6

I have a computer running linux and it has ufw activated with a couple of simple rules set. It is connected to ASUS 4G-N12 router by wifi. When I looked in ufw logs a few days ago it turned out that it had blocked some connections. Today I check logs and again I have many new (identically as previously) entries in log file:

[UFW BLOCK] IN=my_laptop_wifi_interface OUT= MAC=01:00:5e:00:00:01:my_router_MAC_address:08:00 SRC=192.168.1.1 DST=224.0.0.1 LEN=28 TOS=0x00 PREC=0x00 TTL=1 ID=6828 PROTO=2

I am not an expert but if I understand correctly it means that my home wifi router have done some weird things. After searching on the internet and checking my router I found out that this entry means as follow:

MAC=01:00:5e:00:00:01:my_router_MAC_address:08:00

means that connection comes from router and (if I understand correctly) try to reach some standard MAC for multicast (01:00:5e:00:00:01) by IPv4 protocol (08:00 refers to EtherType IPv4);

SRC=192.168.1.1

is my routers IP in local network;

DST=224.0.0.1

is standard IP for All Hosts multicast group addresses - all hosts on the same network segment.

LEN=28 TOS=0x00 PREC=0x00

probably refers somehow to packet content;

TTL=1

is packet time to live;

ID=6828

is probably ufw internal number, every time it is different and as you can see there are many of them;

PROTO=2

probably refers to internet group management protocol (IGMP), so again it’s related to muticast;

Those connections have been blocked because one of my firewalls security rules says that all incoming connections should be denied. I am not a network specialist so maybe it is a normal situation and router sometimes sends such a message to check something related to routing groups membership or something else. However as far as I know I have no services using such communication method running on my router so if I have that right it shouldn’t generate such a traffic. In addition to this I am quite sure that when I checked dmesg logs last time there was no entry like this, and now they are. On the other hand from that time many things has changed for example I upgraded my routers firmwear and also probably changed some settings (both my router and laptop).

And here are my questions:

  1. Why does the router do those weird things? (and is it weird at all?)

  2. Is it something to worry about? (I know that connection on my personal computer is blocked so it is rather safe, but is it possible that it is some kind of a security violation in my local network for example is it possible that router have been owned by some attacker?)

6

That's rather normal – many home routers come with IGMP enabled (both for improving local multicast, and sometimes even for receiving multicast IPTV from the ISP).

That means that one device in the network, usually the router itself, becomes an IGMP "querier" and every so often polls all other devices for changes (e.g. is the device still alive, and is it still subscribed, as IGMPv1 apparently didn't have an "unsubscribe" function).

Do not be unnecessarily paranoid about ICMP & IGMP.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.