Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

My firewall logs are being flooded with logs of packets being blocked that i don't want to be blocked:

enter image description here

Every 3 seconds there are 2 packets being broadcast from my machine:

  • Interface: LAN
  • Source IP: fe80::742c:6fb9:aac3:8dc8 (my desktop pc)
  • Source Port: 56904 (randomly assigned outgoing port)
  • Destination IP: ff02::c (IPv6 link local multicast address)
  • Destination Port: 1900 (Simple Service Discovery Protocol)
  • Protocol: UDP

These are IPv6 packets on the LAN interface that are being blocked. Except i allow all traffic on the LAN interface:

enter image description here

And just for good measure i allow all IPv4 traffic on my LAN interface:

enter image description here

Why are SSDP multicast packets on my LAN being blocked, and how do i stop blocking them?

Note: The reason i am seeing them in the log is because i've asked m0n0wall to log packets blocked by the default rule:

enter image description here

i did this to confirm that no packets should be blocked, because no packets should be blocked


Looking at the logs in "raw" mode:

07:31:47.282546 rl0 @0:16 b fe80::742c:6fb9:aac3:8dc8,56904 -> ff02::c,1900 PR udp len 40 194 IN low-ttl multicast

Reveals nothing interesting:

  • Time: 07:31:47.28546
  • Interface: rl0 (LAN)
  • Group/Rule: @0:16
  • Action: b (Block)
  • From address: fe80::742c:6fb9:aac3:8dc8 (my desktop pc)
  • From port: 56904
  • To address: ff02::c (IPv6 link local multicast address)
  • To port: 1900 (SSDP)
  • Protocol: PR udp (UDP)
  • Packet length: len 40 (40 bytes)
  • Other: 194 IN low-ttl multicast

With m0n0wall's status.php page showing for ipfstat -nio:

ipfstat -nio
...
@16 block in log quick on rl0 all head 100
...
# Group 100
@1 pass in quick from 192.168.0.0/16 to 192.168.1.1/32 keep state group 100
@2 pass in quick from any to any keep state group 100
...

See also

share|improve this question
add comment

1 Answer

This most likely has something to do with the fact that it is multicast traffic, try to look for related settings.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.