Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Yesterday I opened a port on the router, forwarded to LAN IP 192.168.1.201 and blocked the ADSL company password to access the router.

There is no other open port on the router. This log is from the 192.168.1.201 machine.

I can't figure out what do these connections mean. (It doesn't seem to be going to end...)

Any idea?

Apr  9 09:52:08 noname-machine kernel: [31307.968106] [UFW BLOCK] IN=eth0 OUT= MAC=01:00:5e:00:00:01:38:72:c0:ce:53:73:08:00 SRC=192.168.1.1 DST=224.0.0.1 LEN=32 TOS=0x00 PREC=0x00 TTL=1 ID=0 DF PROTO=2 
Apr  9 09:52:24 noname-machine kernel: [31323.693457] [UFW BLOCK] IN=eth0 OUT= MAC=01:00:5e:00:00:fb:18:9e:fc:26:eb:19:08:00 SRC=192.168.1.34 DST=224.0.0.251 LEN=32 TOS=0x00 PREC=0x00 TTL=1 ID=58339 PROTO=2 
Apr  9 09:52:53 noname-machine kernel: [31352.982810] [UFW BLOCK] IN=eth0 OUT= MAC=01:00:5e:00:00:01:38:72:c0:ce:53:73:08:00 SRC=192.168.1.1 DST=224.0.0.1 LEN=32 TOS=0x00 PREC=0x00 TTL=1 ID=0 DF PROTO=2 
Apr  9 09:53:08 noname-machine kernel: [31367.987774] [UFW BLOCK] IN=eth0 OUT= MAC=01:00:5e:00:00:01:38:72:c0:ce:53:73:08:00 SRC=192.168.1.1 DST=224.0.0.1 LEN=32 TOS=0x00 PREC=0x00 TTL=1 ID=0 DF PROTO=2 
Apr  9 09:53:24 noname-machine kernel: [31383.769407] [UFW BLOCK] IN=eth0 OUT= MAC=01:00:5e:00:00:fb:18:9e:fc:26:eb:19:08:00 SRC=192.168.1.34 DST=224.0.0.251 LEN=32 TOS=0x00 PREC=0x00 TTL=1 ID=52153 PROTO=2 
Apr  9 09:53:53 noname-machine kernel: [31412.982860] [UFW BLOCK] IN=eth0 OUT= MAC=01:00:5e:00:00:01:38:72:c0:ce:53:73:08:00 SRC=192.168.1.1 DST=224.0.0.1 LEN=32 TOS=0x00 PREC=0x00 TTL=1 ID=0 DF PROTO=2 
Apr  9 09:54:08 noname-machine kernel: [31427.982756] [UFW BLOCK] IN=eth0 OUT= MAC=01:00:5e:00:00:01:38:72:c0:ce:53:73:08:00 SRC=192.168.1.1 DST=224.0.0.1 LEN=32 TOS=0x00 PREC=0x00 TTL=1 ID=0 DF PROTO=2 
Apr  9 09:54:24 noname-machine kernel: [31443.219560] [UFW BLOCK] IN=eth0 OUT= MAC=01:00:5e:00:00:fb:70:f1:a1:05:07:5c:08:00 SRC=169.254.132.219 DST=224.0.0.251 LEN=32 TOS=0x00 PREC=0x00 TTL=1 ID=106 PROTO=2 
Apr  9 09:54:53 noname-machine kernel: [31472.972692] [UFW BLOCK] IN=eth0 OUT= MAC=01:00:5e:00:00:01:38:72:c0:ce:53:73:08:00 SRC=192.168.1.1 DST=224.0.0.1 LEN=32 TOS=0x00 PREC=0x00 TTL=1 ID=0 DF PROTO=2 
Apr  9 09:55:08 noname-machine kernel: [31487.977674] [UFW BLOCK] IN=eth0 OUT= MAC=01:00:5e:00:00:01:38:72:c0:ce:53:73:08:00 SRC=192.168.1.1 DST=224.0.0.1 LEN=32 TOS=0x00 PREC=0x00 TTL=1 ID=0 DF PROTO=2 
Apr  9 09:55:24 noname-machine kernel: [31503.231641] [UFW BLOCK] IN=eth0 OUT= MAC=01:00:5e:00:00:fb:70:f1:a1:05:07:5c:08:00 SRC=169.254.132.219 DST=224.0.0.251 LEN=32 TOS=0x00 PREC=0x00 TTL=1 ID=142 PROTO=2 
Apr  9 09:55:53 noname-machine kernel: [31532.982790] [UFW BLOCK] IN=eth0 OUT= MAC=01:00:5e:00:00:01:38:72:c0:ce:53:73:08:00 SRC=192.168.1.1 DST=224.0.0.1 LEN=32 TOS=0x00 PREC=0x00 TTL=1 ID=0 DF PROTO=2 
Apr  9 09:56:08 noname-machine kernel: [31547.982624] [UFW BLOCK] IN=eth0 OUT= MAC=01:00:5e:00:00:01:38:72:c0:ce:53:73:08:00 SRC=192.168.1.1 DST=224.0.0.1 LEN=32 TOS=0x00 PREC=0x00 TTL=1 ID=0 DF PROTO=2 
Apr  9 09:56:24 noname-machine kernel: [31563.228754] [UFW BLOCK] IN=eth0 OUT= MAC=01:00:5e:00:00:fb:70:f1:a1:05:07:5c:08:00 SRC=169.254.132.219 DST=224.0.0.251 LEN=32 TOS=0x00 PREC=0x00 TTL=1 ID=217 PROTO=2 
Apr  9 09:56:53 noname-machine kernel: [31592.987662] [UFW BLOCK] IN=eth0 OUT= MAC=01:00:5e:00:00:01:38:72:c0:ce:53:73:08:00 SRC=192.168.1.1 DST=224.0.0.1 LEN=32 TOS=0x00 PREC=0x00 TTL=1 ID=0 DF PROTO=2 
Apr  9 09:57:08 noname-machine kernel: [31607.968135] [UFW BLOCK] IN=eth0 OUT= MAC=01:00:5e:00:00:01:38:72:c0:ce:53:73:08:00 SRC=192.168.1.1 DST=224.0.0.1 LEN=32 TOS=0x00 PREC=0x00 TTL=1 ID=0 DF PROTO=2 
Apr  9 09:57:24 noname-machine kernel: [31623.225584] [UFW BLOCK] IN=eth0 OUT= MAC=01:00:5e:00:00:fb:70:f1:a1:05:07:5c:08:00 SRC=169.254.132.219 DST=224.0.0.251 LEN=32 TOS=0x00 PREC=0x00 TTL=1 ID=277 PROTO=2 
Apr  9 09:57:53 noname-machine kernel: [31652.972559] [UFW BLOCK] IN=eth0 OUT= MAC=01:00:5e:00:00:01:38:72:c0:ce:53:73:08:00 SRC=192.168.1.1 DST=224.0.0.1 LEN=32 TOS=0x00 PREC=0x00 TTL=1 ID=0 DF PROTO=2 
Apr  9 09:58:08 noname-machine kernel: [31667.977532] [UFW BLOCK] IN=eth0 OUT= MAC=01:00:5e:00:00:01:38:72:c0:ce:53:73:08:00 SRC=192.168.1.1 DST=224.0.0.1 LEN=32 TOS=0x00 PREC=0x00 TTL=1 ID=0 DF PROTO=2 
Apr  9 09:58:24 noname-machine kernel: [31683.222757] [UFW BLOCK] IN=eth0 OUT= MAC=01:00:5e:00:00:fb:70:f1:a1:05:07:5c:08:00 SRC=169.254.132.219 DST=224.0.0.251 LEN=32 TOS=0x00 PREC=0x00 TTL=1 ID=315 PROTO=2 
Apr  9 09:58:53 noname-machine kernel: [31712.967765] [UFW BLOCK] IN=eth0 OUT= MAC=01:00:5e:00:00:01:38:72:c0:ce:53:73:08:00 SRC=192.168.1.1 DST=224.0.0.1 LEN=32 TOS=0x00 PREC=0x00 TTL=1 ID=0 DF PROTO=2 
share|improve this question
    
You might get into a bit more detail here, since nobody knows how exactly your router works (this starts e.g. with »Which interface is eth0?«). –  Andreas Wiese Apr 9 at 8:39
    
You are right. eth0 is the unique interface on the machine wich is logging it. Anyway, i admit I was too worried about it because it's my machine, but not my LAN, so I was beginning to worry about it, but I'm seeing it must be something regarding to Itunes on another machine. I appreciate your comment :) (excuse my english) –  Alberto Martín Apr 9 at 9:41

1 Answer 1

up vote 2 down vote accepted

It seems a service on hosts 192.168.1.1 and 192.168.1.34 are trying to send out multicast packets (224.0.0.1 is the address on which all multicast-enabled hosts subscribe). Unfortunately your log doesn't include port numbers, so you can't be sure which service it is, but usually these are 'autodiscover' services.

share|improve this answer
    
Right; almost identical to: stackoverflow.com/questions/12483717/… I've been searching in more detail and it seems to be something regarding to Itunes or similar software wich may be running on 192.168.0.36 almost for sure. Since it's not my computer the one which is making so much "noise" on the LAN and since this noise seems to be harmless, I don't need more detail on what exactly it is. Thanks! –  Alberto Martín Apr 9 at 9:41
    
BTW: To avoid log files to became huge with this issue, I've solved it on Debian adding this rule to the firewall: sudo ufw deny from 192.168.1.1 to 224.0.0.1 To ignore them. –  Alberto Martín Apr 9 at 9:51

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.