I dont uderstand this !!!????

RouterOS General
1

07:43:14 firewall,info input: in:public out:(none), src-mac 00:0b:23:c7:e5:d9, proto TCP (SYN), 81.168.237.105:63839-

83.14.131.226:14234, len 48
07:43:14 firewall,info input: in:public out:(none), src-mac 00:0b:23:c7:e5:d9, proto TCP (SYN), 195.116.17.138:1402-
83.14.131.226:14234, len 48
07:43:15 firewall,info input: in:public out:(none), src-mac 00:0b:23:c7:e5:d9, proto TCP (SYN), 81.219.134.2:3237-
83.14.131.226:14234, len 48
07:43:15 firewall,info input: in:public out:(none), src-mac 00:0b:23:c7:e5:d9, proto TCP (SYN), 83.28.104.117:3756-
83.14.131.226:14234, len 52
07:43:16 firewall,info input: in:public out:(none), src-mac 00:0b:23:c7:e5:d9, proto TCP (SYN), 217.165.108.151:3164-
83.14.131.226:14234, len 48
07:43:17 firewall,info input: in:public out:(none), src-mac 00:0b:23:c7:e5:d9, proto TCP (ACK,FIN), 82.251.81.35:6346-
83.14.131.226:3980, len 40
07:43:17 firewall,info input: in:public out:(none), src-mac 00:0b:23:c7:e5:d9, proto TCP (SYN), 195.116.17.138:1402-
83.14.131.226:14234, len 48
07:43:18 firewall,info input: in:public out:(none), src-mac 00:0b:23:c7:e5:d9, proto TCP (SYN), 81.219.134.2:3237-
83.14.131.226:14234, len 48
07:43:18 firewall,info input: in:public out:(none), src-mac 00:0b:23:c7:e5:d9, proto TCP (SYN), 83.29.78.249:4362-
83.14.131.226:14234, len 48
07:43:19 firewall,info input: in:public out:(none), src-mac 00:0b:23:c7:e5:d9, proto TCP (SYN), 217.165.108.151:3164-
83.14.131.226:14234, len 48
07:43:19 system,info,account user skordanall logged in from 83.14.134.58 via telnet
07:43:20 firewall,info input: in:public out:(none), src-mac 00:0b:23:c7:e5:d9, proto TCP (SYN), 83.18.172.194:2687-
83.14.131.226:14234, len 48
07:43:21 firewall,info input: in:public out:(none), src-mac 00:0b:23:c7:e5:d9, proto TCP (SYN), 83.28.104.117:3756-
83.14.131.226:14234, len 52
07:43:22 firewall,info input: in:public out:(none), src-mac 00:0b:23:c7:e5:d9, proto TCP (SYN), 195.116.17.138:1402-
83.14.131.226:14234, len 48
07:43:23 firewall,info input: in:public out:(none), src-mac 00:0b:23:c7:e5:d9, proto TCP (SYN), 84.40.235.181:4473-
83.14.131.226:14234, len 48
07:43:24 firewall,info input: in:public out:(none), src-mac 00:0b:23:c7:e5:d9, proto TCP (SYN), 81.219.134.2:3237-
83.14.131.226:14234, len 48

what is this … all from one mac 00:0b:23:c7:e5:d9
mayby sameone recognize that situation ?

2

I suppose, MAC-address belongs to the gateway router. Data from remote networks are going trough gateway.

3

Skordan,

I think you are use adsl modem, and this mac-address is mac-addres of your modem .
Logs shows that you are scaned by enemy :laughing: from public interface side.

Use some firewall rules to drop this.