Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My firewall logs are being flooded with logs of packets being blocked that i don't want to be blocked:

enter image description here

Every 3 seconds there are 2 packets being broadcast from my machine:

  • Interface: LAN
  • Source IP: fe80::742c:6fb9:aac3:8dc8 (my desktop pc)
  • Source Port: 56904 (randomly assigned outgoing port)
  • Destination IP: ff02::c (IPv6 link local multicast address)
  • Destination Port: 1900 (Simple Service Discovery Protocol)
  • Protocol: UDP

These are IPv6 packets on the LAN interface that are being blocked. Except i allow all traffic on the LAN interface:

enter image description here

And just for good measure i allow all IPv4 traffic on my LAN interface:

enter image description here

Why are SSDP multicast packets on my LAN being blocked, and how do i stop blocking them?

Note: The reason i am seeing them in the log is because i've asked m0n0wall to log packets blocked by the default rule:

enter image description here

i did this to confirm that no packets should be blocked, because no packets should be blocked

Looking at the logs in "raw" mode:

07:31:47.282546 rl0 @0:16 b fe80::742c:6fb9:aac3:8dc8,56904 -> ff02::c,1900 PR udp len 40 194 IN low-ttl multicast

Reveals nothing interesting:

  • Time: 07:31:47.28546
  • Interface: rl0 (LAN)
  • Group/Rule: @0:16
  • Action: b (Block)
  • From address: fe80::742c:6fb9:aac3:8dc8 (my desktop pc)
  • From port: 56904
  • To address: ff02::c (IPv6 link local multicast address)
  • To port: 1900 (SSDP)
  • Protocol: PR udp (UDP)
  • Packet length: len 40 (40 bytes)
  • Other: 194 IN low-ttl multicast

With m0n0wall's status.php page showing for ipfstat -nio:

ipfstat -nio
@16 block in log quick on rl0 all head 100
# Group 100
@1 pass in quick from to keep state group 100
@2 pass in quick from any to any keep state group 100

See also

share|improve this question

This most likely has something to do with the fact that it is multicast traffic, try to look for related settings.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .