NAT Error in Actiontec (FIOS) Router Security Log

[MelRaff]

I am repeatedly finding this error in the security log of my Actiontec FIOS router:

NAT Error: Conflict Mapping already exists LAN 192.168.1.4 dev clink0 protocol PROTO 41 [repeated 12 times, last time on Dec 6 18:46:14 2009]

The LAN address in the message varies between our two Windows 7 PCs, and the number of repetitions varies, too, sometimes occurr over 100 times (e.g., "repeated 121 times, last time on . . ." ).

Our network seems to be behaving properly, but  I do not understand why this error is occurring, nor do I understand why it is happening repeatedly and so often, nor do I know whether it is a symptom of something troublesome but just not evident. 

The Actiontec manual is of no help.  It says only this: "NAT Error: Conflict Mapping already exists - a conflict occurred because the NAT mapping already exists, so NAT failed."  This little bit helps me not at all.

If anyone does understand, I'd very much appreciate being enlightened.

Thanks.

[dslr595148]

Here is my educated guess on what to do.

Turn off UPnP in the router.

[MelRaff]

Actually, I did that already.  What I was seeing was that as soon as that error appeared in the log, a new mapped port would appear (to the same IP address listed in the error message).  I would delete it, but it would reappear at about the same time as the error message.  So I disabled UPnP on the router, but the error messages continue.  The mapped port, of course, no longer reappears, but the router continues to log these same errors.

[dslr595148]

What is the exact model and version of that Actiontec?

For example MI-424 Ver C

[MelRaff]

It's an MI424-WR, Rev D; firmware version 4.0.16.1.56.0.10.11.6.

   Mel

[dslr595148]

I am not sure, but my educated guess is that is because the router has a Small/Tiny NAT table.

I point to

http://www.dslreports.com/faq/16233

http://www.dslreports.com/faq/16077

--

OR if my guess is wrong, those errors are the least of your issue(s)..

^^

[MelRaff]

Thank you for the suggestions.  The error message I'm getting is not the same as the one from the small NAT table, and I'm not using any of the apps that DSLReports suggests can overrun its capacity.  I've considered the worst case, but multiple malware scanners come up with nothing.

On the bright side, I haven't seen the errors since I dsabled the IPHelper service on all the LAN PCs.  Been over a day now.  This confirms my suspicion that it had something to do with Windows 7 wanting to open Teredo IP V6 tunnels on the Actiontec for some reason.  This made me greatly fear some sort of malware infection, but I haven't been able to come up with anything at all suspicious, as I said.  So maybe I'm OK for now.

   Mel

[dslr595148]

While I am not an expert on making sure that computers are clean OR helping people clean their comptuers, you can go to a site where you can get help doing this.

DSLR has a Security Cleanup FAQ  and Forum.

I am not saying that you must go to DSLR's security cleanup FAQ and get help on DSLR's Security Cleanup forum, but please do go somewhere.

^^