Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I'm sometimes getting a lot of these AUDIT log entries in

...

[UFW AUDIT] IN= OUT=eth0 SRC=176.58.105.134 DST=194.238.48.2 LEN=76 TOS=0x10 PREC=0x00 TTL=64 ID=32137 DF PROTO=UDP SPT=36231 DPT=123 LEN=56
[UFW ALLOW] IN= OUT=eth0 SRC=176.58.105.134 DST=194.238.48.2 LEN=76 TOS=0x10 PREC=0x00 TTL=64 ID=32137 DF PROTO=UDP SPT=36231 DPT=123 LEN=56
[UFW AUDIT] IN= OUT=lo SRC=192.168.192.254 DST=192.168.192.254 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=54579 DF PROTO=TCP SPT=59488 DPT=30002 WINDOW=32792 RES=0x00 SYN URGP=0
[UFW AUDIT] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.192.254 DST=192.168.192.254 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=54579 DF PROTO=TCP SPT=59488 DPT=30002 WINDOW=32792 RES=0x00 SYN URGP=0
[UFW AUDIT] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=192.168.192.254 DST=192.168.192.254 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=4319 DF PROTO=TCP SPT=59489 DPT=30002 WINDOW=32792 RES=0x00 SYN URGP=0

...

What is the meaning of this? When do they occur and why? Should and can I disable these specific entries? I do not wish to disable UFW logging, but I'm not sure whether these lines are useful at all.

Note that this does not actually occur in /var/log/ufw.log. It only occurs in /var/log/syslog. Why is this the case?

More info

  • my logging is set to medium: Logging: on (medium)
share|improve this question

2 Answers 2

up vote 1 down vote accepted

Set your logging to low to remove the AUDIT messages.

The purpose of AUDIT (from what I'm seeing) is related to the non-default/recommended logging - however, that's a guess, and I can't seem to find anything concrete with that.

share|improve this answer

That depend on the line. Usually, it is Field=value.

There is IN, OUT, the ingoing interface, or outgoing ( or both, for packet that are just relayed.

There is TOS, for Type of service,
DST is destination ip,
SRC is source ip
TTL is time to live, a small counter decremented each time a packet is passed through another router ( so if there is a loop, the package destroy itself once to 0 )
DF is "don't fragment" bit, asking to packet to not be fragmented when sent

PROTO is the protocol ( UDP? TCP mostly ) SPT is the source port DPT is the destination port

etc.

You should take a look at TCP/UDP/IP documentation, where everything is explained in more detailed way that i could ever do.

Let's take the first one, that mean that 176.58.105.134 sent a UDP packet on port 123 for 194.238.48.2 . That's for ntp. So i guess someone try to use your computer as a ntp server, likely by error.

For the other line, that's curious, that's traffic on loopback interface ( lo ), ie that's not going anywhere, it goes and comes from your computer. I would check if something is listening on tcp port 30002 with lsof or netstat.

share|improve this answer
    
Thank you. Port 30002 is a mongodb arbiter running. I don't know anything about ntp though, should I be worried? –  Tom May 28 '12 at 18:22
    
No. NTP is just to set time, you likely already used without knowing ( when you check "use network to sync time" in gnome, it use ntp ). It just sync time across a network. Maybe the ip was part of the global pool of ntp network ( pool.ntp.org/fr ), hence the request from someone on the internet ? –  Misc May 28 '12 at 18:25

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.