Who is trying to log in to DD-WRT?

Question

network hardware

Yesterday I noticed very suspicious activity on a router with DD-WRT v3.0-r42015 std (01/18/20). This appears in the log every 15-20 minutes:

Feb 5 23:36:22 TP-Link TL-WR841ND daemon.info httpd[3096]: httpd : Authentication fail
Feb 5 23:36:22 TP-Link TL-WR841ND daemon.err httpd[3096]: httpd : Request Error Code 401: Authorization required. please note that the default username is "root" in all newer releases

IP is dynamic, DDNS has already been turned off, there are no unknown devices in LAN. How to find out the IP or MAC of the device from which an authorization attempt is being made?

Answer 1

It would be nice to look at the logs that httpd itself writes.