Linksys EA9200 Incoming Traffic Logging

Oct 25, 2018
1
0
10
The incoming log file on this router is in real time and only displays active connections. It should be called a monitor and not a log. I have been hitting refresh every few seconds just to try to capture any incoming traffic. Today I had a computer from Russia connect to one of my cameras on a port that I figured nobody would be able to figure out. My question is, is there a away to log (capture and save) incoming traffic so I can go back and look to see who is entering my network. Seems like a no brainer, but everything I have found involves sniffing and translating packets. I want simple.
Source IP --- Destination Port Number
 
Yes, it's normally a multistep process. There is a lot of free software. You can turn an old PC into a router and security appliance machine. Kibana is software to visualize it. There are many other softwares for each of the other steps. Look up Security Onion + ELK, Snort, Splunk and pfsense. These are may latest play toys so I'm still trying to figure it all out. I've seen maps of firewall hits by geolocation. People all over will hit your firewall constantly. Even if you have a stealthed service they may try and brute force random ports/services and get lucky.

I would recommend not allowing inbound. if you do the entry point needs to be heavily secured.

no hits should reply any feedback. all port scans should be dropped. just a few things, this not advice on all the things you need to do. i'm no security expert.

https://www.youtube.com/watch?v=3NjQ9b3pgIg
 

jfreggie2

Honorable
Sep 16, 2013
150
0
10,760
If you're going to put anything on your network that's accessible to the internet you really should have an actual firewall on the edge. Getting something easy like a PFSense setup would greatly decrease your chances of unauthorized access. You can easily set up Geo-blocks and access lists to prevent unwanted access.