<div dir="ltr">I looked at the dmesg output, and long story short - there's nothing scary happening here at all.<br><br>DST=<a href="http://224.0.0.1">224.0.0.1</a>: These packets are the router announcing or managing multicast groups (used for things like streaming, Chromecast, IPTV, etc.). UFW is simply dropping them because you haven't allowed incoming IGMP.<br><br>SRC=192.168.68.51 (and 56), SPT=1900, DST=<a href="http://192.168.68.85">192.168.68.85</a>: UDP source port 1900 is almost always SSDP/UPnP. Your computer is 85, and 51 and 56 are two other devices (e.g., Chromecast) on your network that are performing service discovery. UFW blocks the replies because your computer isn't accepting unsolicited discovery packets.<br><br>192.168.68.56, SPT=47624/33446/50007: These are high-numbered ephemeral UDP ports. The payload size (422 bytes) and timing strongly suggest another local discovery protocol like mDNS/Bonjour. The destination port changes because your computer had opened temporary UDP sockets, and these devices were replying after discovering them. This is also very typical LAN chatter.<br><br>Hope this helps!<br>Cheers,<div>Jason.</div></div><br><div class="gmail_quote gmail_quote_container"><div dir="ltr" class="gmail_attr">On Mon, 3 Aug 2026 at 15:00, Khalid Baheyeldin <<a href="mailto:kb@2bits.com">kb@2bits.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div dir="ltr"><div class="gmail_default" style="font-size:small">Assuming that ufw is configured correctly, and nothing nefarious is going on ...</div><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_default" style="font-size:small">If one wants to suppress ufw logging, then this command takes care of it:</div><div class="gmail_default" style="font-size:small"><pre><code>sudo ufw logging off</code></pre><br></div></div><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Mon, Aug 3, 2026 at 2:18\u202fPM Paul Nijjar via kwlug-disc <<a href="mailto:kwlug-disc@kwlug.org" target="_blank">kwlug-disc@kwlug.org</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><br>
Joe's attachment was too big for the list, so I uploaded it here: <br>
<br>
<a href="https://kwlug.org/sites/default/files/2026-08/joe-hacklog.txt" rel="noreferrer" target="_blank">https://kwlug.org/sites/default/files/2026-08/joe-hacklog.txt</a><br>
<br>
I am guessing Joe is talking about the UFW blocks? <br>
<br>
It would probably be helpful to know what your UFW rules are, and what<br>
IP address this device has. Is there something in particular you are<br>
worried about?</blockquote></div></div>
_______________________________________________<br>
kwlug-disc mailing list<br>
To unsubscribe, send an email to <a href="mailto:kwlug-disc-leave@kwlug.org" target="_blank">kwlug-disc-leave@kwlug.org</a><br>
with the subject "unsubscribe", or email<br>
<a href="mailto:kwlug-disc-owner@kwlug.org" target="_blank">kwlug-disc-owner@kwlug.org</a> to contact a human being.<br>
</blockquote></div>