PDA

View Full Version : firewall log reports strange connection attempt


no-mbr
02-15-2011, 11:17 AM
I got these messages from a 2wire 1000hw dsl-modem log file.

They appear in the firewall log and appear to be some sort of exchange between the router/modem and server at Purdue University.

Any ideas? I'm guessing the "wrn" means warning and err means "error."

WRN 2011/02/03 13:02:54 CST sntpc: Server molecule.ecn.purdue.edu did not respond

Does the second entry mean that the server did attempt a response?

ERR 2011/02/03 17:02:55 CST sntpc: recv error from molecule.ecn.purdue.edu (sts=-1) (err=Protocol error)

PrntRhd
02-15-2011, 09:27 PM
I will let Classicsoftware explain, but firewall logs that show attempts that are blocked are simply showing the firewall is doing its job, and why you want to have firewalls in place between you and the Internet.

classicsoftware
02-15-2011, 10:21 PM
SNTPC (http://www.brothersoft.com/downloads/sntp-client.html): Is a program that synchronizes the time on your computer with a remote server. The message shows your PC tried to log into the server at Perdue and was denied access not that a PC from Perdue tried to access your computer.

no-mbr
02-21-2011, 10:06 AM
Yes, i eventually did find a list that included inactive NTP servers and the particular address was listed.

I also discovered that for whatever reasons 2wire re-downloads configuration settings to its devices and randomly adds non-wire domain NTP servers to the router's list of 2wire time servers.

I had never checked the details of the time-server configuration nor had seen anything but 2wire time updates previously. Hence my concerns.