisc07@bigfoot.com>: Dec 23 11:19AM -0500 On Wed, 23 Dec 2015 10:58:58 -0500, "Paul M. Cook" <pmcook@gte.net> wrote: >router log into a text file on the computer. >1. While looking at the router log file from within your browser: > Control-A to select all I tried that but it highlighted the whole page, not just the data. So it was easier to use to the cursor to choose what to highlight. My firmware is almost 11 years old. Maybe D-Link has refined it by now. Plus there are 20 pages of data, each requiring separate copying, so I was hoping to get all 20 pages in one email. And that includes only System Activity, Attacks, and Notice, not Debug Information and Dropped Packets. Later I will check those to see what shows up. |
Tony Hwang <dragon40@shaw.ca>: Dec 23 09:20AM -0700 M. Stradbury wrote: > Which router password are you talking about? > 1. The Admin password? > 2. The SSID WPA2/PSK passphrase? PSK? How about AES? |
Oren <Oren@127.0.0.1>: Dec 23 08:22AM -0800 On Wed, 23 Dec 2015 10:06:04 -0500, "Paul M. Cook" <pmcook@gte.net> wrote: >What is worrisome is that some of the entries don't come from >what I'd expect an online game to come from, e.g., Brazil, >Mexico, Japan, France, etc. Personally, I would turn off DHCP and manually give each machine a static IP number. Any outside machine connecting to your network is being issued an IP number. "...DHCP is a good option for easy home networking. But if you are truly serious about network security—if you have sensitive data residing on your network or just want to make data or identity theft much less likely—you're probably better off sticking with disabling DHCP and maintaining full manual control of your home network." Two Cents. |
Micky <NONONOmisc07@bigfoot.com>: Dec 23 11:24AM -0500 On Wed, 23 Dec 2015 11:02:44 -0500, "Paul M. Cook" <pmcook@gte.net> wrote: >advanced tab of Administration > Logs >It says on top of the window what time it "thinks" it is: > Current Time: Wednesday, Dec 23,2015 08:03:08 Mine doesn't show the time anywhere, but if yours shows the current time, that's good enough for me. I noticed that because some families have so many wireless devices, they've redesigned routers and now many are 100 to 200 dollars. That means I should be able to get a 2-year old one cheap. Actually I bought cheap at a hamfest what I thought was identical, and only noticed a year later that it was a router like mine but without the wireless part. Now is a bad time to try it because every day I may wish to print the crossword. |
Micky <NONONOmisc07@bigfoot.com>: Dec 23 11:24AM -0500 On Wed, 23 Dec 2015 11:07:42 -0500, "Paul M. Cook" <pmcook@gte.net> wrote: >You can look up the first half of the MAC address (the OUI) to see >what kind of device it appears to be from: > https://www.adminsub.net/mac-address-finder Good to know. Thanks. > (70-3E-AC) >That indeed is an Apple device OUI: > 703EAC indeed resolves to "Apple, Inc." So that means it's an Apple device, like an iphone. Not that it's someone working at Apple, inc.! |
Micky <NONONOmisc07@bigfoot.com>: Dec 23 11:32AM -0500 On Wed, 23 Dec 2015 10:17:10 -0500, "Mayayana" > That's interesting. I didn't know routers kept logs. Did >you find that by logging in to the "control panel"? No, the control panel is on the computer. You have to go to the router. The address is in the manual. In D-link and I think maybe all of them it's http://192.168.0.1 > I used to get a lot of attempts to get into my computer >when I had dialup. That mostly stopped with cable, though >I have caught my cable company, RCN, trying to get I had RCN too, dialup, but after years of their promising high-speed, I decided they were kidding, so I had to go to Verizon. They said I could have email only, with no access to the net, for 3 a month, but then 4 months later, with no warning, they took away my ability to send email, and because of the way Eudora is set up, it's not totally obvious how to change the settings to send only via Verizon. (They also did 3 other bad things to me. And currently, if my credit card number changes and the automatic payment doesn't work, they told me I had told them not to send either an email or a postal mail. I never said that. So 3 times over several years they disconnected me with no warning, and one time they threw away all my email, including any I hadn't downloaded yet. Later they raised it from 3 to 4 a month. Now if they won't notify me both ways, I asked to be notified by email, but they said they won't do that. it's an email company but they won't notify me by email. How has your customer service been? >in. I have no idea why. That's what I said in another post. I was referring to Erols/RCN. |
Poutnik <poutnik4nntp@gmail.com>: Dec 22 11:06PM +0100 Dne 22/12/2015 v 22:50 M. Stradbury napsal(a): > But the capital-air-bubbles-aren't-buoyant theory does sound > plausible (it seems to me it would be easy to test with ants > and toy ships or something). Be aware of surface tension. -- Poutnik ( the Czech word for a wanderer ) Knowledge makes great men humble, but small men arrogant. |
MJC <gravity@mjcoon.plus.com>: Dec 22 11:07PM In article <n5chck$gu4$1@dont-email.me>, poutnik4nntp@gmail.com says... > Poutnik ( the Czech word for a wanderer ) Related to the familiar word "sputnik"? Mike. |
John Heath <heathjohn2@gmail.com>: Dec 23 04:52AM -0800 On Tuesday, December 15, 2015 at 7:00:52 PM UTC-5, Phil Allison wrote: > ** Close to none. > The layout relies on the two plate wires being in close proximity so the out of phase electric fields cancel at a distance. > ... Phil There is a third option. Stop being a hero. You can not fix everything. Phone the customer and say this is a tricky problem and that they are better off taking it to the manufacturer for service. You will lose money but gain some cookie points for being honest. Better still the manufacturer is now spinning their wheels trying to fix it not you which the way it should be if it is a design problem. |
"Mark Zacharias" <mark_zacharias@sbcglobal.net>: Dec 22 04:54AM -0600 "Cydrome Leader" <presence@MUNGEpanix.com> wrote in message news:n59cda$env$1@reader1.panix.com... >> reference. Kind of disappointing. > The fluke meters I have are like that. It's really obnoxious, especially > on my latest 87V. I have a Fluke 28 series II and it's an amazing meter, exactly like my 87-5 in function, but it wastes a lot of battery capacity. AA cells get down to 1.4 volts and it's done. Not so bad really because you get those batteries out of there before they're likely to cause any corrosion. You can "test" the batteries using the backlight and the continuity beeper at the same time. If the batteries are at all marginal, you'll get an early indication. Mark Z. |
You received this digest because you're subscribed to updates for this group. You can change your settings on the group membership page. To unsubscribe from this group and stop receiving emails from it send an email to sci.electronics.repair+unsubscribe@googlegroups.com. |
No Response to "Digest for sci.electronics.repair@googlegroups.com - 18 updates in 4 topics"
Post a Comment