Flint Ax1800 Kernal Logs suspicious?

Routers
1

I did a search :backhand_index_pointing_up:and didn’t find anything close to my inquiry, so I hope this is okay. I’m not necessarily new to network security, just old hat as in used to delve “deeper” 5-10 years ago on an intermediate level, and my brain is mush right now, dealing with setting up a new router to replace an old Motorola modem/router for the home base. My brain also functions on past experiences with targeted doxxing and no, not paranoid (well, yes, but it’s circumstantial). Any help would be greatly appreciated. (Edited for spelling)

I am setting up a new router and modem combo. Before setting up the modem, I was accessing the Flint AX1800 (edit) firmware 4.7.13, via USB tethered to iOS SE 2, with OS 18 to change security settings. Also using Proton VPN on that phone as well as installed on the router per Wireguard. Macbook Mid 2012 Mojave, also with Proton VPN active, used to access router via ethernet port 1. Set up LuCi for firewall and other settings access. I checked the kernel logs and this seems concerning to me (I use "****" to block out potential identifiers, but I am unsure if necessary):

[   22.090562] kmwan: sensitivity and mode are set.
[   23.433904] tertf: br-lan registered, add it
[   23.477293] br-lan: port 1(eth1) entered blocking state
[   23.477330] br-lan: port 1(eth1) entered disabled state
[   23.481600] device eth1 entered promiscuous mode
[   23.703674] br-lan: port 2(eth2) entered blocking state
[   23.703714] br-lan: port 2(eth2) entered disabled state
[   23.710090] device eth2 entered promiscuous mode
[   23.918109] br-lan: port 3(eth3) entered blocking state
[   23.918140] br-lan: port 3(eth3) entered disabled state
[   23.922630] device eth3 entered promiscuous mode
[   24.130812] br-lan: port 4(eth4) entered blocking state
[   24.130844] br-lan: port 4(eth4) entered disabled state
[   24.135153] device eth4 entered promiscuous mode
[   27.435196] nss-dp 3a001200.dp2 eth1: PHY Link up speed: 1000
[   27.435295] br-lan: port 1(eth1) entered blocking state
[   27.439918] br-lan: port 1(eth1) entered forwarding state 10.351860] xt_time: kernel timezone is -0000
[   10.353919] usbcore: registered new interface driver cdc_ether
[   10.357664] usbcore: registered new interface driver cdc_ncm
[   10.378978] usbcore: registered new interface driver huawei_cdc_ncm
[   10.402234] usbcore: registered new interface driver qmi_wwan
[   10.404264] usbcore: registered new interface driver rndis_host
[   10.473862] usbcore: registered new interface driver option
[   10.473925] usbserial: USB Serial support registered for GSM modem (1-port)
[   15.515157] ath11k c000000.wifi: Not multipd architecture
[   15.515439] ath11k c000000.wifi: ipq6018 hw1.0
[   15.519818] remoteproc remoteproc0: powering up cd00000.remoteproc
[   15.546918] remoteproc remoteproc0: Booting fw image IPQ6018/q6_fw.mdt, size 7340
[   16.601379] Subsystem error monitoring/handling services are up
[   16.607117] qcom,cpr4-apss-regulator b018000.cpr4-ctrl: CPR valid fuse count: 4
[   16.608281] qcom,cpr4-apss-regulator b018000.cpr4-ctrl: CPR valid fuse count: 4
[   16.654032] ath11k c000000.wifi: chip_id 0x0 chip_family 0x4 board_id 0xff soc_id 0xffffffff
[   16.654065] ath11k c000000.wifi: fw_version 0x27038969 fw_build_timestamp 2024-08-07 06:44 fw_build_id QC_IMAGE_VERSION_STRING=WLAN.HK.****-****-********-1
[   16.686635] ath11k c000000.wifi: qmi caldata downloaded: type: 2
[   16.715159] remoteproc remoteproc0: remote processor cd00000.remoteproc is now up
[   16.968385] remoteproc remoteproc0: stopped remote processor cd00000.remoteproc
[   16.968423] remoteproc remoteproc0: powering up cd00000.remoteproc
[   16.974589] remoteproc remoteproc0: Booting fw image IPQ6018/q6_fw.mdt, size 7340
[   17.275825] Subsystem error monitoring/handling services are up
[   17.281463] qcom,cpr4-apss-regulator b018000.cpr4-ctrl: CPR valid fuse count: 4
[   17.282636] qcom,cpr4-apss-regulator b018000.cpr4-ctrl: CPR valid fuse count: 4
[   17.328364] ath11k c000000.wifi: chip_id 0x0 chip_family 0x4 board_id 0xff soc_id 0xffffffff
[   17.328395] ath11k c000000.wifi: fw_version 0x27038969 fw_build_timestamp 2024-08-07 06:44 fw_build_id QC_IMAGE_VERSION_STRING=WLAN.HK.****
[   17.341322] ath11k c000000.wifi: qmi caldata downloaded: type: 2
[   17.395133] remoteproc remoteproc0: remote processor cd00000.remoteproc is now up
[   17.395901] kmodloader: done loading kernel modules from /etc/modules.d/*
[   17.401964] qcom,cpr4-apss-regulator b018000.cpr4-ctrl: CPR valid fuse count: 4
[   17.483599] applying ath11k-macs
[   17.514539] ath11k c000000.wifi: Direct firmware load for ath11k/IPQ6018/hw1.0/qdss_trace_config.bin failed with error -2
[   17.514593] ath11k c000000.wifi: Falling back to sysfs fallback for: ath11k/IPQ6018/hw1.0/qdss_trace_config.bin
[   17.858871] ath11k c000000.wifi: Direct firmware load for qdss_trace_config.bin failed with error -2
[   17.858913] ath11k c000000.wifi: Falling back to sysfs fallback for: qdss_trace_config.bin
[   17.932635] ath11k c000000.wifi: qmi failed to load QDSS config: qdss_trace_config.bin
[   17.932673] ath11k c000000.wifi: Failed to download QDSS config to FW: -12
[   22.090562] kmwan: sensitivity and mode are set.
[   23.433904] tertf: br-lan registered, add it
[   23.477293] br-lan: port 1(eth1) entered blocking state
[   23.477330] br-lan: port 1(eth1) entered disabled state
[   23.481600] device eth1 entered promiscuous mode
[   23.703674] br-lan: port 2(eth2) entered blocking state
[   23.703714] br-lan: port 2(eth2) entered disabled state
[   23.710090] device eth2 entered promiscuous mode
[   23.918109] br-lan: port 3(eth3) entered blocking state
[   23.918140] br-lan: port 3(eth3) entered disabled state
[   23.922630] device eth3 entered promiscuous mode
[   24.130812] br-lan: port 4(eth4) entered blocking state
[   24.130844] br-lan: port 4(eth4) entered disabled state
[   24.135153] device eth4 entered promiscuous mode
[   27.435196] nss-dp 3a001200.dp2 eth1: PHY Link up speed: 1000
[   27.435295] br-lan: port 1(eth1) entered blocking state
[   27.439918] br-lan: port 1(eth1) entered forwarding state

What is concerning me is "[ 23.477293] br-lan: port 1(eth1) entered blocking state
[ 23.477330] br-lan: port 1(eth1) entered disabled state
[ 23.481600] device eth1 entered promiscuous mode"

etc

and

"remoteproc remoteproc0: remote processor cd00000.remoteproc is now up"

What's more, on the macbook in the network activity monitor, Syslog keeps sending out packets with PID 42, root user. Which is another topic in itself along with “sandbox” messages, probably best on a different forum discussion but maybe informative for this topic.

Let me know if anything else is needed. Thank you in advance.

2

This is totally fine; it's during the booting process - all network interfaces will get initialized. It's part of the STP (Spanning-Tree-Protocol) and used by switches.

Fine as well, just the firmware telling that the rproc protocol is loaded. It's needed for SoC devices like your router.

This, however, does not seem to be normal. On my MacBook syslog is quiet and does not send out packets. You may look inside the syslog config - maybe forwarding is enabled: How do I send Syslog messages from macOS to EventSentry? | EventSentry

Or try to run sudo lsof -i | grep syslog using the Terminal.app to find the target host of this packets.

2 Likes
5

Whats odd is that syslog shows packets, are you sure you aren't looking to some kind of task manager equilavent? (P.s I'm not a mac user😋)

If it is indeed some kind of task manager maybe it is normal legitimate process you can indeed check like @admon suggested to see if it is a normal process.

2 Likes
6

Thanks! This sets my mind at ease regarding the router. Also, thanks for taking the time to give advice on my Syslog anomaly despite it being slightly off topic. I’ll look into your suggestions and let you know what I find (if interested).