From: Michael Klinteberg <michael@klintan.cjb.net>
To: Kit Massengill <KitM@FirstEquipment.com>
Cc: netfilter@lists.netfilter.org
Subject: Re: How do I get rid of these broadcasts in my logs
Date: Mon, 26 Jan 2004 23:22:48 +0100 [thread overview]
Message-ID: <40159338.5010107@klintan.cjb.net> (raw)
In-Reply-To: <E8214FAA4482174EB648559A0AB63F75340F95@astro>
Kit Massengill wrote:
> Hi,
>
> I recently got a beautiful script from jlevie at experts-exchange that fixed
> my Linux router, but I need to now how to turn off the following broadcast
> loggings (eth1 is internal, obviously):
>
>
> <snip>
> Jan 23 09:35:21 ns1 kernel: Firewalled:IN=eth1 OUT=
> MAC=ff:ff:ff:ff:ff:ff:00:0d:88:52:15:15:08:00 SRC=192.168.1.111
> DST=192.168.1.255 LEN=249 TOS=0x00 PREC=0x00 TTL=128 ID=1732 PROTO=UDP
> SPT=138 DPT=138 LEN=229
> Jan 23 09:35:30 ns1 kernel: Firewalled:IN=eth1 OUT=
> MAC=ff:ff:ff:ff:ff:ff:00:50:8b:44:b0:3e:08:00 SRC=192.168.1.50
> DST=192.168.1.255 LEN=78 TOS=0x00 PREC=0x00 TTL=128 ID=50311 PROTO=UDP
> SPT=137 DPT=137 LEN=58
> Jan 23 09:35:35 ns1 kernel: Firewalled:IN=eth1 OUT=
> MAC=ff:ff:ff:ff:ff:ff:00:a0:c9:8d:8d:39:08:00 SRC=192.168.1.33
> DST=255.255.255.255 LEN=40 TOS=0x00 PREC=0x00 TTL=128 ID=50577 PROTO=UDP
> SPT=2301 DPT=2301 LEN=20
> Jan 23 09:35:36 ns1 kernel: Firewalled:IN=eth1 OUT=
> MAC=ff:ff:ff:ff:ff:ff:00:09:6b:1f:78:49:08:00 SRC=192.168.1.104
> DST=192.168.1.255 LEN=249 TOS=0x00 PREC=0x00 TTL=128 ID=38960 PROTO=UDP
> SPT=138 DPT=138 LEN=229
> Jan 23 09:35:53 ns1 kernel: Firewalled:IN=eth1 OUT=
> MAC=ff:ff:ff:ff:ff:ff:00:a0:c9:74:65:60:08:00 SRC=192.168.1.35
> DST=192.168.1.255 LEN=78 TOS=0x00 PREC=0x00 TTL=128 ID=35506 PROTO=UDP
> SPT=137 DPT=137 LEN=58
> Jan 23 09:35:53 ns1 kernel: Firewalled:IN=eth1 OUT=
> MAC=ff:ff:ff:ff:ff:ff:00:a0:c9:74:65:60:08:00 SRC=192.168.1.35
> DST=192.168.1.255 LEN=78 TOS=0x00 PREC=0x00 TTL=128 ID=37810 PROTO=UDP
> SPT=137 DPT=137 LEN=58
> <snip>
>
> Thanks,
> KitM
>
Take out some bits from the log and analyze it.
First one: IN=eth1, DST=192.168.0.255, PROTO=UDP, SPT=138, DPT=138
Next: IN=eth1, DST=192.168.0.255, PROTO=UDP, SPT=127, DPT=137
Next: IN=eth1, DST=255.255.255.255,PROTO=UDP,SPT=2301,DPT=2301
Next write the rules and drop them.
Remember that you have to insert them *before* the LOG rules.
iptables -A INPUT -i eth1 -d 192.168.0.255 -p UDP \
-m multiport --ports 137 -j DROP
iptables -A INPUT -i eth1 -d 192.168.0.255 -p UDP \
-m multiport --ports 138 -j DROP
#I'm not sure about this one, don't know what's it for
# iptables -A INPUT -i eth1 -d 255.255.255.255 -p UDP \
# -m multiport --ports 2301 -j DROP
Regards
Michael K
prev parent reply other threads:[~2004-01-26 22:22 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2004-01-26 20:25 How do I get rid of these broadcasts in my logs Kit Massengill
2004-01-26 22:22 ` Michael Klinteberg [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=40159338.5010107@klintan.cjb.net \
--to=michael@klintan.cjb.net \
--cc=KitM@FirstEquipment.com \
--cc=netfilter@lists.netfilter.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.