发现俺的宝贝被别人攻击了,请看下日志确认下......

q815***

发现俺的宝贝被别人攻击了,请看下日志确认下......






难怪感觉最近路由器工作不正常.......


日志打了XX:XX:XX的网卡地址是自己知道的,认识的......

日志里面有很多俺没操作过的命令........

虽然不懂,但是有些命令看名字就感觉不对劲.......

请帮俺看下是不是有人想破坏俺的路由器启动不了......

先谢谢啦........




Aug 23 17:43:37 ARP old IP 239.255.255.250 Mac 01:00:5e:7f:ff:fa
Aug 23 17:53:39 ARP old IP 239.255.255.250 Mac 01:00:5e:7f:ff:fa
Aug 23 18:00:01 crond[13283]: USER admin pid 32025 cmd flashWrite
Aug 23 18:08:41 ARP old IP 239.255.255.250 Mac 01:00:5e:7f:ff:fa
Aug 23 18:23:43 ARP old IP 239.255.255.250 Mac 01:00:5e:7f:ff:fa
Aug 23 18:25:47 ARP new IP 192.168.22.47 Mac 5c:36:b8:XX:XX:XX
Aug 23 18:38:46 ARP old IP 239.255.255.250 Mac 01:00:5e:7f:ff:fa
Aug 23 18:53:48 ARP old IP 239.255.255.250 Mac 01:00:5e:7f:ff:fa
Aug 23 19:08:51 ARP old IP 239.255.255.250 Mac 01:00:5e:7f:ff:fa
Aug 23 19:18:52 ARP old IP 239.255.255.250 Mac 01:00:5e:7f:ff:fa
Aug 23 19:38:55 ARP old IP 239.255.255.250 Mac 01:00:5e:7f:ff:fa
Aug 23 19:53:58 ARP old IP 239.255.255.250 Mac 01:00:5e:7f:ff:fa
Aug 23 19:59:11 ARP new IP 192.168.22.221 Mac 28:f3:66:XX:XX:XX
Aug 23 20:03:59 ARP old IP 239.255.255.250 Mac 01:00:5e:7f:ff:fa
Aug 23 20:05:00 ARP old IP 192.168.22.221 Mac 28:f3:66:XX:XX:XX
Aug 23 20:07:03 ARP new IP 192.168.22.221 Mac 28:f3:66:XX:XX:XX
Aug 23 20:13:16 ARP old IP 192.168.22.221 Mac 28:f3:66:XX:XX:XX
Aug 23 20:19:02 ARP old IP 239.255.255.250 Mac 01:00:5e:7f:ff:fa
Aug 23 20:34:04 ARP old IP 239.255.255.250 Mac 01:00:5e:7f:ff:fa
Aug 23 20:49:07 ARP old IP 239.255.255.250 Mac 01:00:5e:7f:ff:fa
Aug 23 21:04:09 ARP old IP 239.255.255.250 Mac 01:00:5e:7f:ff:fa
Aug 23 21:14:11 ARP old IP 239.255.255.250 Mac 01:00:5e:7f:ff:fa
Aug 23 21:33:59 ARP old IP 239.255.255.250 Mac 01:00:5e:7f:ff:fa
Aug 23 21:49:16 ARP old IP 239.255.255.250 Mac 01:00:5e:7f:ff:fa
Aug 23 22:04:19 ARP old IP 239.255.255.250 Mac 01:00:5e:7f:ff:fa
Aug 23 22:19:21 ARP old IP 239.255.255.250 Mac 01:00:5e:7f:ff:fa
Aug 23 22:29:23 ARP old IP 239.255.255.250 Mac 01:00:5e:7f:ff:fa
Aug 23 22:44:25 ARP old IP 239.255.255.250 Mac 01:00:5e:7f:ff:fa
Aug 23 22:59:27 ARP old IP 239.255.255.250 Mac 01:00:5e:7f:ff:fa
Aug 23 23:14:30 ARP old IP 239.255.255.250 Mac 01:00:5e:7f:ff:fa
Aug 23 23:29:32 ARP old IP 239.255.255.250 Mac 01:00:5e:7f:ff:fa
Aug 23 23:44:35 ARP old IP 239.255.255.250 Mac 01:00:5e:7f:ff:fa
Aug 23 23:59:37 ARP old IP 239.255.255.250 Mac 01:00:5e:7f:ff:fa
Aug 24 00:00:01 crond[13283]: USER admin pid 32029 cmd ipset -F sys_poe_nt_ok
Aug 24 00:00:01 crond[13283]: USER admin pid 32030 cmd ipset -F sys_notice_ok
Aug 24 00:00:01 crond[13283]: USER admin pid 32031 cmd flashWrite
Aug 24 00:10:01 crond[13283]: USER admin pid 32035 cmd uttStatsClear
Aug 24 00:12:14 ARP new IP 192.168.22.221 Mac 28:f3:66:XX:XX:XX
Aug 24 00:14:39 ARP old IP 239.255.255.250 Mac 01:00:5e:7f:ff:fa
Aug 24 00:20:40 ARP old IP 192.168.22.221 Mac 28:f3:66:XX:XX:XX
Aug 24 00:29:42 ARP old IP 239.255.255.250 Mac 01:00:5e:7f:ff:fa
Aug 24 00:36:28 ARP old IP 192.168.22.47 Mac 5c:36:b8:XX:XX:XX
Aug 24 00:36:58 ARP old IP 192.168.22.254 Mac 40:71:e2:XX:XX:XX
Aug 24 00:36:58 ARP old IP 239.255.255.250 Mac 01:00:5e:7f:ff:fa
Aug 24 00:37:58 ARP old IP 192.168.22.222 Mac d4:61:2e:XX:XX:XX
Aug 24 00:38:35 ARP new IP 192.168.22.254 Mac 40:71:e2:XX:XX:XX
Aug 24 00:39:08 ARP new IP 192.168.22.222 Mac d4:61:2e:XX:XX:XX
Aug 24 00:41:59 ARP old IP 192.168.22.222 Mac d4:61:2e:XX:XX:XX
Aug 24 00:43:04 ARP new IP 192.168.22.222 Mac d4:61:2e:XX:XX:XX
Aug 24 00:44:10 ARP new IP 192.168.22.221 Mac 28:f3:66:XX:XX:XX
Aug 24 00:50:45 ARP old IP 192.168.22.221 Mac 28:f3:66:XX:XX:XX
Aug 24 00:54:46 ARP old IP 239.255.255.250 Mac 01:00:5e:7f:ff:fa
Aug 24 00:56:52 ARP new IP 192.168.22.221 Mac 28:f3:66:XX:XX:XX
Aug 24 01:00:01 crond[13283]: USER admin pid 32063 cmd uttclearOptCnt pppoe
Aug 24 01:00:01 crond[13283]: USER admin pid 32064 cmd uttclearOptCnt webauth
Aug 24 01:00:47 ARP old IP 192.168.22.221 Mac 28:f3:66:XX:XX:XX
Aug 24 01:09:48 ARP old IP 239.255.255.250 Mac 01:00:5e:7f:ff:fa
Aug 24 01:15:30 ARP old IP 0.0.0.0 Mac  
Aug 24 01:15:34 ARP old IP 192.168.22.254 Mac 40:71:e2:XX:XX:XX
Aug 24 01:15:45 ARP new IP 192.168.22.254 Mac 40:71:e2:XX:XX:XX
Aug 24 01:16:19 ARP old IP 192.168.22.222 Mac d4:61:2e:XX:XX:XX
Aug 24 01:18:38 ARP new IP 192.168.22.222 Mac d4:61:2e:XX:XX:XX
Aug 24 01:23:50 ARP old IP 239.255.255.250 Mac 01:00:5e:7f:ff:fa
Aug 24 01:38:53 ARP old IP 239.255.255.250 Mac 01:00:5e:7f:ff:fa
Aug 24 01:53:55 ARP old IP 239.255.255.250 Mac 01:00:5e:7f:ff:fa
Aug 24 02:08:58 ARP old IP 239.255.255.250 Mac 01:00:5e:7f:ff:fa
Aug 24 02:24:00 ARP old IP 239.255.255.250 Mac 01:00:5e:7f:ff:fa
Aug 24 02:39:02 ARP old IP 239.255.255.250 Mac 01:00:5e:7f:ff:fa
Aug 24 02:54:05 ARP old IP 239.255.255.250 Mac 01:00:5e:7f:ff:fa
Aug 24 03:09:07 ARP old IP 239.255.255.250 Mac 01:00:5e:7f:ff:fa
Aug 24 03:24:10 ARP old IP 239.255.255.250 Mac 01:00:5e:7f:ff:fa
Aug 24 03:39:12 ARP old IP 239.255.255.250 Mac 01:00:5e:7f:ff:fa
Aug 24 03:49:13 ARP old IP 239.255.255.250 Mac 01:00:5e:7f:ff:fa
Aug 24 04:04:16 ARP old IP 239.255.255.250 Mac 01:00:5e:7f:ff:fa
Aug 24 04:19:18 ARP old IP 239.255.255.250 Mac 01:00:5e:7f:ff:fa
Aug 24 04:34:21 ARP old IP 239.255.255.250 Mac 01:00:5e:7f:ff:fa
Aug 24 04:49:23 ARP old IP 239.255.255.250 Mac 01:00:5e:7f:ff:fa
Aug 24 05:04:25 ARP old IP 239.255.255.250 Mac 01:00:5e:7f:ff:fa
Aug 24 05:19:28 ARP old IP 239.255.255.250 Mac 01:00:5e:7f:ff:fa
Aug 24 05:34:30 ARP old IP 239.255.255.250 Mac 01:00:5e:7f:ff:fa
Aug 24 05:49:33 ARP old IP 239.255.255.250 Mac 01:00:5e:7f:ff:fa
Aug 24 06:00:01 crond[13283]: USER admin pid 32082 cmd flashWrite
Aug 24 06:04:35 ARP old IP 239.255.255.250 Mac 01:00:5e:7f:ff:fa
Aug 24 06:14:37 ARP old IP 239.255.255.250 Mac 01:00:5e:7f:ff:fa
Aug 24 06:29:39 ARP old IP 239.255.255.250 Mac 01:00:5e:7f:ff:fa
Aug 24 06:44:41 ARP old IP 239.255.255.250 Mac 01:00:5e:7f:ff:fa
Aug 24 06:59:44 ARP old IP 239.255.255.250 Mac 01:00:5e:7f:ff:fa
Aug 24 07:14:46 ARP old IP 239.255.255.250 Mac 01:00:5e:7f:ff:fa
Aug 24 07:26:15 ARP new IP 192.168.22.47 Mac 5c:36:b8:XX:XX:XX
Aug 24 07:29:49 ARP old IP 239.255.255.250 Mac 01:00:5e:7f:ff:fa
Aug 24 07:44:51 ARP old IP 239.255.255.250 Mac 01:00:5e:7f:ff:fa
Aug 24 07:59:53 ARP old IP 239.255.255.250 Mac 01:00:5e:7f:ff:fa
Aug 24 08:13:56 ARP old IP 239.255.255.250 Mac 01:00:5e:7f:ff:fa
Aug 24 08:28:58 ARP old IP 239.255.255.250 Mac 01:00:5e:7f:ff:fa
Aug 24 08:44:00 ARP old IP 239.255.255.250 Mac 01:00:5e:7f:ff:fa
Aug 24 08:50:16 ARP old IP 192.168.22.254 Mac 40:71:e2:XX:XX:XX
Aug 24 08:50:16 ARP old IP 192.168.22.47 Mac 5c:36:b8:XX:XX:XX
Aug 24 08:50:16 ARP old IP 239.255.255.250 Mac 01:00:5e:7f:ff:fa
Aug 24 08:50:40 ARP new IP 192.168.22.254 Mac 40:71:e2:XX:XX:XX
Aug 24 08:50:47 ARP old IP 192.168.22.222 Mac d4:61:2e:XX:XX:XX
Aug 24 08:52:02 ARP new IP 192.168.22.222 Mac d4:61:2e:XX:XX:XX
Aug 24 09:10:05 ARP old IP 239.255.255.250 Mac 01:00:5e:7f:ff:fa
Aug 24 09:25:07 ARP old IP 239.255.255.250 Mac 01:00:5e:7f:ff:fa
Aug 24 09:36:49 ARP new IP 192.168.22.47 Mac 5c:36:b8:XX:XX:XX
Aug 24 09:40:09 ARP old IP 239.255.255.250 Mac 01:00:5e:7f:ff:fa
Aug 24 09:55:12 ARP old IP 239.255.255.250 Mac 01:00:5e:7f:ff:fa
Aug 24 10:10:14 ARP old IP 239.255.255.250 Mac 01:00:5e:7f:ff:fa
Aug 24 10:25:17 ARP old IP 239.255.255.250 Mac 01:00:5e:7f:ff:fa
Aug 24 10:36:32 ARP new IP 192.168.22.221 Mac 28:f3:66:XX:XX:XX
Aug 24 10:40:19 ARP old IP 239.255.255.250 Mac 01:00:5e:7f:ff:fa

725***

可能别人在扫代理

q815***

725216 发表于 2016-8-24 11:26
可能别人在扫代理

大师你能看出是外网还是内网攻击??

他在干什么??