On 19.08.2012, Reindl Harald wrote:
if it is DNS-rverse-lookup 4096 is a LARGE count
Sure it is reverse lookups which are performed here.
The router logs the ip-adresses and resolves them on demand.
try netstat without and with reverse-lookups
there are very few cases where it doe snot hurt
The router doesn't resolve them "on-the-fly", so there's no danger
here.
and NO dns-reverse-lookups does not help to
get a "overview over what happens"
Bob observed a rapidly increasing connection counter on his router
running dd-wrt. Having a look at what the QoS connection-tracker
reports makes visible if the increased connection-rate is due to
outgoing connections, so in fact it does contribute to getting an
overview over what happens.
If the log functionality in dd-wrt is broken, he has to put something
with log capability in front of the router to track the incoming
connections. Alternatively, it could be an idea to log into the
routers console and place some netfilter/iptables-rules there
which communicate with rsyslogd or similar on one of the local machines.