[kwlug-disc] Fw: Frightening dmesg.

[D. Hugh Redelmeier]

I'm not a networking expert, but here are some observations to help you 
get started.

It appears that all the interesting action was from Aug 3 13:05 on.
That's all UFW BLOCK messages

PROTO=2 means IGMP messages (see /etc/protocols).  Probably not 
interesting.

The rest of the rejected traffic is UDP.  To understand what that's about, 
you have to look at the source port (SPT) (for a request) or the 
destination port (DPT) (for a response).  See /etc/services.
1900 is for Simple Service Discovery Protocol.  The rest are not Well 
Known Ports.

Several IPv4 addresses appear.
192.168.68.1
192.168.68.51
192.168.68.56
192.168.68.85
What are they?

You would probably be better off using tcpdump to capture the whole 
traffic, not just the rejected packets.

Are you actually observing problems talking to the ESP32 or is this just 
scary noise?

> From: Paul Nijjar via kwlug-disc <kwlug-disc at kwlug.org>
> To: kwlug-disc at kwlug.org
> Cc: Paul Nijjar <paul_nijjar at yahoo.ca>
> Date: Mon, 3 Aug 2026 14:17:22 -0400
> Subject: [kwlug-disc] Fw: Frightening dmesg.
> 
> 
> Joe's attachment was too big for the list, so I uploaded it here: 
> 
> https://kwlug.org/sites/default/files/2026-08/joe-hacklog.txt
> 
> I am guessing Joe is talking about the UFW blocks? 
> 
> It would probably be helpful to know what your UFW rules are, and what
> IP address this device has. Is there something in particular you are
> worried about?
> 
> - Paul
> 
> ----- Forwarded message from Joe Wennechuk <youcanreachmehere at hotmail.com> -----
> 
> Date: Mon, 3 Aug 2026 17:35:10 +0000
> From: Joe Wennechuk <youcanreachmehere at hotmail.com>
> To: "kwlug-disc at kwlug.org" <kwlug-disc at kwlug.org>
> Subject: Frightening dmesg.
> 
> I just received an esp32 and fired up dmesg before I was about to plug it in and the output looks frightening. Can anyone help me understand this?
> 
> 
> 
> 
> ----- End forwarded message -----
> 
> _______________________________________________
> kwlug-disc mailing list
> To unsubscribe, send an email to kwlug-disc-leave at kwlug.org
> with the subject "unsubscribe", or email
> kwlug-disc-owner at kwlug.org to contact a human being.
>