Hi, I've upgraded my IPS system and it has begun to send me alerts notifying that my orbi device was connecting on port 80 to an address that seems to be in China, and it does so regularly. does anyone know why it does that ? best regards Message: IPS Alert 1: A Network Trojan was Detected. Signature ET MALWARE Suspicious User-Agent (1 space). From: 10.1.1.16:52320, to: 203.205.142.208:80, protocol: TCP Message: IPS Alert 1: A Network Trojan was Detected. Signature ET MALWARE Suspicious User-Agent (1 space). From: 10.1.1.16:52230, to: 203.205.255.80:8080, protocol: TCP

The WhoIs lookup on these IP's traces back to: inetnum: 203.205.192.0 - 203.205.255.255 netname: TENCENT-NET-AP descr: Shenzhen Tencent Computer Systems Company Limited descr: Tencent Building, Kejizhongyi Avenue,Hi-techPark, descr: NanshanDistrict, Shenzhen country: CN inetnum: 203.205.128.0 - 203.205.159.255 netname: TENCENT-NET-AP descr: Shenzhen Tencent Computer Systems Company Limited descr: Tencent Building, Kejizhongyi Avenue,Hi-techPark, descr: NanshanDistrict, Shenzhen country: CN This doesn't smell like "Netgear" to me. If 10.1.1.16 is the Orbi's WAN port, you could use the debug page to capture the LAN traffic and see exactly which device on your Orbi is connecting to those IP's.

CrimpOn wrote: The WhoIs lookup on these IP's traces back to: inetnum: 203.205.192.0 - 203.205.255.255 netname: TENCENT-NET-AP descr: Shenzhen Tencent Computer Systems Company Limited descr: Tencent Building, Kejizhongyi Avenue,Hi-techPark, descr: NanshanDistrict, Shenzhen country: CN inetnum: 203.205.128.0 - 203.205.159.255 netname: TENCENT-NET-AP descr: Shenzhen Tencent Computer Systems Company Limited descr: Tencent Building, Kejizhongyi Avenue,Hi-techPark, descr: NanshanDistrict, Shenzhen country: CN See above. CrimpOn wrote: This doesn't smell like "Netgear" to me. Nor does it smell like the Chinese or Russian governments. Many of these things tracks back to something else on the local network. Sometimes an IoT device. Who knows? Don't immediately think Chinese IP address = nasty. Look under the hood for what is really going on. This is the important bit: ...capture the LAN traffic and see exactly which device on your Orbi is connecting to those IP's. The router's log may be helpful. But it also had a habit for finding useless and misleading information. But first check the plumbing.

I don't know if it matters whether the Orbi is in "router" or "AP" mode (my Orbi is in router), but @ekhalil showed me how to display all the "open ports". Browse to the Orbi debug page, usually 192.168.1.1/debug.htm Check the box "Enable Telnet" User your favorite telnet application to telnet to the Orbi and log in with the same "admin" and password Enter the command cat /proc/net ip_conntrack It is sort of tedious to locate the IP you want in the telnet window, so I save the telnet session to a file and use a text editor to find what I want, sort the entries, etc. Every time I used the Windows telnet client, I would forget to save the session to a file, so I changed over to Putty and created a script that always saves the session to a unique text file. After closing the telnet session, remember to go back to the debug page and turn off telnet access. Once the device which has opened that IP connection has been located, I believe there are similar commands to display which application has the port open.

Proton68 wrote: I've upgraded my IPS system What's that? Google suggests Integrated Plumbing Systems. 203.205.142.208 is Tencent.

michaelkenward wrote: Proton68 wrote: I've upgraded my IPS system What's that? Google suggests Integrated Plumbing Systems. 203.205.142.208 is Tencent. :-) Intrusion Prevention System

Orbi connection to China | NETGEAR Communities

14 Replies

michaelkenward
Guru
Feb 14, 2019
Proton68 wrote:

I've upgraded my IPS system

What's that? Google suggests Integrated Plumbing Systems.

203.205.142.208 is Tencent.
- Proton68
  Aspirant
  Feb 14, 2019
  michaelkenward wrote:
  
  Proton68 wrote:
  
  I've upgraded my IPS system
  
  What's that? Google suggests Integrated Plumbing Systems.
  
  203.205.142.208 is Tencent.
  
  :-)
  
  Intrusion Prevention System
ekhalil
Master
Feb 14, 2019
Proton68 wrote:

Hi,

I've upgraded my IPS system and it has begun to send me alerts notifying that my orbi device was connecting on port 80 to an address that seems to be in China, and it does so regularly. does anyone know why it does that ?

best regards

Message: IPS Alert 1: A Network Trojan was Detected. Signature ET MALWARE Suspicious User-Agent (1 space). From: 10.1.1.16:52320, to: 203.205.142.208:80, protocol: TCP

Message: IPS Alert 1: A Network Trojan was Detected. Signature ET MALWARE Suspicious User-Agent (1 space). From: 10.1.1.16:52230, to: 203.205.255.80:8080, protocol: TCP

When you use the Orbi app and you login to your Netgear account, the app creates a VPN connection from your Netgear account on the cloud to Orbi to be able to manage your Orbi from the app. I think this is what your IPS sees.

This is only needed when using the app for Orbi management but not when you use the web GUI.
- CrimpOn
  Guru
  Feb 14, 2019
  The WhoIs lookup on these IP's traces back to:
  
  inetnum: 203.205.192.0 - 203.205.255.255 netname: TENCENT-NET-AP descr: Shenzhen Tencent Computer Systems Company Limited descr: Tencent Building, Kejizhongyi Avenue,Hi-techPark, descr: NanshanDistrict, Shenzhen country: CN
  
  inetnum: 203.205.128.0 - 203.205.159.255 netname: TENCENT-NET-AP descr: Shenzhen Tencent Computer Systems Company Limited descr: Tencent Building, Kejizhongyi Avenue,Hi-techPark, descr: NanshanDistrict, Shenzhen country: CN
  
  This doesn't smell like "Netgear" to me. If 10.1.1.16 is the Orbi's WAN port, you could use the debug page to capture the LAN traffic and see exactly which device on your Orbi is connecting to those IP's.
  - michaelkenward
    Guru
    Feb 14, 2019
    CrimpOn wrote:
    
    The WhoIs lookup on these IP's traces back to:
    
    inetnum: 203.205.192.0 - 203.205.255.255 netname: TENCENT-NET-AP descr: Shenzhen Tencent Computer Systems Company Limited descr: Tencent Building, Kejizhongyi Avenue,Hi-techPark, descr: NanshanDistrict, Shenzhen country: CN
    
    inetnum: 203.205.128.0 - 203.205.159.255 netname: TENCENT-NET-AP descr: Shenzhen Tencent Computer Systems Company Limited descr: Tencent Building, Kejizhongyi Avenue,Hi-techPark, descr: NanshanDistrict, Shenzhen country: CN
    
    See above.
    
    CrimpOn wrote:
    
    This doesn't smell like "Netgear" to me.
    
    Nor does it smell like the Chinese or Russian governments.
    
    Many of these things tracks back to something else on the local network. Sometimes an IoT device. Who knows?
    
    Don't immediately think Chinese IP address = nasty. Look under the hood for what is really going on.
    
    This is the important bit:
    
    ...capture the LAN traffic and see exactly which device on your Orbi is connecting to those IP's.
    
    The router's log may be helpful. But it also had a habit for finding useless and misleading information.
    
    But first check the plumbing.

Forum Discussion

Orbi connection to China