Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

Continually getting message in logs:

IPTables Packet Dropped: IN=eth1 OUT= MAC=c4:17:fe:65:51:f8:20:76:00:aa:98:78:08:00 
SRC=199.47.216.148 DST=192.168.1.102 LEN=218 TOS=0x00 PREC=0x00 TTL=54 ID=52253 DF  #
PROTO=TCP SPT=80 DPT=60684 WINDOW=31 RES=0x00 ACK PSH URGP=0 

I did a whois and know that the source IP 199.47.216.148 has something to do with Dropbox, which I do have installed, but why is it continually trying to connect to me on my 60684 port and clogging up the logs? Dropbox is otherwise working completely fine. It has established connections like

dropbox   2409          myuser   17u  IPv4 220578      0t0  TCP     127.0.0.1:37255->127.0.0.1:8080 (CLOSE_WAIT)
dropbox   2409          myuser   23u  IPv4 221364      0t0  TCP     127.0.0.1:37273->127.0.0.1:80y80 (CLOSE_WAIT)
dropbox   2409          muser   26u  IPv4 221496      0t0  TCP 127.0.0.1:37279->127.0.0.1:8080 (ESTABLISHED)
dropbox   2409          myuser   27u  IPv4 216008      0t0  TCP 127.0.0.1:37261->127.0.0.1:8080 (CLOSE_WAIT)

(I should perhaps mention that I have privoxy and dansguardian installed too, so only privoxy is allowed http, https outbound to port 80, and only dansguardian is allowed local outbound to privoxy which listens on 8118, and firefox is then forced to connect to dansguardian on 127.0.0.1:8080. This means Dropbox connects through a "proxy" of 127.0.0.1:8080 too, just like firefox does. Not sure this has any relevance but just incase. Pretty much all other standard outbound is allowed. )

My iptables rules for reference are set to drop and log all inbound connections unless tracked by

iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

As I say the strange thing is that Dropbox appears to otherwise work fine, so whatever it wants with this inbound connection must be pretty minor, but it is annoying to continually see it in the logs.

share|improve this question
add comment

1 Answer

The reason you're seeing this is because only root can open ports below 1024 so any application that wants an outgoing connection will open a port higher than that.

You can open ports between 1025 and 65335 inclusively as a non-root user.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.