Xmas port scan attack????????????

Question

Im using a DI-524 router and I just realized I have 40 pages of logs, indicating Xmas port scan attack

I checked their locations and its all over the place.

There is one IP address that changes every time
eg) x.x.x.100 then x.x.x.101 then x.x.x.102 etc.

Also there are some out of the country, and some from the town that i used to live (i think its my own ip address back in town too)

Some are from the states, some from canada, some from south korea, some from china

theyre from everywhere

could anyone help me with this

thanks a lot in advance

Answer 1

i would imagine they were blocked and its letting you know you was port scaned by a trojan or on a trojan port.
101 and 102 things of that nature is probably yourself exspecially if they are 192.168.1.101 so on and so forth or something similar. i would check to see if you are using something thats using a port where you connect to others and they connect to you. should have the port number in those logs, you can compare that port and the software port you suspect as being the culprit. i get logs when people try to connect to me on a port that has udp capabilities. i only allow tcp on that port so i get a warning every now and then.