0

I'm running an nginx web server on the local network. I'm behind a linksys EA3500 router. I've noticed a lot of strange activity on my web server coming from the router (192.168.1.1). I've tried power-cycling the router and haven't seen any change. Here is a section of my nginx access logs with the strange activity: 

192.168.1.1 - - [19/Jun/2016:13:40:00 -0400] "GET /HNAP1/ HTTP/1.1" 404 1564 "-" "-"
192.168.1.1 - - [19/Jun/2016:13:40:00 -0400] "GET / HTTP/1.1" 302 107 "-" "-"
192.168.1.1 - - [19/Jun/2016:13:40:00 -0400] "POST /JNAP/ HTTP/1.1" 404 1564 "-" "-"
192.168.1.1 - - [19/Jun/2016:13:40:00 -0400] "GET /admin/login HTTP/1.1" 200 2581 "-" "-"
192.168.1.1 - - [19/Jun/2016:13:40:00 -0400] "GET / HTTP/1.1" 302 107 "-" "-"
192.168.1.1 - - [19/Jun/2016:13:40:00 -0400] "GET /admin/login HTTP/1.1" 200 2588 "-" "-"
192.168.1.1 - - [19/Jun/2016:13:42:16 -0400] "GET / HTTP/1.1" 302 107 "-" "-"
192.168.1.1 - - [19/Jun/2016:13:42:16 -0400] "GET /HNAP1/ HTTP/1.1" 404 1564 "-" "-"
192.168.1.1 - - [19/Jun/2016:13:42:16 -0400] "GET /admin/login HTTP/1.1" 200 2588 "-" "-"
192.168.1.1 - - [19/Jun/2016:13:42:16 -0400] "GET / HTTP/1.1" 302 107 "-" "-"
192.168.1.1 - - [19/Jun/2016:13:42:16 -0400] "GET /HNAP1/ HTTP/1.1" 404 1564 "-" "-"
192.168.1.1 - - [19/Jun/2016:13:42:16 -0400] "POST /JNAP/ HTTP/1.1" 404 1564 "-" "-"
192.168.1.1 - - [19/Jun/2016:13:42:16 -0400] "POST /JNAP/ HTTP/1.1" 404 1564 "-" "-"
192.168.1.1 - - [19/Jun/2016:13:42:16 -0400] "GET /admin/login HTTP/1.1" 200 2588 "-" "-"
192.168.1.1 - - [19/Jun/2016:13:48:31 -0400] "GET /HNAP1/ HTTP/1.1" 404 1564 "-" "-"
192.168.1.1 - - [19/Jun/2016:13:48:31 -0400] "POST /JNAP/ HTTP/1.1" 404 1564 "-" "-"
192.168.1.1 - - [19/Jun/2016:13:48:31 -0400] "POST /JNAP/ HTTP/1.1" 404 1564 "-" "-"
192.168.1.1 - - [19/Jun/2016:13:48:31 -0400] "GET /HNAP1/ HTTP/1.1" 404 1564 "-" "-"
192.168.1.1 - - [19/Jun/2016:13:48:31 -0400] "GET / HTTP/1.1" 302 107 "-" "-"
192.168.1.1 - - [19/Jun/2016:13:48:31 -0400] "GET / HTTP/1.1" 302 107 "-" "-"
192.168.1.1 - - [19/Jun/2016:13:48:31 -0400] "GET /admin/login HTTP/1.1" 200 2588 "-" "-"
192.168.1.1 - - [19/Jun/2016:13:48:31 -0400] "GET /admin/login HTTP/1.1" 200 2588 "-" "-"
192.168.1.1 - - [19/Jun/2016:13:50:31 -0400] "GET /HNAP1/ HTTP/1.1" 404 1564 "-" "-"
192.168.1.1 - - [19/Jun/2016:13:50:31 -0400] "GET / HTTP/1.1" 302 107 "-" "-"
192.168.1.1 - - [19/Jun/2016:13:50:31 -0400] "POST /JNAP/ HTTP/1.1" 404 1564 "-" "-"
192.168.1.1 - - [19/Jun/2016:13:50:31 -0400] "GET /HNAP1/ HTTP/1.1" 404 1564 "-" "-"
192.168.1.1 - - [19/Jun/2016:13:50:31 -0400] "GET /admin/login HTTP/1.1" 200 2588 "-" "-"
192.168.1.1 - - [19/Jun/2016:13:50:31 -0400] "GET / HTTP/1.1" 302 107 "-" "-"
192.168.1.1 - - [19/Jun/2016:13:50:31 -0400] "GET /admin/login HTTP/1.1" 200 2588 "-" "-"
192.168.1.1 - - [19/Jun/2016:13:50:31 -0400] "POST /JNAP/ HTTP/1.1" 404 1564 "-" "-"
192.168.1.1 - - [19/Jun/2016:13:55:49 -0400] "GET / HTTP/1.1" 302 107 "-" "-"
192.168.1.1 - - [19/Jun/2016:13:55:49 -0400] "POST /JNAP/ HTTP/1.1" 404 1564 "-" "-"
192.168.1.1 - - [19/Jun/2016:13:55:49 -0400] "GET /HNAP1/ HTTP/1.1" 404 1564 "-" "-"
192.168.1.1 - - [19/Jun/2016:13:55:49 -0400] "GET /admin/login HTTP/1.1" 200 2588 "-" "-"
192.168.1.1 - - [19/Jun/2016:13:55:49 -0400] "GET /HNAP1/ HTTP/1.1" 404 1564 "-" "-"
192.168.1.1 - - [19/Jun/2016:13:55:49 -0400] "GET / HTTP/1.1" 302 107 "-" "-"
192.168.1.1 - - [19/Jun/2016:13:55:49 -0400] "GET /admin/login HTTP/1.1" 200 2588 "-" "-"
192.168.1.1 - - [19/Jun/2016:14:36:39 -0400] "GET / HTTP/1.1" 302 107 "-" "-"
192.168.1.1 - - [19/Jun/2016:14:36:39 -0400] "POST /JNAP/ HTTP/1.1" 404 1564 "-" "-"

The thing that concerns me most is that the router appears to be trying to log into my web server's web app (it hasn't gotten in so far, and never provides credentials). Any ideas what is going on and how I can stop the router from making these requests?

Leonel Galán
  • 6,993
  • 2
  • 41
  • 60
Silvertail
  • 169
  • 1
  • 13
  • Do you have that port open to the outside world and redirected to your web server? It could be someone hitting those endpoints on the redirected port in your public interface. – Leonel Galán Jun 24 '16 at 14:45
  • The only ports I have open are port 80 and port 443, neither of which seam to be used here. Also, port 80 is not forwarded to the webserver. – Silvertail Jun 24 '16 at 14:55

0 Answers0