States Table filling up with entries from DirecTv box on known trojan port 2189

Guest

I have attached a txt file of my states table.

I am seeing a LOT of suspecious 192.168.1.199 entries in the states table. So much that I am worried.

I have a wireless access point on my network secured with WPA (i know that is easily cracked) but I do not see the 192.168.1.199 IP in the clients list for the WAP.

I have no idea what this machine is or where it is connecting from.

I would like to either find a way to block this traffic completely or find out where it is coming from in order to rebuild the machine or whatever has to happen.

Thanks for your help!
[States Table.txt](/public/imported_attachments/1/States Table.txt)

Guest

I decided to stop pulling my hair out and start pulling some cat cable out. I disconnected all devices and started plugging them back in one by one with a couple minutes in between and checked the states table each time.
To my surprise, I was able to determine that my damn DirecTv box was the culprit. You have to plug it into the internet to use some of the ondemand features they offer. I will be having a fun conversation with them soon.

Thanks for those of you who looked,
and thanks for PfSense!!!

Guest

Do you guys think there is something wrong with this DirecTv box?
Should I try and get a new box or try to terminate my contract due to what this is doing to my network?

chpalmer

It would be interesting to know why and if its normal for the box to do that… I cant imagine all the problems this kinda traffic could cause to a cheap WalMart bought broadband router...

Keep us updated on what they tell you after you get past level 1 support...

Guest

Will do :)
Yes, thanks to pfsense my network was not completely killed by this, but my states table did go above 10K entries, which I agree would have brought down a consumer model router to it's knees.

dreamslacker

@chpalmer:

It would be interesting to know why and if its normal for the box to do that… I cant imagine all the problems this kinda traffic could cause to a cheap WalMart bought broadband router...

Keep us updated on what they tell you after you get past level 1 support...

It'd cripple most consumer routers within minutes. Even those the higher-end models. I've tried the more powerful models like the D-link DGL-4300, Linksys WRT-350N so on and so forth. They will rapidly slowdown at 3000+ connections and just freeze up at about 6000 connections.