[kwlug-disc] Fw: Frightening dmesg.

[Jason Eckert]

I looked at the dmesg output, and long story short - there's nothing scary
happening here at all.

DST=224.0.0.1: These packets are the router announcing or managing
multicast groups (used for things like streaming, Chromecast, IPTV, etc.).
UFW is simply dropping them because you haven't allowed incoming IGMP.

SRC=192.168.68.51 (and 56), SPT=1900, DST=192.168.68.85: UDP source port
1900 is almost always SSDP/UPnP. Your computer is 85, and 51 and 56 are two
other devices (e.g., Chromecast) on your network that are performing
service discovery. UFW blocks the replies because your computer isn't
accepting unsolicited discovery packets.

192.168.68.56, SPT=47624/33446/50007: These are high-numbered ephemeral UDP
ports. The payload size (422 bytes) and timing strongly suggest another
local discovery protocol like mDNS/Bonjour. The destination port changes
because your computer had opened temporary UDP sockets, and these devices
were replying after discovering them. This is also very typical LAN chatter.

Hope this helps!
Cheers,
Jason.

On Mon, 3 Aug 2026 at 15:00, Khalid Baheyeldin <kb at 2bits.com> wrote:

> Assuming that ufw is configured correctly, and nothing nefarious is going
> on ...
>
> If one wants to suppress ufw logging, then this command takes care of it:
>
> sudo ufw logging off
>
>
> On Mon, Aug 3, 2026 at 2:18 PM Paul Nijjar via kwlug-disc <
> kwlug-disc at kwlug.org> wrote:
>
>>
>> Joe's attachment was too big for the list, so I uploaded it here:
>>
>> https://kwlug.org/sites/default/files/2026-08/joe-hacklog.txt
>>
>> I am guessing Joe is talking about the UFW blocks?
>>
>> It would probably be helpful to know what your UFW rules are, and what
>> IP address this device has. Is there something in particular you are
>> worried about?
>
> _______________________________________________
> kwlug-disc mailing list
> To unsubscribe, send an email to kwlug-disc-leave at kwlug.org
> with the subject "unsubscribe", or email
> kwlug-disc-owner at kwlug.org to contact a human being.
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.kwlug.org/pipermail/kwlug-disc_kwlug.org/attachments/20260804/cc2d56e4/attachment-0001.htm>