odd probes 2

What are Tech Mahindra playing at?

[LAN access from remote] from 199.68.218.129:47420 to 192.168.1.9:80 Saturday, Jan 11,2014 16:21:59
[LAN access from remote] from 199.68.218.129:34282 to 192.168.1.9:80 Saturday, Jan 11,2014 16:21:58
[LAN access from remote] from 199.68.218.129:39887 to 192.168.1.9:80 Saturday, Jan 11,2014 16:21:57
[LAN access from remote] from 199.68.218.129:39785 to 192.168.1.9:80 Saturday, Jan 11,2014 16:21:56
[LAN access from remote] from 199.68.218.129:50558 to 192.168.1.9:80 Saturday, Jan 11,2014 16:21:55
[LAN access from remote] from 199.68.218.129:51750 to 192.168.1.9:80 Saturday, Jan 11,2014 16:21:55
[LAN access from remote] from 199.68.218.129:49432 to 192.168.1.9:80 Saturday, Jan 11,2014 16:21:55
[LAN access from remote] from 199.68.218.129:13656 to 192.168.1.9:80 Saturday, Jan 11,2014 16:21:54
[LAN access from remote] from 199.68.218.129:13046 to 192.168.1.9:80 Saturday, Jan 11,2014 16:21:54
[LAN access from remote] from 199.68.218.129:32097 to 192.168.1.9:80 Saturday, Jan 11,2014 16:21:54
[LAN access from remote] from 199.68.218.129:12733 to 192.168.1.9:80 Saturday, Jan 11,2014 16:21:54
[LAN access from remote] from 199.68.218.129:54673 to 192.168.1.9:80 Saturday, Jan 11,2014 16:21:54
[LAN access from remote] from 199.68.218.129:43122 to 192.168.1.9:80 Saturday, Jan 11,2014 16:21:54
[LAN access from remote] from 199.68.218.129:37606 to 192.168.1.9:80 Saturday, Jan 11,2014 16:21:51

odd probes

The memory test results came back from Synology. The results were both conclusive and inconclusive.

They proved that the environment is stable and not under any strain. But they were unable to demonstrate why CPU utilisation was close to 100%.

There were no rogue (or non-rogue) services or processes spinning (and thus eating up CPU).

There were no jobs ticking along in either TSR or background.

And there were no previously unknown index-based utilities doing indexy-related things.

So it was a bit of a mystery as to why CPU should be almost maxed out (yet delivery performance was unaffected by the high-90%s utilisation – because, remember RAM utilisation was in the normal band).

I spent a couple of days wondering what could eat up CPU let leave RAM relatively untroubled.

I was travelling to work, a few days ago, when I remembered a conversation I had with my friend Avril, many years ago – about processing architecture and IP packets.

Avril was a network genius. She holds a number of networking patents, and has worked at BTs R&D division in Suffolk in a senior capacity. She also lectured, part time, at UWE on Real Time Information Systems.

We had a conversation, years ago, about processor architecture and how some types of processors are designed to dump processes in to RAM, whilst others will handle simple positive/negative steps themselves.

It’s as clear as crystal, if you remember the big RISC v Intel debate.

I looked up the architecture specs for the processors in the NAS and discovered that they are designed on the RISC SPARC model.

Light dawned.

So it was entirely possible that the processors were performing simple RAM-type processes, without actually dumping them in to RAM to be dealt with there.

On the way home I decided to check the router logs.

[later]

A look at the router logs confirmed what I’d thought: I was under a DDoS attack.

The router was stopping 95% of the probes, but the 5% that were getting through were enough to be eating up almost all of the CPU. The NAS was rejecting the 5%, but that yes/no process was where the CPU utilisation was going.

At the peak of the attack the router logs indicated that my infrastructure was receiving c. 500 probes per minute – so many probes that the router log couldn’t record them all, it was filling up and over-writing itself every few minutes.

Unfortunately, effective though the router’s firewall is, it isn’t configurable, so I have to rely on its defaults, and beef up the second layer of security on the NAS (which I’m using as secondary firewall and DHCP server/router).

So I figure that I just have to sit tight and wait out the DDoS attack.

But here’s a thing.

Do you know how much traffic your internet router is receiving?

I doubt many people bother to check.

But crack open the logs and have a look. I’m betting you’ll be surprised at what’s going on behind the scenes.

memory testing

This is exciting!

In an attempt to get to the source of the 100% CPU utilisation, I had a word with Synology support.

They got back to me with a suggestion of a memory diagnostic which I ran earlier this evening.

I’ve just mailed off two memory tests for analysis.

Watch this space for further updates!

(ps: ironically, the 100% CPU utilisation issue has not reared its ugly head since)

whittling away at it

I’ve updated the ‘pending’ list over there.

I have been less than impressed with Ghost (the platform, not Drift Ghost HD, my new video camera, which is excellent!). It has left me with a strong aftertaste of mediocrity. I understand the concept, but if you strip away the aspirations, really it has no significant advantages over Drupal or WordPress (and has some fairly hefty disadvantages).

Subdomains (both leading and trailing) were actually much easier to get a grip of than I thought they would be. The simpler method, where there is a need, is to deploy trailing subdomains, but I do understand why the geeky amongst us would prefer leading subdomains.

I had initially set up one of the HP servers, but both are now up and running. I have some test MySQL databases on one, a couple of test domains on the other and I’m experimenting with the split of data (between ‘A’ and ‘B’ boxes).

There is, though, a periodic routing problem that I want to get to grips with. The internet router seems to be doing its job, the NAS (acting as DHCP router) seems to be doing its job, and the servers seem to be doing their jobs.

But every now and then latency creeps up and can run up from an operating level of +90ms to as much as +3s.

I need to sit down and figure out where this is springing from and why it’s a periodic issue. No packets are being lost, so it’s not as if the routing is being dropped, just slowed down. I have also noticed that sometimes the CPU on the NAS rises to 99% utilisation from the customary 15-25%. But when it does peak that high, the RAM utilisation scarcely gets over 35%.

Anyway, I’m sure the routing thing is fixable and probably needs nothing more than some fine-tuning. I’d like to sit down and check my IP addressing. But as ever, this all needs time and there isn’t too much spare time knocking about, at the moment.

Not on the ‘pending’ list, but I have spent a lot of time (almost all of this weekend) consolidating data from a multitude of backups.

Over the last six years I’ve burned out three laptops (or hard disks in laptops).

Before I bought the NAS I undertook a weekly global backup of my laptop(s), all the way back to 2008. To accommodate these backups, I bought three external HDDs (one 500Mb, the other two 1Tb each).

So this weekend, while the weather has been absolutely pants, I’ve been consolidating the data from these individual devices on to the ‘A’ HP server.

This consolidation hasn’t really increased the data footprint on the ‘A’ server very much, but it has freed up three fairly large external HDDs. I have no idea what I’m going to do with them, but I’m sure I’ll think of something.

(a nice side effect of the data consolidation is that my iTunes library has now risen to 7,500 songs)

puzzling it

Earlier this evening I had a look at the router log.

It’s showing *a lot* of IP-related activity.

I don’t know enough about IP traffic-types to be able to read the log and determine what it all means.

But if you do, could you drop me a line?

Here’s an excerpt. If you look at the timings, you’ll see what I mean by *a lot*!

[LAN access from remote] from 165.88.254.215:36379 to 192.168.1.9:80 Friday, Jan 03,2014 21:06:50
[LAN access from remote] from 122.55.79.221:39718 to 192.168.1.9:80 Friday, Jan 03,2014 21:06:41
[LAN access from remote] from 173.192.238.41:50686 to 192.168.1.9:80 Friday, Jan 03,2014 21:06:14
[LAN access from remote] from 173.192.238.41:50549 to 192.168.1.9:80 Friday, Jan 03,2014 21:06:14

geeking in .php

I was awake until gone 4 this morning, trying to crack an apparent permissions problem on a MySQL database.

The database runs a content management system (indexing/categorising/tracking metadata/grouping and, of course, reporting.

It was brought to my attention at about 7pm last night that the content management system wasn’t letting registered users (or administrators) add new content/update metadata.

This is something of a problem, for a content management system.

Obv.

I logged on to the database as senior user and experienced the problem first hand.

My first thought was that the permissions had somehow become unstuck, and the user hierarchy had assumed a permission value of ‘null’.

I checked the user permissions in the admin panel and they were all as they should have been.

I flipped in to the database and looked at things from there, and saw nowt wrong there either.

Hmm. Puzzling.

I then spent several hours running through logical, systematic checks (eg: creating a new user, assigning standard permissions to a section, validating those permissions with the database, writing to the database from the backend with those permissions – etc, etc, etc – up and down the structural, content and permissions-based hierarchies.

I spent several hours achieving some things and not others.

By 4.15am I was too tired to think straight, but switching off the light didn’t help; I couldn’t sleep for ages.

I woke at 9am and had an idea.

What if the .php front-end was somehow fudging the permissions? Concealing functionality? Somehow?

Unlikely, but I was running out of places to look.

I checked the read/write permissions on all of the trigger .php files.

Nope, nothing off-key to be found.

And then I had another thought.

What if it was the design template?

Supposing that there was a not-permissions problem, a something else kind of a problem with the design?

Something missing? Something garbled/corrupted? Something somewhere, that was occluding (word?) a fundamental line (or block) of executable code?

I am not a design expert.

I don’t do flashy front ends and high quality UX audits. I understand function point analysis, yes. I understand integration/interfaces, yes. To a (limited) degree I understand databases of various flavours.

But I’m not a front end developer.

And the person who did the front end development on this application has long since vanished back to Sydney.

I surrounded myself with the few debugging tools I have, gave myself two hours to unpick the front end code, looking for a bug, or a garble, or a thing that didn’t make any sense.

At just under an hour I thought I was on the track of it.

At an hour and ten minutes I knew I had the problem in my sights.

I changed some syntax in a section of triggers, got out of bed, showered, brushed my teeth, got dressed and took the bike out for a ride.

When I got back, a couple of hours later, I had lungfuls a plenty of fresh air, and a clear head.

I went straight back to the area I had been working, completed the tidying up, applied the new code and blow me down, it only went and worked.

Registered users now have read/write access to the appropriate areas of the system (as designated by their admin settings).

And I tidied up a very minor presentational thing that has been annoying me ever since I started looking after the product.

What caused it?

What was the terrible event that triggered this near-apocalyptic devastation?

In a nutshell, I upgraded the database.

It was a legacy product which I had just dragged up to MySQL 5.x (MySQL 5.6.15) from an unstable MySQL 4.1 – and what’s that, something like nine years old?

The front end developer had hard-coded certain (but unnecessary) database calls in to the front end .php.

Upgrading the database (a thing I did on Boxing Day), disconnected the hard-coding and the system had a paddy.

It was that simple.

Yes, very easy to believe that the problem was permission-based. But actually it was a disconnect in the front end that was producing symptoms of a permission-based failure.

I got there.

A more highly-skilled front end wiz would probably have got there much quicker than I did.

But I’m not a front end specialist.

I’m just a geek who does stuff here and there.

rendered completely useless

I’ve been playing with the video I shot yesterday.

I used Sony Vegas Pro as the video/audio editor; here’s what I did first of all:

  • migrated the raw footage to the studio laptop
  • viewed the raw footage in VLC
  • fired up SVP
  • created a blank project using a slightly modified template I designed a while ago
  • imported the raw video to the project
  • split the raw video to the start and end points I wanted (I didn’t want to edit the timeline)
  • created fade in and fade out points for the edited video
  • created and dropped to the start of the edited video a title graphic
  • created a new video channel within the project
  • dropped the ‘comment’ graphics in to the new video channel
  • removed the audio track to the edited video (original track)
  • imported the chosen musical track in to the project, to where I wanted it to start/end
  • saved the project as a .veg file
  • rendered the project as .wmv format

When I played the finished project back in the master viewer in SVP, it looked fine. The start and end points were good, the fades were good, the text graphics were good.

But when I viewed the file in .wmv format there was nothing to like:

  • the title graphic was bitty; dropped, for no reason, and then came back, and flickered briefly to negative before returning to normal
  • the video quality was rubbish, not so much HD (which it should have been), but VFPQ (work it out)

But, oddly, the audio remained consistent.

I re-rendered the finished project as .wmv three times, and each time the same quality (lack of quality!) issues were apparent.

Then I rendered the project as .mpg and viewed it.

Brilliant! No quality issues.

The weird thing is that .wmv presents itself as the default format for rendered video.

Well, not any more, obv. I’ve changed that.

But the questions running around in my head now are what the hell use is .wmv? And why does rendering a finished project in to .wmv present so many quality issues?

patching patches?

I always get puzzled and slightly perplexed when a patch to an operating system is made available, and all it says is something vague such as ‘enhanced security’, or ‘fixes security bug’.

I’m used to the professional world of regular updates being released against a release calendar.

But this slightly concerning lack of true transparency, where a patch to what is, effectively, another patch that was released a couple of months ago, is less than professional.

Anyway, Synology have released another patch to the DSM operating system on the NAS.

I applied the patch last night.

It wasn’t a hot-fix patch, it needed the NAS to be dropped after applying it.

Which I did.

There were no issues in applying the patch.

No issues in dropping the NAS.

No issues in bringing it back up.

I just have issues with largely undocumented patches/fixes/upgrades.

monitor

Since I had my trawl through the services running on the NAS, I’ve noticed that the unit is not working as hard as it used to, whilst doing the same amount of tasks.

Or is it since I updated the Linux kernel (which was at the same time)?

Either way, the CPU activity is waaaay lower than it used to be.

And you can see how hard the NAS is working, routing incoming traffic, as per the router stats I shared earlier.

Anyway, CPU activity here:

Monitor

summary and pressing new words and routing

I think, to summarise, there are/have been three issues here:

  1. correctly-generated main blog feeds being corrupted/unread in one feed aggregator
  2. Mantra dicking around in the main blog
  3. the NAS getting its knickers in a knot and locking up after the RAID controller patch was applied

To mitigate these problems:

  • I edited to a correct state a number of defective files in the Mantra theme
  • I edited to a correct state a number of defective WordPress files
  • I reduced to zero the number of services running on the NAS, and reapplied some of them them, one by one (today)

Also today:

  • I applied a new upgrade to Mantra
  • I applied a new upgrade to WordPress
  • I validated the RSS feeds

I’m betting with myself that both WordPress and Mantra realised that the previous versions of their products achieved less than 100% on a quality measure.

I could be wrong, but I get very technosceptic when I see suppliers rush out a new version so soon after the previous issue.

As to the NAS issue, I may have been at fault in not cold-restarting the NAS after I applied the RAID controller patch.

And this error may have indirectly caused the NAS to get its knickers in a knot.

But, it has had a positive effect. I have conducted a review of the services I had running on the NAS.

I have stopped and removed some, and altered others. I was probably a bit keen, when I set the NAS up, and just ticked lots of boxes in a “Yeah, I’ll have that, that, that, that, that, that, and that running!” kind of way.

I have, for the sake of clarity, not touched either Server A or Server B*, as neither of those pieces of hardware (nor their hard disks, nor their operating systems) have shown any sign of a problem.

I have also, and just for good measure, checked the status of the internet router, that sits in front of the NAS.

It too was solid, and doing a very good job very thoroughly. Here’s a snippet from the router log. It’s very interesting reading!

[LAN access from remote] from 98.168.210.166:23654 to 192.168.1.2:20589 Sunday, Dec 15,2013 19:26:14
[LAN access from remote] from 123.125.71.50:20181 to 192.168.1.9:80 Sunday, Dec 15,2013 19:26:14
[LAN access from remote] from 157.56.92.156:33247 to 192.168.1.9:80 Sunday, Dec 15,2013 19:26:00
[LAN access from remote] from 86.140.85.43:51338 to 192.168.1.9:80 Sunday, Dec 15,2013 19:24:08
[LAN access from remote] from 184.168.193.182:57286 to 192.168.1.9:80 Sunday, Dec 15,2013 19:23:29
[LAN access from remote] from 66.249.93.63:38064 to 192.168.1.9:80 Sunday, Dec 15,2013 19:23:16
[LAN access from remote] from 61.188.38.249:6000 to 192.168.1.9:1433 Sunday, Dec 15,2013 19:21:07
[LAN access from remote] from 208.79.209.50:56611 to 192.168.1.9:80 Sunday, Dec 15,2013 19:20:59
[LAN access from remote] from 72.14.199.237:58709 to 192.168.1.9:80 Sunday, Dec 15,2013 19:20:23
[LAN access from remote] from 94.14.36.33:51511 to 192.168.1.9:80 Sunday, Dec 15,2013 19:20:18
[LAN access from remote] from 184.168.193.182:54834 to 192.168.1.9:80 Sunday, Dec 15,2013 19:20:10
[LAN access from remote] from 213.238.175.37:37014 to 192.168.1.9:80 Sunday, Dec 15,2013 19:19:41
[LAN access from remote] from 74.125.176.145:51362 to 192.168.1.9:80 Sunday, Dec 15,2013 19:19:10
[LAN access from remote] from 184.168.193.182:53920 to 192.168.1.9:80 Sunday, Dec 15,2013 19:18:58
[LAN access from remote] from 66.249.78.63:58917 to 192.168.1.9:80 Sunday, Dec 15,2013 19:18:40
[LAN access from remote] from 220.181.108.95:1704 to 192.168.1.9:80 Sunday, Dec 15,2013 19:18:39
[LAN access from remote] from 184.168.193.182:53303 to 192.168.1.9:80 Sunday, Dec 15,2013 19:18:15
[LAN access from remote] from 184.168.193.182:53276 to 192.168.1.9:80 Sunday, Dec 15,2013 19:18:13
[LAN access from remote] from 109.74.1.174:56869 to 192.168.1.9:80 Sunday, Dec 15,2013 19:18:05
[LAN access from remote] from 157.55.34.93:57458 to 192.168.1.9:80 Sunday, Dec 15,2013 19:17:12
[LAN access from remote] from 184.0.57.174:20574 to 192.168.1.9:80 Sunday, Dec 15,2013 19:17:08
[LAN access from remote] from 2.131.9.105:35937 to 192.168.1.9:80 Sunday, Dec 15,2013 19:17:07
[LAN access from remote] from 2.131.9.105:35936 to 192.168.1.9:80 Sunday, Dec 15,2013 19:17:07
[LAN access from remote] from 202.68.229.118:1116 to 192.168.1.9:80 Sunday, Dec 15,2013 19:16:54
[LAN access from remote] from 192.99.11.146:57104 to 192.168.1.9:80 Sunday, Dec 15,2013 19:16:24
[LAN access from remote] from 5.10.83.82:53564 to 192.168.1.9:80 Sunday, Dec 15,2013 19:16:22
[LAN access from remote] from 66.249.78.199:63671 to 192.168.1.9:80 Sunday, Dec 15,2013 19:16:18
[LAN access from remote] from 184.168.193.182:51461 to 192.168.1.9:80 Sunday, Dec 15,2013 19:16:07
[LAN access from remote] from 94.228.34.209:50891 to 192.168.1.9:80 Sunday, Dec 15,2013 19:16:01
[LAN access from remote] from 90.202.18.165:61822 to 192.168.1.9:80 Sunday, Dec 15,2013 19:15:23
[LAN access from remote] from 90.202.18.165:61821 to 192.168.1.9:80 Sunday, Dec 15,2013 19:15:23
[LAN access from remote] from 142.166.3.122:5553 to 192.168.1.9:80 Sunday, Dec 15,2013 19:15:04
[LAN access from remote] from 142.166.3.122:15784 to 192.168.1.9:80 Sunday, Dec 15,2013 19:15:03
[LAN access from remote] from 157.55.33.29:18535 to 192.168.1.9:80 Sunday, Dec 15,2013 19:14:12
[LAN access from remote] from 194.63.133.92:56368 to 192.168.1.9:80 Sunday, Dec 15,2013 19:13:49
[LAN access from remote] from 46.161.41.24:34086 to 192.168.1.9:80 Sunday, Dec 15,2013 19:13:32
[LAN access from remote] from 86.132.98.19:1166 to 192.168.1.9:80 Sunday, Dec 15,2013 19:13:20
[LAN access from remote] from 157.55.34.93:48748 to 192.168.1.9:80 Sunday, Dec 15,2013 19:12:44
[LAN access from remote] from 86.133.231.63:56821 to 192.168.1.9:80 Sunday, Dec 15,2013 19:12:17
[LAN access from remote] from 77.22.75.71:3504 to 192.168.1.9:80 Sunday, Dec 15,2013 19:11:10
[LAN access from remote] from 77.22.75.71:3501 to 192.168.1.9:80 Sunday, Dec 15,2013 19:11:10
[LAN access from remote] from 199.30.16.7:57584 to 192.168.1.9:80 Sunday, Dec 15,2013 19:11:05
[LAN access from remote] from 199.30.16.7:57435 to 192.168.1.9:80 Sunday, Dec 15,2013 19:11:05
[LAN access from remote] from 184.168.193.182:48449 to 192.168.1.9:80 Sunday, Dec 15,2013 19:11:02
[LAN access from remote] from 5.10.83.35:48968 to 192.168.1.9:80 Sunday, Dec 15,2013 19:10:52
[LAN access from remote] from 77.101.154.220:52664 to 192.168.1.9:80 Sunday, Dec 15,2013 19:10:32
[LAN access from remote] from 66.249.78.63:55225 to 192.168.1.9:80 Sunday, Dec 15,2013 19:10:07
[LAN access from remote] from 157.55.34.93:17919 to 192.168.1.9:80 Sunday, Dec 15,2013 19:09:25
[LAN access from remote] from 157.55.34.93:15429 to 192.168.1.9:80 Sunday, Dec 15,2013 19:09:20
[LAN access from remote] from 93.194.78.106:55707 to 192.168.1.9:80 Sunday, Dec 15,2013 19:09:15
[LAN access from remote] from 65.55.24.244:37211 to 192.168.1.9:80 Sunday, Dec 15,2013 19:09:15
[LAN access from remote] from 5.104.241.171:38125 to 192.168.1.9:80 Sunday, Dec 15,2013 19:08:19
[LAN access from remote] from 77.22.75.71:2964 to 192.168.1.9:80 Sunday, Dec 15,2013 19:07:57
[LAN access from remote] from 184.168.193.182:45578 to 192.168.1.9:80 Sunday, Dec 15,2013 19:07:14
[LAN access from remote] from 66.249.78.88:44209 to 192.168.1.9:80 Sunday, Dec 15,2013 19:07:12
[LAN access from remote] from 66.249.78.88:52955 to 192.168.1.9:80 Sunday, Dec 15,2013 19:07:07
[LAN access from remote] from 86.140.10.44:53068 to 192.168.1.9:80 Sunday, Dec 15,2013 19:06:49
[LAN access from remote] from 184.22.136.143:54333 to 192.168.1.9:80 Sunday, Dec 15,2013 19:06:23
[LAN access from remote] from 66.249.66.30:49501 to 192.168.1.9:80 Sunday, Dec 15,2013 19:06:17
[LAN access from remote] from 66.249.78.63:55837 to 192.168.1.9:80 Sunday, Dec 15,2013 19:05:26
[LAN access from remote] from 184.168.193.182:44164 to 192.168.1.9:80 Sunday, Dec 15,2013 19:05:21
[LAN access from remote] from 187.187.232.237:53227 to 192.168.1.9:80 Sunday, Dec 15,2013 19:05:05
[LAN access from remote] from 66.249.78.63:57329 to 192.168.1.9:80 Sunday, Dec 15,2013 19:05:02
[LAN access from remote] from 5.104.241.171:54148 to 192.168.1.9:80 Sunday, Dec 15,2013 19:04:52
[LAN access from remote] from 157.55.32.86:52030 to 192.168.1.9:80 Sunday, Dec 15,2013 19:04:14
[LAN access from remote] from 184.168.193.182:43134 to 192.168.1.9:80 Sunday, Dec 15,2013 19:04:07
[LAN access from remote] from 5.10.83.89:41478 to 192.168.1.9:80 Sunday, Dec 15,2013 19:03:48
[LAN access from remote] from 5.10.83.88:35276 to 192.168.1.9:80 Sunday, Dec 15,2013 19:03:36
[LAN access from remote] from 5.10.83.43:50614 to 192.168.1.9:80 Sunday, Dec 15,2013 19:03:30
[LAN access from remote] from 112.5.234.98:7009 to 192.168.1.9:80 Sunday, Dec 15,2013 19:03:12
[LAN access from remote] from 184.168.193.182:42164 to 192.168.1.9:80 Sunday, Dec 15,2013 19:02:59
[LAN access from remote] from 27.159.219.220:55082 to 192.168.1.9:80 Sunday, Dec 15,2013 19:02:47
[LAN access from remote] from 94.228.34.212:59695 to 192.168.1.9:80 Sunday, Dec 15,2013 19:02:46
[LAN access from remote] from 5.10.83.65:48724 to 192.168.1.9:80 Sunday, Dec 15,2013 19:02:34
[LAN access from remote] from 5.10.83.55:33933 to 192.168.1.9:80 Sunday, Dec 15,2013 19:02:30
[LAN access from remote] from 173.192.238.41:39428 to 192.168.1.9:80 Sunday, Dec 15,2013 19:02:14
[LAN access from remote] from 66.249.78.63:35745 to 192.168.1.9:80 Sunday, Dec 15,2013 19:02:07
[LAN access from remote] from 212.159.26.160:55871 to 192.168.1.9:80 Sunday, Dec 15,2013 19:02:07
[LAN access from remote] from 65.19.138.33:57037 to 192.168.1.9:80 Sunday, Dec 15,2013 19:02:04
[LAN access from remote] from 174.36.228.156:55005 to 192.168.1.9:80 Sunday, Dec 15,2013 19:01:51
[LAN access from remote] from 174.36.228.156:54836 to 192.168.1.9:80 Sunday, Dec 15,2013 19:01:51
[LAN access from remote] from 94.228.34.209:53243 to 192.168.1.9:80 Sunday, Dec 15,2013 19:01:47
[LAN access from remote] from 5.10.83.22:55594 to 192.168.1.9:80 Sunday, Dec 15,2013 19:01:44
[LAN access from remote] from 66.249.78.63:56090 to 192.168.1.9:80 Sunday, Dec 15,2013 19:01:35
[LAN access from remote] from 93.152.185.46:50033 to 192.168.1.9:80 Sunday, Dec 15,2013 19:01:26
[LAN access from remote] from 93.152.185.46:50032 to 192.168.1.9:80 Sunday, Dec 15,2013 19:01:26
[LAN access from remote] from 184.168.193.182:40454 to 192.168.1.9:80 Sunday, Dec 15,2013 19:00:57
[LAN access from remote] from 50.73.18.69:63704 to 192.168.1.9:80 Sunday, Dec 15,2013 19:00:55
[LAN access from remote] from 65.55.24.244:38947 to 192.168.1.9:80 Sunday, Dec 15,2013 19:00:31
[LAN access from remote] from 178.210.208.72:58800 to 192.168.1.9:80 Sunday, Dec 15,2013 19:00:09
[LAN access from remote] from 178.210.208.72:58799 to 192.168.1.9:80 Sunday, Dec 15,2013 19:00:09
[LAN access from remote] from 66.249.78.126:33910 to 192.168.1.9:80 Sunday, Dec 15,2013 18:59:28
[LAN access from remote] from 74.125.176.145:58240 to 192.168.1.9:80 Sunday, Dec 15,2013 18:59:20
[LAN access from remote] from 89.240.53.210:54456 to 192.168.1.9:80 Sunday, Dec 15,2013 18:59:17
[LAN access from remote] from 66.249.78.126:56759 to 192.168.1.9:80 Sunday, Dec 15,2013 18:59:13
[LAN access from remote] from 81.225.80.13:56294 to 192.168.1.9:80 Sunday, Dec 15,2013 18:58:58
[LAN access from remote] from 213.238.175.38:52297 to 192.168.1.9:80 Sunday, Dec 15,2013 18:58:21
[LAN access from remote] from 157.55.33.41:60313 to 192.168.1.9:80 Sunday, Dec 15,2013 18:56:31
[LAN access from remote] from 88.190.37.12:50089 to 192.168.1.9:80 Sunday, Dec 15,2013 18:55:58
[LAN access from remote] from 88.190.37.12:50088 to 192.168.1.9:80 Sunday, Dec 15,2013 18:55:58
[LAN access from remote] from 88.190.37.12:50087 to 192.168.1.9:80 Sunday, Dec 15,2013 18:55:58
[LAN access from remote] from 184.168.193.182:37478 to 192.168.1.9:80 Sunday, Dec 15,2013 18:55:56
[LAN access from remote] from 66.249.78.31:41725 to 192.168.1.9:80 Sunday, Dec 15,2013 18:54:09
[LAN access from remote] from 199.30.16.26:3926 to 192.168.1.9:80 Sunday, Dec 15,2013 18:53:55
[LAN access from remote] from 199.30.16.26:3809 to 192.168.1.9:80 Sunday, Dec 15,2013 18:53:54
[LAN access from remote] from 66.249.78.63:40616 to 192.168.1.9:80 Sunday, Dec 15,2013 18:53:02
[LAN access from remote] from 94.228.34.209:51132 to 192.168.1.9:80 Sunday, Dec 15,2013 18:51:58
[LAN access from remote] from 175.44.28.117:13601 to 192.168.1.9:80 Sunday, Dec 15,2013 18:51:47
[LAN access from remote] from 184.168.193.182:34398 to 192.168.1.9:80 Sunday, Dec 15,2013 18:51:46
[LAN access from remote] from 119.63.193.196:17000 to 192.168.1.9:80 Sunday, Dec 15,2013 18:51:46
[LAN access from remote] from 202.46.62.30:44828 to 192.168.1.9:80 Sunday, Dec 15,2013 18:51:31
[LAN access from remote] from 178.210.208.72:58279 to 192.168.1.9:80 Sunday, Dec 15,2013 18:51:20
[LAN access from remote] from 178.210.208.72:58280 to 192.168.1.9:80 Sunday, Dec 15,2013 18:51:20
[LAN access from remote] from 93.72.24.153:1214 to 192.168.1.9:80 Sunday, Dec 15,2013 18:51:03
[LAN access from remote] from 80.1.186.39:61976 to 192.168.1.9:80 Sunday, Dec 15,2013 18:51:00
[LAN access from remote] from 69.171.242.118:34830 to 192.168.1.9:80 Sunday, Dec 15,2013 18:50:45
[LAN access from remote] from 157.56.92.156:64338 to 192.168.1.9:80 Sunday, Dec 15,2013 18:50:29
[LAN access from remote] from 184.168.193.182:33318 to 192.168.1.9:80 Sunday, Dec 15,2013 18:50:21
[LAN access from remote] from 74.125.40.23:58091 to 192.168.1.9:80 Sunday, Dec 15,2013 18:49:38
[LAN access from remote] from 184.168.193.182:32487 to 192.168.1.9:80 Sunday, Dec 15,2013 18:49:15
[LAN access from remote] from 199.16.185.50:19201 to 192.168.1.9:80 Sunday, Dec 15,2013 18:49:08
[LAN access from remote] from 204.11.32.242:55659 to 192.168.1.9:80 Sunday, Dec 15,2013 18:48:50
[LAN access from remote] from 77.160.175.196:57151 to 192.168.1.9:80 Sunday, Dec 15,2013 18:48:50
[LAN access from remote] from 77.160.175.196:57150 to 192.168.1.9:80 Sunday, Dec 15,2013 18:48:50
[LAN access from remote] from 72.14.199.237:43811 to 192.168.1.9:80 Sunday, Dec 15,2013 18:48:11
[LAN access from remote] from 5.10.83.43:47035 to 192.168.1.9:80 Sunday, Dec 15,2013 18:47:56
[LAN access from remote] from 5.10.83.55:37976 to 192.168.1.9:80 Sunday, Dec 15,2013 18:47:34
[LAN access from remote] from 66.249.93.63:37803 to 192.168.1.9:80 Sunday, Dec 15,2013 18:46:05
[LAN access from remote] from 98.168.210.166:23654 to 192.168.1.2:20589 Sunday, Dec 15,2013 18:45:56
[LAN access from remote] from 184.168.193.182:29272 to 192.168.1.9:80 Sunday, Dec 15,2013 18:45:45
[LAN access from remote] from 178.210.208.72:57898 to 192.168.1.9:80 Sunday, Dec 15,2013 18:44:39
[LAN access from remote] from 178.210.208.72:57896 to 192.168.1.9:80 Sunday, Dec 15,2013 18:44:39
[LAN access from remote] from 178.210.208.72:57897 to 192.168.1.9:80 Sunday, Dec 15,2013 18:44:39
[LAN access from remote] from 157.55.33.214:33286 to 192.168.1.9:80 Sunday, Dec 15,2013 18:44:33
[LAN access from remote] from 66.249.78.63:49793 to 192.168.1.9:80 Sunday, Dec 15,2013 18:44:20
[LAN access from remote] from 66.249.78.63:64090 to 192.168.1.9:80 Sunday, Dec 15,2013 18:43:45
[LAN access from remote] from 157.56.92.156:32581 to 192.168.1.9:80 Sunday, Dec 15,2013 18:43:43
[LAN access from remote] from 37.140.141.11:11635 to 192.168.1.9:80 Sunday, Dec 15,2013 18:43:31
[LAN access from remote] from 64.91.229.52:55904 to 192.168.1.9:80 Sunday, Dec 15,2013 18:42:14
[LAN access from remote] from 98.168.210.166:5356 to 192.168.1.9:80 Sunday, Dec 15,2013 18:41:52
[LAN access from remote] from 98.168.210.166:5355 to 192.168.1.9:80 Sunday, Dec 15,2013 18:41:52
[LAN access from remote] from 94.23.233.204:43049 to 192.168.1.9:80 Sunday, Dec 15,2013 18:41:41
[LAN access from remote] from 94.23.233.204:58790 to 192.168.1.9:80 Sunday, Dec 15,2013 18:41:39
[LAN access from remote] from 94.23.233.204:38858 to 192.168.1.9:80 Sunday, Dec 15,2013 18:41:38
[LAN access from remote] from 94.23.233.204:44442 to 192.168.1.9:80 Sunday, Dec 15,2013 18:41:36
[LAN access from remote] from 94.23.233.204:36246 to 192.168.1.9:80 Sunday, Dec 15,2013 18:41:35
[LAN access from remote] from 94.23.233.204:34049 to 192.168.1.9:80 Sunday, Dec 15,2013 18:41:33
[LAN access from remote] from 94.23.233.204:59814 to 192.168.1.9:80 Sunday, Dec 15,2013 18:41:32
[LAN access from remote] from 94.23.233.204:41183 to 192.168.1.9:80 Sunday, Dec 15,2013 18:41:31
[LAN access from remote] from 94.23.233.204:44796 to 192.168.1.9:80 Sunday, Dec 15,2013 18:41:30
[LAN access from remote] from 94.23.233.204:47848 to 192.168.1.9:80 Sunday, Dec 15,2013 18:41:27
[LAN access from remote] from 94.23.233.204:44318 to 192.168.1.9:80 Sunday, Dec 15,2013 18:41:25
[LAN access from remote] from 94.23.233.204:43005 to 192.168.1.9:80 Sunday, Dec 15,2013 18:41:24
[LAN access from remote] from 94.23.233.204:54383 to 192.168.1.9:80 Sunday, Dec 15,2013 18:41:23
[LAN access from remote] from 94.23.233.204:34529 to 192.168.1.9:80 Sunday, Dec 15,2013 18:41:22
[LAN access from remote] from 94.23.233.204:53456 to 192.168.1.9:80 Sunday, Dec 15,2013 18:41:21
[LAN access from remote] from 94.23.233.204:55812 to 192.168.1.9:80 Sunday, Dec 15,2013 18:41:19
[LAN access from remote] from 94.23.233.204:54619 to 192.168.1.9:80 Sunday, Dec 15,2013 18:41:18
[LAN access from remote] from 190.145.33.250:43547 to 192.168.1.9:80 Sunday, Dec 15,2013 18:41:15
[LAN access from remote] from 190.145.33.250:43463 to 192.168.1.9:80 Sunday, Dec 15,2013 18:41:12
[LAN access from remote] from 157.55.34.93:59670 to 192.168.1.9:80 Sunday, Dec 15,2013 18:41:12
[LAN access from remote] from 5.10.83.79:45816 to 192.168.1.9:80 Sunday, Dec 15,2013 18:40:54
[LAN access from remote] from 184.168.193.182:26060 to 192.168.1.9:80 Sunday, Dec 15,2013 18:40:35
[LAN access from remote] from 199.30.20.23:1828 to 192.168.1.9:80 Sunday, Dec 15,2013 18:40:28
[LAN access from remote] from 199.30.20.23:1732 to 192.168.1.9:80 Sunday, Dec 15,2013 18:40:27
[LAN access from remote] from 213.44.143.90:62100 to 192.168.1.9:80 Sunday, Dec 15,2013 18:40:25
[LAN access from remote] from 131.253.24.58:8400 to 192.168.1.9:80 Sunday, Dec 15,2013 18:39:40
[LAN access from remote] from 131.253.24.58:8411 to 192.168.1.9:80 Sunday, Dec 15,2013 18:39:40
[LAN access from remote] from 70.70.144.13:61206 to 192.168.1.9:80 Sunday, Dec 15,2013 18:39:40
[LAN access from remote] from 131.253.24.58:6090 to 192.168.1.9:80 Sunday, Dec 15,2013 18:39:29
[LAN access from remote] from 131.253.24.58:5627 to 192.168.1.9:80 Sunday, Dec 15,2013 18:39:26
[LAN access from remote] from 184.168.193.182:25084 to 192.168.1.9:80 Sunday, Dec 15,2013 18:39:24
[LAN access from remote] from 5.10.83.51:43835 to 192.168.1.9:80 Sunday, Dec 15,2013 18:38:08
[LAN access from remote] from 54.205.105.168:45440 to 192.168.1.9:80 Sunday, Dec 15,2013 18:37:04
[LAN access from remote] from 54.205.105.168:45417 to 192.168.1.9:80 Sunday, Dec 15,2013 18:37:03
[LAN access from remote] from 54.224.5.73:60053 to 192.168.1.9:80 Sunday, Dec 15,2013 18:37:01
[LAN access from remote] from 23.20.236.174:58739 to 192.168.1.9:80 Sunday, Dec 15,2013 18:36:59
[LAN access from remote] from 174.129.122.186:60422 to 192.168.1.9:80 Sunday, Dec 15,2013 18:36:57
[LAN access from remote] from 118.161.79.71:6000 to 192.168.1.9:25 Sunday, Dec 15,2013 18:36:40
[LAN access from remote] from 184.168.193.182:22822 to 192.168.1.9:80 Sunday, Dec 15,2013 18:36:39
[LAN access from remote] from 5.10.83.43:35187 to 192.168.1.9:80 Sunday, Dec 15,2013 18:36:31
[LAN access from remote] from 109.120.157.179:64408 to 192.168.1.9:80 Sunday, Dec 15,2013 18:35:47
[LAN access from remote] from 109.120.157.179:64265 to 192.168.1.9:80 Sunday, Dec 15,2013 18:35:46
[LAN access from remote] from 66.249.78.63:45982 to 192.168.1.9:80 Sunday, Dec 15,2013 18:35:44
[LAN access from remote] from 208.115.113.87:54041 to 192.168.1.9:80 Sunday, Dec 15,2013 18:35:30
[LAN access from remote] from 65.55.24.244:47813 to 192.168.1.9:80 Sunday, Dec 15,2013 18:35:23
[LAN access from remote] from 117.25.106.132:51622 to 192.168.1.9:80 Sunday, Dec 15,2013 18:35:19
[LAN access from remote] from 184.168.193.182:21595 to 192.168.1.9:80 Sunday, Dec 15,2013 18:35:12
[LAN access from remote] from 69.143.254.170:4532 to 192.168.1.9:80 Sunday, Dec 15,2013 18:34:13
[LAN access from remote] from 65.55.24.244:52649 to 192.168.1.9:80 Sunday, Dec 15,2013 18:34:06
[LAN access from remote] from 162.243.45.13:43820 to 192.168.1.9:80 Sunday, Dec 15,2013 18:33:54

 

* I really need to get a better naming convention 🙂