1

Yesterday I opened a port on the router, forwarded to LAN IP 192.168.1.201 and blocked the ADSL company password to access the router.

There is no other open port on the router. This log is from the 192.168.1.201 machine.

I can't figure out what do these connections mean. (It doesn't seem to be going to end...)

Any idea?

Apr  9 09:52:08 noname-machine kernel: [31307.968106] [UFW BLOCK] IN=eth0 OUT= MAC=01:00:5e:00:00:01:38:72:c0:ce:53:73:08:00 SRC=192.168.1.1 DST=224.0.0.1 LEN=32 TOS=0x00 PREC=0x00 TTL=1 ID=0 DF PROTO=2 
Apr  9 09:52:24 noname-machine kernel: [31323.693457] [UFW BLOCK] IN=eth0 OUT= MAC=01:00:5e:00:00:fb:18:9e:fc:26:eb:19:08:00 SRC=192.168.1.34 DST=224.0.0.251 LEN=32 TOS=0x00 PREC=0x00 TTL=1 ID=58339 PROTO=2 
Apr  9 09:52:53 noname-machine kernel: [31352.982810] [UFW BLOCK] IN=eth0 OUT= MAC=01:00:5e:00:00:01:38:72:c0:ce:53:73:08:00 SRC=192.168.1.1 DST=224.0.0.1 LEN=32 TOS=0x00 PREC=0x00 TTL=1 ID=0 DF PROTO=2 
Apr  9 09:53:08 noname-machine kernel: [31367.987774] [UFW BLOCK] IN=eth0 OUT= MAC=01:00:5e:00:00:01:38:72:c0:ce:53:73:08:00 SRC=192.168.1.1 DST=224.0.0.1 LEN=32 TOS=0x00 PREC=0x00 TTL=1 ID=0 DF PROTO=2 
Apr  9 09:53:24 noname-machine kernel: [31383.769407] [UFW BLOCK] IN=eth0 OUT= MAC=01:00:5e:00:00:fb:18:9e:fc:26:eb:19:08:00 SRC=192.168.1.34 DST=224.0.0.251 LEN=32 TOS=0x00 PREC=0x00 TTL=1 ID=52153 PROTO=2 
Apr  9 09:53:53 noname-machine kernel: [31412.982860] [UFW BLOCK] IN=eth0 OUT= MAC=01:00:5e:00:00:01:38:72:c0:ce:53:73:08:00 SRC=192.168.1.1 DST=224.0.0.1 LEN=32 TOS=0x00 PREC=0x00 TTL=1 ID=0 DF PROTO=2 
Apr  9 09:54:08 noname-machine kernel: [31427.982756] [UFW BLOCK] IN=eth0 OUT= MAC=01:00:5e:00:00:01:38:72:c0:ce:53:73:08:00 SRC=192.168.1.1 DST=224.0.0.1 LEN=32 TOS=0x00 PREC=0x00 TTL=1 ID=0 DF PROTO=2 
Apr  9 09:54:24 noname-machine kernel: [31443.219560] [UFW BLOCK] IN=eth0 OUT= MAC=01:00:5e:00:00:fb:70:f1:a1:05:07:5c:08:00 SRC=169.254.132.219 DST=224.0.0.251 LEN=32 TOS=0x00 PREC=0x00 TTL=1 ID=106 PROTO=2 
Apr  9 09:54:53 noname-machine kernel: [31472.972692] [UFW BLOCK] IN=eth0 OUT= MAC=01:00:5e:00:00:01:38:72:c0:ce:53:73:08:00 SRC=192.168.1.1 DST=224.0.0.1 LEN=32 TOS=0x00 PREC=0x00 TTL=1 ID=0 DF PROTO=2 
Apr  9 09:55:08 noname-machine kernel: [31487.977674] [UFW BLOCK] IN=eth0 OUT= MAC=01:00:5e:00:00:01:38:72:c0:ce:53:73:08:00 SRC=192.168.1.1 DST=224.0.0.1 LEN=32 TOS=0x00 PREC=0x00 TTL=1 ID=0 DF PROTO=2 
Apr  9 09:55:24 noname-machine kernel: [31503.231641] [UFW BLOCK] IN=eth0 OUT= MAC=01:00:5e:00:00:fb:70:f1:a1:05:07:5c:08:00 SRC=169.254.132.219 DST=224.0.0.251 LEN=32 TOS=0x00 PREC=0x00 TTL=1 ID=142 PROTO=2 
Apr  9 09:55:53 noname-machine kernel: [31532.982790] [UFW BLOCK] IN=eth0 OUT= MAC=01:00:5e:00:00:01:38:72:c0:ce:53:73:08:00 SRC=192.168.1.1 DST=224.0.0.1 LEN=32 TOS=0x00 PREC=0x00 TTL=1 ID=0 DF PROTO=2 
Apr  9 09:56:08 noname-machine kernel: [31547.982624] [UFW BLOCK] IN=eth0 OUT= MAC=01:00:5e:00:00:01:38:72:c0:ce:53:73:08:00 SRC=192.168.1.1 DST=224.0.0.1 LEN=32 TOS=0x00 PREC=0x00 TTL=1 ID=0 DF PROTO=2 
Apr  9 09:56:24 noname-machine kernel: [31563.228754] [UFW BLOCK] IN=eth0 OUT= MAC=01:00:5e:00:00:fb:70:f1:a1:05:07:5c:08:00 SRC=169.254.132.219 DST=224.0.0.251 LEN=32 TOS=0x00 PREC=0x00 TTL=1 ID=217 PROTO=2 
Apr  9 09:56:53 noname-machine kernel: [31592.987662] [UFW BLOCK] IN=eth0 OUT= MAC=01:00:5e:00:00:01:38:72:c0:ce:53:73:08:00 SRC=192.168.1.1 DST=224.0.0.1 LEN=32 TOS=0x00 PREC=0x00 TTL=1 ID=0 DF PROTO=2 
Apr  9 09:57:08 noname-machine kernel: [31607.968135] [UFW BLOCK] IN=eth0 OUT= MAC=01:00:5e:00:00:01:38:72:c0:ce:53:73:08:00 SRC=192.168.1.1 DST=224.0.0.1 LEN=32 TOS=0x00 PREC=0x00 TTL=1 ID=0 DF PROTO=2 
Apr  9 09:57:24 noname-machine kernel: [31623.225584] [UFW BLOCK] IN=eth0 OUT= MAC=01:00:5e:00:00:fb:70:f1:a1:05:07:5c:08:00 SRC=169.254.132.219 DST=224.0.0.251 LEN=32 TOS=0x00 PREC=0x00 TTL=1 ID=277 PROTO=2 
Apr  9 09:57:53 noname-machine kernel: [31652.972559] [UFW BLOCK] IN=eth0 OUT= MAC=01:00:5e:00:00:01:38:72:c0:ce:53:73:08:00 SRC=192.168.1.1 DST=224.0.0.1 LEN=32 TOS=0x00 PREC=0x00 TTL=1 ID=0 DF PROTO=2 
Apr  9 09:58:08 noname-machine kernel: [31667.977532] [UFW BLOCK] IN=eth0 OUT= MAC=01:00:5e:00:00:01:38:72:c0:ce:53:73:08:00 SRC=192.168.1.1 DST=224.0.0.1 LEN=32 TOS=0x00 PREC=0x00 TTL=1 ID=0 DF PROTO=2 
Apr  9 09:58:24 noname-machine kernel: [31683.222757] [UFW BLOCK] IN=eth0 OUT= MAC=01:00:5e:00:00:fb:70:f1:a1:05:07:5c:08:00 SRC=169.254.132.219 DST=224.0.0.251 LEN=32 TOS=0x00 PREC=0x00 TTL=1 ID=315 PROTO=2 
Apr  9 09:58:53 noname-machine kernel: [31712.967765] [UFW BLOCK] IN=eth0 OUT= MAC=01:00:5e:00:00:01:38:72:c0:ce:53:73:08:00 SRC=192.168.1.1 DST=224.0.0.1 LEN=32 TOS=0x00 PREC=0x00 TTL=1 ID=0 DF PROTO=2 
2
  • You might get into a bit more detail here, since nobody knows how exactly your router works (this starts e.g. with »Which interface is eth0?«). Apr 9, 2014 at 8:39
  • You are right. eth0 is the unique interface on the machine wich is logging it. Anyway, i admit I was too worried about it because it's my machine, but not my LAN, so I was beginning to worry about it, but I'm seeing it must be something regarding to Itunes on another machine. I appreciate your comment :) (excuse my english) Apr 9, 2014 at 9:41

3 Answers 3

6

It seems a service on hosts 192.168.1.1 and 192.168.1.34 are trying to send out multicast packets (224.0.0.1 is the address on which all multicast-enabled hosts subscribe). Unfortunately your log doesn't include port numbers, so you can't be sure which service it is, but usually these are 'autodiscover' services.

2
  • Right; almost identical to: stackoverflow.com/questions/12483717/… I've been searching in more detail and it seems to be something regarding to Itunes or similar software wich may be running on 192.168.0.36 almost for sure. Since it's not my computer the one which is making so much "noise" on the LAN and since this noise seems to be harmless, I don't need more detail on what exactly it is. Thanks! Apr 9, 2014 at 9:41
  • BTW: To avoid log files to became huge with this issue, I've solved it on Debian adding this rule to the firewall: sudo ufw deny from 192.168.1.1 to 224.0.0.1 To ignore them. Apr 9, 2014 at 9:51
2
SRC=192.168.1.1 DST=224.0.0.1 LEN=32 TOS=0x00 PREC=0x00 TTL=1 ID=0 DF PROTO=2

SRC=192.168.1.1 - looks like a NAT router address (the other common one being 192.168.1.254)

DST=224.0.0.1 - IP multicast 'all hosts' address

PROTO=2 - IGMP - Internet Group Management Protocol

So this is mostly likely an IGMP Query packet sent by your local router to all devices on the subnet so it can update / refresh IP multicast group memberships. You need to dump the packet contents to be sure.

SRC=169.254.132.219 DST=224.0.0.251 LEN=32 TOS=0x00 PREC=0x00 TTL=1 ID=142 PROTO=2

DST=224.0.0.251

PROTO=2 - IGMP - Internet Group Management Protocol

There is a device on the network trying to use Multicast DNS (which is usually associated with address 224.0.0.251). However, since the protocol is again IGMP, this is again a query/discovery packet but specifically for mDNS.

2

Don't automatically dump it.

This multicast can have effect on displaying SMB shares. The shares are there, they just might not display on other machines. If the machine that blocks these multicasts is acting as an old type master browser in a non-DC (or AD) controlled network (like a home network), it can take down the SMB listings for anywhere from one to all of the computers involved.

To reiterate: the shares are always there, but blocking these mulicasts can prevent them from automatically displaying when clicking on a network browser in Windows or Linux.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .