Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Yesterday I opened a port on the router, forwarded to LAN IP 192.168.1.201 and blocked the ADSL company password to access the router.

There is no other open port on the router. This log is from the 192.168.1.201 machine.

I can't figure out what do these connections mean. (It doesn't seem to be going to end...)

Any idea?

Apr  9 09:52:08 noname-machine kernel: [31307.968106] [UFW BLOCK] IN=eth0 OUT= MAC=01:00:5e:00:00:01:38:72:c0:ce:53:73:08:00 SRC=192.168.1.1 DST=224.0.0.1 LEN=32 TOS=0x00 PREC=0x00 TTL=1 ID=0 DF PROTO=2 
Apr  9 09:52:24 noname-machine kernel: [31323.693457] [UFW BLOCK] IN=eth0 OUT= MAC=01:00:5e:00:00:fb:18:9e:fc:26:eb:19:08:00 SRC=192.168.1.34 DST=224.0.0.251 LEN=32 TOS=0x00 PREC=0x00 TTL=1 ID=58339 PROTO=2 
Apr  9 09:52:53 noname-machine kernel: [31352.982810] [UFW BLOCK] IN=eth0 OUT= MAC=01:00:5e:00:00:01:38:72:c0:ce:53:73:08:00 SRC=192.168.1.1 DST=224.0.0.1 LEN=32 TOS=0x00 PREC=0x00 TTL=1 ID=0 DF PROTO=2 
Apr  9 09:53:08 noname-machine kernel: [31367.987774] [UFW BLOCK] IN=eth0 OUT= MAC=01:00:5e:00:00:01:38:72:c0:ce:53:73:08:00 SRC=192.168.1.1 DST=224.0.0.1 LEN=32 TOS=0x00 PREC=0x00 TTL=1 ID=0 DF PROTO=2 
Apr  9 09:53:24 noname-machine kernel: [31383.769407] [UFW BLOCK] IN=eth0 OUT= MAC=01:00:5e:00:00:fb:18:9e:fc:26:eb:19:08:00 SRC=192.168.1.34 DST=224.0.0.251 LEN=32 TOS=0x00 PREC=0x00 TTL=1 ID=52153 PROTO=2 
Apr  9 09:53:53 noname-machine kernel: [31412.982860] [UFW BLOCK] IN=eth0 OUT= MAC=01:00:5e:00:00:01:38:72:c0:ce:53:73:08:00 SRC=192.168.1.1 DST=224.0.0.1 LEN=32 TOS=0x00 PREC=0x00 TTL=1 ID=0 DF PROTO=2 
Apr  9 09:54:08 noname-machine kernel: [31427.982756] [UFW BLOCK] IN=eth0 OUT= MAC=01:00:5e:00:00:01:38:72:c0:ce:53:73:08:00 SRC=192.168.1.1 DST=224.0.0.1 LEN=32 TOS=0x00 PREC=0x00 TTL=1 ID=0 DF PROTO=2 
Apr  9 09:54:24 noname-machine kernel: [31443.219560] [UFW BLOCK] IN=eth0 OUT= MAC=01:00:5e:00:00:fb:70:f1:a1:05:07:5c:08:00 SRC=169.254.132.219 DST=224.0.0.251 LEN=32 TOS=0x00 PREC=0x00 TTL=1 ID=106 PROTO=2 
Apr  9 09:54:53 noname-machine kernel: [31472.972692] [UFW BLOCK] IN=eth0 OUT= MAC=01:00:5e:00:00:01:38:72:c0:ce:53:73:08:00 SRC=192.168.1.1 DST=224.0.0.1 LEN=32 TOS=0x00 PREC=0x00 TTL=1 ID=0 DF PROTO=2 
Apr  9 09:55:08 noname-machine kernel: [31487.977674] [UFW BLOCK] IN=eth0 OUT= MAC=01:00:5e:00:00:01:38:72:c0:ce:53:73:08:00 SRC=192.168.1.1 DST=224.0.0.1 LEN=32 TOS=0x00 PREC=0x00 TTL=1 ID=0 DF PROTO=2 
Apr  9 09:55:24 noname-machine kernel: [31503.231641] [UFW BLOCK] IN=eth0 OUT= MAC=01:00:5e:00:00:fb:70:f1:a1:05:07:5c:08:00 SRC=169.254.132.219 DST=224.0.0.251 LEN=32 TOS=0x00 PREC=0x00 TTL=1 ID=142 PROTO=2 
Apr  9 09:55:53 noname-machine kernel: [31532.982790] [UFW BLOCK] IN=eth0 OUT= MAC=01:00:5e:00:00:01:38:72:c0:ce:53:73:08:00 SRC=192.168.1.1 DST=224.0.0.1 LEN=32 TOS=0x00 PREC=0x00 TTL=1 ID=0 DF PROTO=2 
Apr  9 09:56:08 noname-machine kernel: [31547.982624] [UFW BLOCK] IN=eth0 OUT= MAC=01:00:5e:00:00:01:38:72:c0:ce:53:73:08:00 SRC=192.168.1.1 DST=224.0.0.1 LEN=32 TOS=0x00 PREC=0x00 TTL=1 ID=0 DF PROTO=2 
Apr  9 09:56:24 noname-machine kernel: [31563.228754] [UFW BLOCK] IN=eth0 OUT= MAC=01:00:5e:00:00:fb:70:f1:a1:05:07:5c:08:00 SRC=169.254.132.219 DST=224.0.0.251 LEN=32 TOS=0x00 PREC=0x00 TTL=1 ID=217 PROTO=2 
Apr  9 09:56:53 noname-machine kernel: [31592.987662] [UFW BLOCK] IN=eth0 OUT= MAC=01:00:5e:00:00:01:38:72:c0:ce:53:73:08:00 SRC=192.168.1.1 DST=224.0.0.1 LEN=32 TOS=0x00 PREC=0x00 TTL=1 ID=0 DF PROTO=2 
Apr  9 09:57:08 noname-machine kernel: [31607.968135] [UFW BLOCK] IN=eth0 OUT= MAC=01:00:5e:00:00:01:38:72:c0:ce:53:73:08:00 SRC=192.168.1.1 DST=224.0.0.1 LEN=32 TOS=0x00 PREC=0x00 TTL=1 ID=0 DF PROTO=2 
Apr  9 09:57:24 noname-machine kernel: [31623.225584] [UFW BLOCK] IN=eth0 OUT= MAC=01:00:5e:00:00:fb:70:f1:a1:05:07:5c:08:00 SRC=169.254.132.219 DST=224.0.0.251 LEN=32 TOS=0x00 PREC=0x00 TTL=1 ID=277 PROTO=2 
Apr  9 09:57:53 noname-machine kernel: [31652.972559] [UFW BLOCK] IN=eth0 OUT= MAC=01:00:5e:00:00:01:38:72:c0:ce:53:73:08:00 SRC=192.168.1.1 DST=224.0.0.1 LEN=32 TOS=0x00 PREC=0x00 TTL=1 ID=0 DF PROTO=2 
Apr  9 09:58:08 noname-machine kernel: [31667.977532] [UFW BLOCK] IN=eth0 OUT= MAC=01:00:5e:00:00:01:38:72:c0:ce:53:73:08:00 SRC=192.168.1.1 DST=224.0.0.1 LEN=32 TOS=0x00 PREC=0x00 TTL=1 ID=0 DF PROTO=2 
Apr  9 09:58:24 noname-machine kernel: [31683.222757] [UFW BLOCK] IN=eth0 OUT= MAC=01:00:5e:00:00:fb:70:f1:a1:05:07:5c:08:00 SRC=169.254.132.219 DST=224.0.0.251 LEN=32 TOS=0x00 PREC=0x00 TTL=1 ID=315 PROTO=2 
Apr  9 09:58:53 noname-machine kernel: [31712.967765] [UFW BLOCK] IN=eth0 OUT= MAC=01:00:5e:00:00:01:38:72:c0:ce:53:73:08:00 SRC=192.168.1.1 DST=224.0.0.1 LEN=32 TOS=0x00 PREC=0x00 TTL=1 ID=0 DF PROTO=2 
share|improve this question
    
You might get into a bit more detail here, since nobody knows how exactly your router works (this starts e.g. with »Which interface is eth0?«). –  Andreas Wiese Apr 9 '14 at 8:39
    
You are right. eth0 is the unique interface on the machine wich is logging it. Anyway, i admit I was too worried about it because it's my machine, but not my LAN, so I was beginning to worry about it, but I'm seeing it must be something regarding to Itunes on another machine. I appreciate your comment :) (excuse my english) –  Alberto Martín Apr 9 '14 at 9:41

2 Answers 2

up vote 3 down vote accepted

It seems a service on hosts 192.168.1.1 and 192.168.1.34 are trying to send out multicast packets (224.0.0.1 is the address on which all multicast-enabled hosts subscribe). Unfortunately your log doesn't include port numbers, so you can't be sure which service it is, but usually these are 'autodiscover' services.

share|improve this answer
    
Right; almost identical to: stackoverflow.com/questions/12483717/… I've been searching in more detail and it seems to be something regarding to Itunes or similar software wich may be running on 192.168.0.36 almost for sure. Since it's not my computer the one which is making so much "noise" on the LAN and since this noise seems to be harmless, I don't need more detail on what exactly it is. Thanks! –  Alberto Martín Apr 9 '14 at 9:41
    
BTW: To avoid log files to became huge with this issue, I've solved it on Debian adding this rule to the firewall: sudo ufw deny from 192.168.1.1 to 224.0.0.1 To ignore them. –  Alberto Martín Apr 9 '14 at 9:51
SRC=192.168.1.1 DST=224.0.0.1 LEN=32 TOS=0x00 PREC=0x00 TTL=1 ID=0 DF PROTO=2

SRC=192.168.1.1 - looks like a NAT router address (the other common one being 192.168.1.254)

DST=224.0.0.1 - IP multicast 'all hosts' address

PROTO=2 - IGMP - Internet Group Management Protocol

So this is mostly likely an IGMP Query packet sent by your local router to all devices on the subnet so it can update / refresh IP multicast group memberships. You need to dump the packet contents to be sure.

SRC=169.254.132.219 DST=224.0.0.251 LEN=32 TOS=0x00 PREC=0x00 TTL=1 ID=142 PROTO=2

DST=224.0.0.251

PROTO=2 - IGMP - Internet Group Management Protocol

There is a device on the network trying to use Multicast DNS (which is usually associated with address 224.0.0.251). However, since the protocol is again IGMP, this is again a query/discovery packet but specifically for mDNS.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.