Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Strange router log entry. Am I being hacked?


  • Please log in to reply
7 replies to this topic

#1 allosaurus

allosaurus

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:02:39 AM

Posted 25 September 2015 - 02:32 PM

I've had problems for a few months with someone hacking me. My modem will reboot, sometimes several times, and then weird things start happening. I've changed my ip address several times, and it happens each time after a while. Yesterday I thought I blocked there way in, then today my modem reset again. Immediately afterwards I noticed this in my router log:

 

DHCPC Unicasting a release of (my ip address) to xxx.xxx.xxx.xxx.

 

I don't know what the xxx.xxx.xxx.xxx address is. I just know it belongs to charter. Can anyone tell me what this means?



BC AdBot (Login to Remove)

 


#2 Wand3r3r

Wand3r3r

  • Members
  • 2,027 posts
  • OFFLINE
  •  
  • Local time:11:39 PM

Posted 25 September 2015 - 03:14 PM

the only ip address you can change is your lan ip address and that has nothing to with preventing a hacker.

 

that router entry is normal.  You should have others saying "dhcp offer unicast"

 

your modem rebooting is not a sign of a hacker but more of a hardware failure issue.  contact your isp and get the unit replaced.



#3 allosaurus

allosaurus
  • Topic Starter

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:02:39 AM

Posted 25 September 2015 - 04:35 PM

I've replaced my modem several times with new modems, not refurbished. That's how I changed my ip address. New MAC = new IP from Charter. That's also how I know I don't have a hardware failure issue with my modem. My modem doesn't reboot normally. When it does it is always accompanied by strange things happening to my pc. Like having a youtube video load in my broswer automatically, having certain websites blocked, having all websites blocked, my computer waking from sleep all by itself with no tasks scheduled, having passwords changed, having my cd drive disappear from the BIOS until I reset it, etc.

 

I do not have any log entries with "dhcp offer unicast", only the one in my first post which I don't recall seeing before. What I found really strange about it was the first IP address is mine, but the second IP address is not, and it's not a local network address, it's a public IP address. Why would I have a public IP address besides my own in my router logs? I have never seen that before.



#4 Wand3r3r

Wand3r3r

  • Members
  • 2,027 posts
  • OFFLINE
  •  
  • Local time:11:39 PM

Posted 25 September 2015 - 05:54 PM

What was your ISP's response when you brought these issues to their attention?



#5 allosaurus

allosaurus
  • Topic Starter

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:02:39 AM

Posted 25 September 2015 - 06:03 PM

What was your ISP's response when you brought these issues to their attention?

 

I haven't brought it to their attention because I don't know who's doing it, and I don't have proof. I thought this log might be what I need, but I don't know enough about networking to know if this is legitimate traffic, or if this is the hacker's ip address. That's why I'm posting here.



#6 Wand3r3r

Wand3r3r

  • Members
  • 2,027 posts
  • OFFLINE
  •  
  • Local time:11:39 PM

Posted 25 September 2015 - 09:54 PM

True hackers would have erased any log entries  that would leave a clue that they were there.

 

Have a friend bring in their laptop and see what their experience is like.  It may just be hardware or your pc is having issues.



#7 FostersJack

FostersJack

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:09:39 AM

Posted 01 October 2015 - 03:25 AM

It is really seems to appear a hardware problems. Your modem is going to die...



#8 technonymous

technonymous

  • Members
  • 2,500 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:11:39 PM

Posted 10 October 2015 - 05:27 AM

Yep could be Modem. However, it could be Charter outage or maintenance. If it happens at night that's probably what it is nightly maintenance on offpeak hours. The reps you call wouldn't know much of anyhting other then power clycling it for you unless esculated to level 3. Maybe there is a web portal you can login to at Charter and check outages in your area? It could also be outside wiring or bad splitter if it's been raining etc something could be shorting the signals to ground. See if you can go to the Modem's IP address and check errors and signals. Usually 192.168.100.1 in the browser will get you to it.


Edited by technonymous, 10 October 2015 - 05:27 AM.





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users