XMAS scan in Router Log what to do?

[bishop101]

Everyday I check my router log and I always see someone has been trying to map my network and scan my ports. It appears as xmas scan. Should I be worried, if the router logs it does it mean it's blocked? Is there any way I can prevent this? How much am I at risk? Are there any offensive measures I can take?

Someone said I should enable "block WAN request" what does that do? Interestingly enough when I was browsing the log it said "block WAN request disabled" , as if an outside source disable it in my router. :shock:

I'm not sure if it's the same I.P, but I will be saving the logs each day and compare IP addresses. Not that it matters, as I'm sure the perp is spoofing his IP anyways.

I have a D-Link wbr-1310 and have avast internet security running.

Thanks

 

[Dwarf]

Are you connecting wirelessly, or via direct Ethernet (wired) connection? If you don't use or require the wireless functionality, you should always turn it off on the router.

 

[bishop101]

I use the wifi for a laptop. While my other 2 other desktop is connected with cat 5 cable.

 

[dogbert2]

What router are you using, some routers allow better filtering of scans, ports, etc... I have a Buffalo WHR-G54S running DD-WRT (3rd party firmware based on linux). It allows me much finer control at blocking (or allowing) inbound or outbound traffic.

 

[carwiz]

It's probably Windows (or the router) polling the devices on you network.

See here: Secrets of Network Cartography - The Xmas Tree Scan (-sX)