Technology in terms you understand. Sign up for the Confident Computing newsletter for weekly solutions to make your life easier. Click here and get The Ask Leo! Guide to Staying Safe on the Internet — FREE Edition as my thank you for subscribing!

What are these access attempts in my router log?

I went into my router to
change my password from “admin”,
and checked the log. There were a lot of “unrecognized access” from random IP
addresses, to a set of fairly random ports.
Are these the pages I am reading on the internet, or random
attempted hacks into my computer network?

You would be amazed at the amount of malicious network traffic on the internet.
At least one security guru has coined the term “Internet Background Noise”
for all this traffic.

What is it?

I’ll put it this way: it’s the reason you must have a firewall.

Become a Patron of Ask Leo! and go ad-free!

To put it bluntly, yes, those are most likely attempted hacks into your computer or
computer network.

But please don’t think that there’s someone out trying to get to you.
You are most definitely not alone.
They’re trying to get to anyone. Anyone who’s not protected, not up to date, or
otherwise has some kind of vulnerability.

Here’s what’s going on.

Computers can be really dumb, but they make up for it by being really fast and/or really persistent.

Malware authors can
take advantage of that by writing malicious software that, effectively, goes out and checks
every possible IP address for a computer with known vulnerabilities.
If a vulnerability is found the malware then infects that computer and moves on to the next.

Now, “every possible IP address” is a lot of IP addresses. It’s measured in the billions. And yes,
checking each one is kind of a stupid way to go about it. But here’s where persistence pays off – one
computer starts scanning. It eventually finds one that’s vulnerable to attack, so it infects that computer with
a virus, and the scanning software. Now the first computer keeps looking for more, and the second
computer starts looking as well. Each time another computer is found to be vulnerable, it’s infected and added
to the legion of computers that are out scanning for more vulnerable computers.

Eventually your IP will come up. If you’re vulnerable, you’ll be infected, and your computer
will join the crowd. If, however, you’re not vulnerable by virtue of being behind a firewall, being
up-to-date on all your operating system patches, or both, then the computer attempting to infect
you will see that it cannot, and move on.

Now you know why you need a firewall. Any machine sitting “naked” on the internet is
subject to these constant attempts to exploit known vulnerabilities. Your router log is
showing these attempts. Your router is acting
as firewall and preventing them from reaching a “real machine”.

“But the sad fact is that there are a large number of folks who still do not adequately protect themselves.”

So where are all these vulnerability probes coming from? Infected machines. In fact,
the owners of those machines probably have no idea that their machine is participating
in this activity.

So why don’t those folks just clean, patch and protect their machines?

Why indeed.

They should. But the sad fact is that there are a large number of folks who still do not adequately protect themselves.
And these folks, in turn, are putting the rest of us at risk.
In fact, much of this “internet background
noise” are computers infected with viruses that are several years old, and for which patches have
also been available for several years.

So, yes, as I and others have been preaching almost daily, it’s critical to keep
your machine up to date and get behind a firewall so as to avoid becoming one of those
machines trying to infect everyone else.

And to protect yourself from everyone who doesn’t.

Subscribe to Confident Computing! Tech problem solving & safety tips & a weekly confidence boost in your inbox every week.

I'll see you there!

10 Reasons Your Computer is Slow

Slow Computer?

Speed up with my special report: 10 Reasons Your Computer is Slow, now updated for Windows 10.

NOW: name your own price! You decide how much to pay -- and yes, that means you can get this report completely free if you so choose. Get your copy now!

7 comments on “What are these access attempts in my router log?”

  1. Hi Leo,I enjoy your newsletter. Especially the “to the point” answers and descriptions you give.My brain is getting quite old, but i do remember the Wireless tech telling me i don’t need all those firewalls because their equipment keeps changing, the IP address? I did check and i have a Nate. Thanks,js

    Hash: SHA1

    It depends on a lot of different things.

    If you are on dial-up you get a new IP each time. I used to believe that
    you didn’t need a firewall in that case, but have since changed my mind.

    MOST broadband connections also give you a new IP address occasionally,
    but it’s definitely not “changing all the time”. Firewall of some sort

    What he *may* have been refering to is that you may already be behind a
    net router which acts as a firewall. That’s how I run here at home. My
    router acts as my firewall for all my machines, and the machines
    themselves do NOT run any additional firewall software.

    But even if your IP changes, the random scans that I discuss in the
    article are still happening, and could quite easily hit your IP address.

    Version: GnuPG v1.4.6 (MingW32)


  3. I have a NAT router,its an external
    modem provided by our ISP after we sign up for our DSL internet connection.i tried to get into it, but i just don’t know where to i need a software to get into to my router’s setting?can you please help me out?

  4. Try opening your web browser and typing dslrouter in the address bar. If you’re with Verizon and you have the Westell router they usually supply, the default username is admin and the default password is password.

  5. Do I have to change the IP address of my router? (IP address to connect or setup the router is always the same on different routers). Can some one access my router from the outside and change the setup, passwords or break into my internal wireless connection security code?


Leave a reply:

Before commenting please:

  • Read the article.
  • Comment on the article.
  • No personal information.
  • No spam.

Comments violating those rules will be removed. Comments that don't add value will be removed, including off-topic or content-free comments, or comments that look even a little bit like spam. All comments containing links and certain keywords will be moderated before publication.

I want comments to be valuable for everyone, including those who come later and take the time to read.