Router logs show constant unknown port mapping (forwarding)?

Question

Do I have a virus or trojan? Should I be worried? What’s going on here? I’m currently running Debian, and there are records like this for every day since these first records showed up. I coincidentally reformatted my hard drive yesterday, and reinstalled debian with an encrypted drive. Records from yesterday still showed up though.

2015/11/25 00:12:35 Notice  [IGD][2250]: Delete Port mapping (null):3074
2015/11/25 00:08:06 Notice  [IGD][2250]: Add Port mapping :3074 to 10.0.0.39:3074
2015/11/23 23:07:27 Notice  [IGD][2244]: Add Port mapping :59435 to 10.0.0.139:59435
2015/11/23 23:07:27 Notice  [IGD][2280]: Add Port mapping :59435 to 10.0.0.139:59435
2015/11/23 23:07:24 Notice  [IGD][2244]: Add Port mapping :4433 to 10.0.0.139:4433
2015/11/23 23:07:24 Notice  [IGD][2280]: Add Port mapping :4433 to 10.0.0.139:4433
2015/11/23 23:07:21 Notice  [IGD][2280]: Add Port mapping :59435 to 10.0.0.139:59435
2015/11/23 23:07:21 Notice  [IGD][2244]: Add Port mapping :59435 to 10.0.0.139:59435

Solution

I googled IGD, or Internet Gateway Device Protocol, which brought me to UPnP, or Universal Plug and Play, which brought me to the culprit, Deluge, my torrent client. It automatically forwards those ports for seeding whenever the download has finished. Just have to disable seeding which apparently deluge does not support completely. Time to switch torrent programs I guess.

Comments

[alpha]

Transmission works very well for me, including proper use of uPnP ports. It's available in the Debian Repos too. (The port :3074 entry is for your XBox)

[Giacomo1968]

Pretty good self-answered question. But one thing to note past the copy edits I made: Not everyone knows what some software like “Deluge” is. So always best to uppercase it as a proper noun and link to the software’s homepage if possible. Otherwise, nice work!

[lscstu22]

Thank you for the suggestion! It looks like it's between Transmission and qBittorrent... but I'll probably go with qBittorrent due to the familiar interface. @JakeGould Thanks! I'll keep that in mind for future questions/answers

[Steve Reeder]

Damn, I was going to say it sounds like UPnP but you beat me to it.