Page 1 of 1
FTTN Router Log - Hijacked?
Posted: Fri Mar 11, 2016 10:30 pm
by baumjwb
Is this Event Log entry from my Pace 5031NV gateway significant? I do not like the word "Hijacked." I find 4 recent entries, all the same. A Google search of "fe80:0000:0000:0000

c8ff:fe7a:b8c5" yielded nothing useful.
hurl host=fe80:0000:0000:0000

c8ff:fe7a:b8c5 uri=/xslt hijacked
thanks,
John
Re: FTTN Router Log - Hijacked?
Posted: Sat Mar 12, 2016 10:38 pm
by kevinmcm
fe80:0000:0000:0000

c8ff:fe7a:b8c5 is probably one of your own LAN addresses. Many modems are as easy to exploit as embedding a few URLs or a bit of JavaScript into a web page. If you know which web page or e-mail causes that, you should report it.
Re: FTTN Router Log - Hijacked?
Posted: Sun Mar 13, 2016 9:23 pm
by baumjwb
Thank you, kevinmcm, for your reply.
I'm afraid I'm not as tech savvy as you are. I need an expanded explanation to appreciate what you wrote. If this is a LAN address, does it take other forms, e.g., a URL? Is there a particular tab in the Router/Gateway URL display that would establish a link between "fe80:0000:0000:0000

c8ff:fe7a:b8c5" and something I can identify? It looks vaguely like a memory address to me. It that is the case I've no idea how to interpret it.
I've saved another day's log to Excel and find that this same entry shows up twice a day, once in the late morning, 10-11:00 and again in the afternoon, 15-16:00, it seems to be drifting later. In most cases the log reports a 'repeat.'
In the log, 'sys' suggests 'system' but I cannot parse 'acs' and 'hurl'
thanks again
John
Re: FTTN Router Log - Hijacked?
Posted: Mon Mar 14, 2016 8:37 am
by dherr
Just to clear up the first question, the "fe80:0000:0000:0000

c8ff:fe7a:b8c5" in this context is an IPv6 address. Since it starts with fe80 we know that it is an a "link local" address. If I boot up my computer without having it connected in any way to any sort of networking stuff but with IPv6 enabled then it will only show a "link local" address for my network interface. More info on "link local" in general:
https://en.wikipedia.org/wiki/Link-local_address