Teacher
•
20 Messages
worrisome hijacking language in Router logs
Hi all,
Have been using Fiber for about a month. Periodically the internet will cut out so I logged into the router to see what's going on. I've pasted the logs below but prior to it going out I always see the following type of lines:
| INF | 2017-05-29T12:38:30-07:00 | hurl | host=eeroup.com uri=/up.css hijacked |
| INF | 2017-05-29T12:38:14-07:00 | hurl | host=wpad uri=/wpad.dat hijacked |
| INF | 2016-01-21T08:36:30-08:00 | hurl | host=yzbvlqkvlmpwmj uri=/xslt hijacked |
| INF | 2016-01-21T08:36:30-08:00 | hurl | host=zwinmafqpqbfbgq uri=/xslt hijacked |
| INF | 2016-01-21T08:36:30-08:00 | hurl | host=cgjorldmfibps uri=/xslt hijacked |
it has me worried that my DNS has been hijacked but I don't know what to do. Any help would be greatly appreciated. Is there anything I can do to prevent this in the future or ensure my internet browsing is secure?
Full logs:
Type Date/Time Event Description
INF 2017-06-17T08:16:15-07:00 sys Node 192.168.1.77 is up
INF 2017-06-17T08:13:03-07:00 sys Node 192.168.1.67 is down
INF 2017-06-17T08:10:32-07:00 sys Node 192.168.1.69 is up
INF 2017-06-17T08:06:41-07:00 Previous log entry repeated 1 times
INF 2017-06-17T08:06:39-07:00 sys Node 192.168.1.79 is up
INF 2017-06-17T08:04:23-07:00 sys Node 192.168.1.105 is down
INF 2017-06-17T08:02:20-07:00 sys Node 192.168.1.89 is down
INF 2017-06-17T07:58:50-07:00 sys Node 192.168.1.67 is down
INF 2017-06-17T07:51:19-07:00 sys Node 192.168.1.67 is up
INF 2017-06-17T07:46:22-07:00 sys Node 192.168.1.86 is down
INF 2017-06-17T07:40:34-07:00 sys Node 192.168.1.86 is up
INF 2017-06-17T07:36:18-07:00 sys Node 192.168.1.86 is down
INF 2017-06-17T07:35:59-07:00 sys Node 192.168.1.105 is down
INF 2017-06-17T07:30:25-07:00 sys Node 192.168.1.69 is up
INF 2017-06-17T07:25:03-07:00 sys Node 192.168.1.86 is down
INF 2017-06-17T07:22:15-07:00 sys Node 192.168.1.90 is up
INF 2017-06-17T07:22:06-07:00 sys Node 192.168.1.84 is down
INF 2017-06-17T07:20:40-07:00 sys Node 192.168.1.94 is down
INF 2017-06-17T07:18:59-07:00 sys Node 192.168.1.92 is up
INF 2017-06-17T07:12:27-07:00 sys Node 192.168.1.88 is up
INF 2017-06-17T07:12:27-07:00 sys Node 192.168.1.87 is up
INF 2017-06-17T07:11:56-07:00 sys Node 192.168.1.88 is up
INF 2017-06-17T07:11:52-07:00 sys Node 192.168.1.87 is up
INF 2017-06-17T07:05:52-07:00 sys Node 192.168.1.84 is down
INF 2017-06-17T07:05:26-07:00 sys Node 192.168.1.94 is down
INF 2017-06-17T07:02:49-07:00 sys Node 192.168.1.86 is down
INF 2017-06-17T06:53:46-07:00 sys Node 192.168.1.69 is down
INF 2017-06-17T06:50:22-07:00 sys Node 192.168.1.86 is down
INF 2017-06-17T06:43:43-07:00 acs connreq: all done, close connection...
INF 2017-06-17T06:39:01-07:00 sys Node 192.168.1.86 is down
INF 2017-06-17T06:36:57-07:00 sys Node 192.168.1.84 is down
INF 2017-06-17T06:35:03-07:00 sys Node 192.168.1.84 is up
INF 2017-06-17T06:33:00-07:00 sys Node 192.168.1.86 is down
INF 2017-06-17T06:32:58-07:00 sys Node 192.168.1.85 is down
INF 2017-06-17T06:29:03-07:00 sys Node 192.168.1.89 is down
INF 2017-06-17T06:27:21-07:00 sys Node 192.168.1.85 is up
INF 2017-06-17T06:23:47-07:00 sys Node 192.168.1.105 is down
INF 2017-06-17T06:23:03-07:00 sys Node 192.168.1.90 is up
INF 2017-06-17T06:19:03-07:00 sys Node 192.168.1.86 is down
INF 2017-06-17T06:14:55-07:00 sys Node 192.168.1.69 is down
INF 2017-06-17T06:13:28-07:00 sys Node 192.168.1.86 is down
INF 2017-06-17T05:54:02-07:00 sys Node 192.168.1.86 is down
INF 2017-06-17T05:52:28-07:00 sys Node 192.168.1.84 is down
INF 2017-06-17T05:46:59-07:00 sys Node 192.168.1.90 is down
INF 2017-06-17T05:43:36-07:00 sys Node 192.168.1.96 is up
INF 2017-06-17T05:41:14-07:00 sys Node 192.168.1.95 is up
INF 2017-06-17T05:39:56-07:00 sys Node 192.168.1.84 is down
INF 2017-06-17T05:33:31-07:00 sys Node 192.168.1.86 is down
INF 2017-06-17T03:55:27-07:00 acs connreq: all done, close connection...
INF 2017-06-17T01:05:47-07:00 acs connreq: all done, close connection...
INF 2017-06-16T22:14:56-07:00 acs connreq: all done, close connection...
INF 2017-06-16T19:22:23-07:00 acs connreq: all done, close connection...
INF 2017-06-16T16:28:57-07:00 acs connreq: all done, close connection...
INF 2017-06-16T13:27:42-07:00 acs connreq: all done, close connection...
INF 2017-06-16T10:29:19-07:00 acs connreq: all done, close connection...
INF 2017-06-16T07:33:57-07:00 acs connreq: all done, close connection...
INF 2017-06-16T04:40:01-07:00 acs connreq: all done, close connection...
INF 2017-06-16T01:47:46-07:00 acs connreq: all done, close connection...
INF 2017-06-15T22:54:04-07:00 acs connreq: all done, close connection...
INF 2017-06-15T19:43:27-07:00 acs connreq: all done, close connection...
INF 2017-06-15T16:48:53-07:00 acs connreq: all done, close connection...
INF 2017-06-15T13:38:38-07:00 acs connreq: all done, close connection...
INF 2017-06-15T10:50:57-07:00 acs connreq: all done, close connection...
INF 2017-06-15T08:08:03-07:00 acs connreq: all done, close connection...
INF 2017-06-15T05:20:43-07:00 acs connreq: all done, close connection...
INF 2017-06-15T02:53:04-07:00 acs connreq: all done, close connection...
INF 2017-06-15T00:11:05-07:00 acs connreq: all done, close connection...
INF 2017-06-14T21:34:06-07:00 acs connreq: all done, close connection...
INF 2017-06-14T18:34:07-07:00 acs connreq: all done, close connection...
INF 2017-06-14T16:00:15-07:00 acs connreq: all done, close connection...
INF 2017-06-14T13:25:08-07:00 acs connreq: all done, close connection...
INF 2017-06-14T10:57:18-07:00 acs connreq: all done, close connection...
INF 2017-06-14T09:46:42-07:00 acs CWMD fault: 9005 get params
INF 2017-06-14T08:25:39-07:00 acs connreq: all done, close connection...
INF 2017-06-14T05:54:33-07:00 acs connreq: all done, close connection...
INF 2017-06-14T03:03:18-07:00 acs connreq: all done, close connection...
INF 2017-06-14T00:26:50-07:00 acs connreq: all done, close connection...
INF 2017-06-13T22:02:28-07:00 acs connreq: all done, close connection...
INF 2017-06-13T19:33:23-07:00 acs connreq: all done, close connection...
INF 2017-05-29T12:38:30-07:00 hurl host=eeroup.com uri=/up.css hijacked
INF 2017-05-29T12:38:14-07:00 hurl host=wpad uri=/wpad.dat hijacked
INF 2016-01-21T08:36:30-08:00 hurl host=yzbvlqkvlmpwmj uri=/xslt hijacked
INF 2016-01-21T08:36:30-08:00 hurl host=zwinmafqpqbfbgq uri=/xslt hijacked
INF 2016-01-21T08:36:30-08:00 hurl host=cgjorldmfibps uri=/xslt hijacked
INF P0000-00-00T00:02:27 hurl err=4 name=NO_DHCP_SERVICE clear
INF P0000-00-00T00:02:25 hurl err=4 name=NO_DHCP_SERVICE redirect
INF P0000-00-00T00:02:25 hurl host=eeroup.com uri=/up.css hijacked
INF P0000-00-00T00:02:25 hurl host=eeroup.com uri=/up.css hijacked
INF P0000-00-00T00:02:25 hurl err=4 name=NO_DHCP_SERVICE redirect
INF P0000-00-00T00:02:24 hurl err=4 name=NO_DHCP_SERVICE clear
INF P0000-00-00T00:02:23 hurl err=15 name=EAPOL_FAILED clear
INF P0000-00-00T00:02:21 hurl err=15 name=EAPOL_FAILED clear
INF P0000-00-00T00:02:01 hurl err=15 name=EAPOL_FAILED detect
INF P0000-00-00T00:02:00 hurl err=15 name=EAPOL_FAILED redirect
INF P0000-00-00T00:02:00 hurl err=15 name=EAPOL_FAILED redirect
INF P0000-00-00T00:02:00 hurl host=wpad uri=/wpad.dat hijacked
INF P0000-00-00T00:02:00 hurl host=wpad uri=/wpad.dat hijacked
INF P0000-00-00T00:02:00 hurl err=15 name=EAPOL_FAILED redirect
INF P0000-00-00T00:02:00 hurl host=wpad uri=/wpad.dat hijacked
INF P0000-00-00T00:01:59 hurl err=15 name=EAPOL_FAILED detect
_xyzzy_
Expert
•
15K Messages
7 years ago
See this forum thread with the @mibrnsurg solution. Short answer, disable IPv6 in the gateway.
I hope that solves the problem and it isn't something else.
0
0
krabkin
Teacher
•
20 Messages
7 years ago
0
0
JefferMC
ACE - Expert
•
35K Messages
7 years ago
Messages with time stamps that are near zero are immediately after boot. The messages you're talking about seem to be weeks old. The messages that show 192.168.1.xxx "is down" are just indicating that the Gateway is no longer seeing that device in response to ARP requests, and the "... is up" just means it is back in communication with it.
When your Internet "cuts out" are you on a wireless connection with the Gateway? If you have devices that are connected by wired Ethernet, can you check to see if they're working when your other one fails? I'm thinking you are just having wireless issues inside your home.
0
0
krabkin
Teacher
•
20 Messages
7 years ago
It cuts out on wired and wireless.
Point taken on the time stamp but the date stamps are the end May of 2017 so it's happened pretty recently.
0
0
krabkin
Teacher
•
20 Messages
7 years ago
It went out today again. Putting the logs here, although no new hijacking logs so that is something.
err Jun 18 10:01:46
daemon: lmd[1343]: wifi_dev_qtn_set_interface: qcsapi_interface_enable failed
info Jun 18 10:01:46
daemon: lmd[1343]: wifi_dev_qtn_unconfig: Wireless unconfig: deviceid=9
err Jun 18 09:59:40
daemon: dhcp6d[1313]: setsockopt(insock, IPV6_JOIN_GROUP): No such device
err Jun 18 09:59:40
daemon: lmd[1343]: device0: wifi_device_is_reachable failed, deviceid is 9, error code: 145
warn Jun 18 09:59:38
daemon: lmd[1343]: wireless unconfig: device 9, bring the link down failed: Address already in use
err Jun 18 09:59:38
daemon: lmd[1343]: wifi_dev_qtn_unconfig: wifi_dev_qtn_set_interface failed.
err Jun 18 09:59:38
daemon: lmd[1343]: wifi_dev_qtn_set_interface: qcsapi_interface_enable failed
info Jun 18 09:59:38
daemon: lmd[1343]: wifi_dev_qtn_unconfig: Wireless unconfig: deviceid=9
info Jun 18 09:58:52
daemon: mcpd: vzonead_carousel_start msp_recv_ip=6b815c59
info Jun 18 09:58:52
daemon: mcpd: carousel pbit=4 dscp=18 class=1
info Jun 18 09:58:52
daemon: mcpd: vzonead_carousel: 1608 fd=13 IP_ADD_MEMBERSHIP maddr=efc40001
info Jun 18 09:58:52
daemon: mcpd: vzonead_carousel_start 1567 caller=452 car_mcast=efc40001 car_port=31801
info Jun 18 09:58:52
daemon: mcpd: vzonead_carousel_stop 1506 car_mcast=efc40001 car_port=31801
info Jun 18 09:58:52
daemon: mcpd: vzonead_carousel: 446: Carousel timeout! No car packet for 600 secs. seg_cnt:0 prev_seg_cnt:0
err Jun 18 09:54:38
daemon: dhcp6d[1313]: setsockopt(insock, IPV6_JOIN_GROUP): No such device
warn Jun 18 09:54:38
daemon: lmd[1343]: wireless unconfig: device 9, bring the link down failed: Address already in use
err Jun 18 09:54:38
daemon: lmd[1343]: wifi_dev_qtn_unconfig: wifi_dev_qtn_set_interface failed.
err Jun 18 09:54:38
daemon: lmd[1343]: wifi_dev_qtn_set_interface: qcsapi_interface_enable failed
info Jun 18 09:54:37
daemon: lmd[1343]: wifi_dev_qtn_unconfig: Wireless unconfig: deviceid=9
warn Jun 18 09:54:37
daemon: lmd[1343]: wireless unconfig: device 9, bring the link down failed: Address already in use
err Jun 18 09:54:37
daemon: lmd[1343]: wifi_dev_qtn_unconfig: wifi_dev_qtn_set_interface failed.
err Jun 18 09:54:37
daemon: lmd[1343]: wifi_dev_qtn_set_interface: qcsapi_interface_enable failed
info Jun 18 09:54:37
daemon: lmd[1343]: wifi_dev_qtn_unconfig: Wireless unconfig: deviceid=9
warn Jun 18 09:52:21
daemon: httpd[1337]: tw_ulib_stats_get_stats(wifi0) failed: Invalid argument
err Jun 18 09:52:16
daemon: dsld[1326]: bcmdsl_get_mib() failed: rc: 9002, size: 30740, sizeof(adslMibInfo): 30740
err Jun 18 09:52:16
daemon: dsld[1326]: bcmdsl_get_mib() failed: rc: 9002, size: 30740, sizeof(adslMibInfo): 30740
err Jun 18 09:52:16
daemon: dsld[1326]: bcmdsl_get_mib() failed: rc: 9002, size: 30740, sizeof(adslMibInfo): 30740
err Jun 18 09:52:16
daemon: dsld[1326]: bcmdsl_get_mib() failed: rc: 9002, size: 30740, sizeof(adslMibInfo): 30740
warn Jun 18 09:52:16
daemon: httpd[1337]: dsl_get_bondstats failed: Invalid argument
err Jun 18 09:52:16
daemon: httpd[1337]: dsld_gbondstats_1 failure: 22, Invalid argument
err Jun 18 09:52:16
daemon: dsld[1326]: DSLD_CMD_GBONDSTATS: DSL device not up
err Jun 18 09:52:16
daemon: dsld[1326]: bcmdsl_get_priv_info fail: device:/dev/dsl0
err Jun 18 09:52:16
daemon: dsld[1326]: bcmdsl_get_mib() failed: rc: 9002, size: 30740, sizeof(adslMibInfo): 30740
err Jun 18 09:52:16
daemon: dsld[1326]: bcmdsl_get_priv_info fail: device:/dev/dsl0
err Jun 18 09:52:16
daemon: dsld[1326]: bcmdsl_get_mib() failed: rc: 9002, size: 30740, sizeof(adslMibInfo): 30740
warn Jun 18 09:52:12
daemon: httpd[1337]: dsl_get_bondstats failed: Invalid argument
err Jun 18 09:52:12
daemon: httpd[1337]: dsld_gbondstats_1 failure: 22, Invalid argument
err Jun 18 09:52:12
daemon: dsld[1326]: DSLD_CMD_GBONDSTATS: DSL device not up
err Jun 18 09:52:12
daemon: dsld[1326]: bcmdsl_get_priv_info fail: device:/dev/dsl0
err Jun 18 09:52:12
daemon: dsld[1326]: bcmdsl_get_mib() failed: rc: 9002, size: 30740, sizeof(adslMibInfo): 30740
err Jun 18 09:52:12
daemon: dsld[1326]: bcmdsl_get_priv_info fail: device:/dev/dsl0
err Jun 18 09:52:12
daemon: dsld[1326]: bcmdsl_get_mib() failed: rc: 9002, size: 30740, sizeof(adslMibInfo): 30740
warn Jun 18 09:51:19
daemon: httpd[1337]: dsl_get_bondstats failed: Invalid argument
err Jun 18 09:51:19
daemon: httpd[1337]: dsld_gbondstats_1 failure: 22, Invalid argument
err Jun 18 09:51:19
daemon: dsld[1326]: DSLD_CMD_GBONDSTATS: DSL device not up
err Jun 18 09:51:19
daemon: dsld[1326]: bcmdsl_get_priv_info fail: device:/dev/dsl0
err Jun 18 09:51:19
daemon: dsld[1326]: bcmdsl_get_mib() failed: rc: 9002, size: 30740, sizeof(adslMibInfo): 30740
err Jun 18 09:51:19
daemon: dsld[1326]: bcmdsl_get_priv_info fail: device:/dev/dsl0
err Jun 18 09:51:19
daemon: dsld[1326]: bcmdsl_get_mib() failed: rc: 9002, size: 30740, sizeof(adslMibInfo): 30740
err Jun 18 09:49:41
daemon: dhcp6d[1313]: setsockopt(insock, IPV6_JOIN_GROUP): No such device
warn Jun 18 09:49:37
daemon: lmd[1343]: wireless unconfig: device 9, bring the link down failed: Address already in use
err Jun 18 09:49:37
daemon: lmd[1343]: wifi_dev_qtn_unconfig: wifi_dev_qtn_set_interface failed.
err Jun 18 09:49:37
daemon: lmd[1343]: wifi_dev_qtn_set_interface: qcsapi_interface_enable failed
info Jun 18 09:49:35
daemon: lmd[1343]: wifi_dev_qtn_unconfig: Wireless unconfig: deviceid=9
err Jun 18 09:49:35
daemon: lmd[1343]: device0: wifi_device_is_reachable failed, deviceid is 9, error code: 145
err Jun 18 09:49:32
daemon: rulemgrd[1378]: The update function attempted to execute more than 3 consecutive iterations.
err Jun 18 09:49:24
daemon: lmd[1343]: device0: wifi_device_is_reachable failed, deviceid is 9, error code: 145
err Jun 18 09:49:21
daemon: lmd[1343]: device0: wifi_device_is_reachable failed, deviceid is 9, error code: 145
info Jun 18 09:49:20
daemon: ntpd[3100]: Listening on routing socket on fd #21 for interface updates
info Jun 18 09:49:20
daemon: ntpd[3100]: peers refreshed
info Jun 18 09:49:20
daemon: ntpd[3100]: Listen normally on 4 lo ::1 UDP 123
info Jun 18 09:49:20
daemon: ntpd[3100]: Listen normally on 3 br1 107.129.92.89 UDP 123
info Jun 18 09:49:20
daemon: ntpd[3100]: Listen normally on 2 lo 127.0.0.1 UDP 123
info Jun 18 09:49:20
daemon: ntpd[3100]: Listen and drop on 1 v6wildcard :: UDP 123
info Jun 18 09:49:20
daemon: ntpd[3100]: Listen and drop on 0 v4wildcard 0.0.0.0 UDP 123
notice Jun 18 09:49:20
daemon: ntpd[3100]: proto: precision = 10.705 usec
notice Jun 18 09:49:20
daemon: ntpd[3100]: ntpd 4.2.6p5@1.2349 Thu Jan 21 22:39:53 UTC 2016 (1)
info Jun 18 09:49:18
daemon: cwmd[1306]: inited ca label 'root'
err Jun 18 09:49:03
daemon: lmd[1343]: device0: wifi_device_is_reachable failed, deviceid is 9, error code: 145
err Jan 21 08:36:09
daemon: dhcp6d[1313]: setsockopt(insock, IPV6_JOIN_GROUP): No such device
err Jan 21 08:36:08
daemon: lmd[1343]: device0: wifi_device_is_reachable failed, deviceid is 9, error code: 145
info Jan 21 08:36:06
daemon: httpd[1337]: DNS server name: 107.129.92.89
info Jan 21 08:36:06
daemon: httpd[1337]: bind(fd=12) family 2, port 50001 to 107.129.92.89 scope 0
err Jan 21 08:36:05
daemon: dhcp6d[1313]: setsockopt(insock, IPV6_JOIN_GROUP): No such device
info Jan 21 08:36:03
daemon: timemgrd[1386]: broadband up and ntpd start
info Jan 21 08:36:03
daemon: mcpd: msp_timer 1759 MSP socket not created yet
info Jan 21 08:36:03
daemon: mcpd: vzonead_config: 127180: msp_timer MSP config changed, reset timer to 0
info Jan 21 08:36:03
daemon: mcpd: vzonead_config: 956 update car_port run 0 with car_port config 31801
info Jan 21 08:36:03
daemon: mcpd: vzonead_config: 921 during_ad_timeout run 0 config 25000
info Jan 21 08:36:03
daemon: mcpd: vzonead_carousel_start msp_recv_ip=6b815c59
info Jan 21 08:36:03
daemon: mcpd: carousel pbit=0 dscp=0 class=1
info Jan 21 08:36:03
daemon: mcpd: vzonead_carousel: 1608 fd=13 IP_ADD_MEMBERSHIP maddr=efc40001
info Jan 21 08:36:03
daemon: mcpd: vzonead_carousel_start 1567 caller=1804 car_mcast=efc40001 car_port=31801
info Jan 21 08:36:03
daemon: mcpd: vzonead_netlink_start 368 enable netlink
info Jan 21 08:36:03
daemon: vzonead[1399]: vzonead_config_update 1191 calls AIOCSCONFEND rc=0
info Jan 21 08:36:03
daemon: mcpd: vzonead_mini: 3235 rcv AIOCSCONFEND num=0
info Jan 21 08:36:03
daemon: vzonead[1399]: vzonead_config_update 1171 calls AIOCSPROFINFOS prof=0
info Jan 21 08:36:03
daemon: vzonead[1399]: vzonead_config_update 1141 calls AIOCSLINEUPINFOS lineuptable_empty=1
info Jan 21 08:36:03
daemon: vzonead[1399]: vzonead_config_update 1132 calls AIOCSCONFINFOS rc=0
info Jan 21 08:36:03
daemon: mcpd: vzonead_mini: 3164 rcv AIOCSCONFINFOS enb=1 msp=0 mspport=0 car=efc40001 carport=31801
err Jan 21 08:36:03
daemon: dhcp6d[1313]: setsockopt(insock, IPV6_JOIN_GROUP): No such device
info Jan 21 08:36:02
daemon: vzonead[1399]: vzonead: vzonead_cm_notify()
info Jan 21 08:36:02
daemon: lmd[1343]: ip6rd0: UP on pm_bb_if_ip6rd with 2602:300::/28 GW:::12.83.49.81
info Jan 21 08:36:01
daemon: mcpd: mcpd_vzonead_intf_change 1886 br1 WAN iface is up
info Jan 21 08:36:01
daemon: lmd[1343]: ipnet0: addr 239.192.0.0 shift 14 action 1 msgsize = 56
info Jan 21 08:36:01
daemon: lmd[1343]: ipnet0: if br1 enabled 1 default rule 0 count 1
err Jan 21 08:36:01
daemon: mcpd: mcpd_igmp_interface_init 185 IP_ADD_MEMBERSHIP ALL_ROUTERS err=125 addr=e0000002 ifaddr=c0a801fe
info Jan 21 08:36:01
daemon: lmd[1343]: ipnet0: UP on br1 DNS1: 68.94.156.8 DNS2: 68.94.157.8
info Jan 21 08:36:01
daemon: lmd[1343]: ipnet0: UP on br1 with 107.129.92.89/22 GW:107.129.92.1
info Jan 21 08:36:01
daemon: lmd[1343]: ipnet0: addr 239.192.0.0 shift 14 action 1 msgsize = 56
0
0
krabkin
Teacher
•
20 Messages
7 years ago
And it's back and the internet went down
0
0