Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

Here's an example log message:

May 25 10:36:07 myserver kernel: [7057243.392334] [UFW BLOCK] IN=eth0 OUT= MAC=00:02:55:67:82:eb:00:06:b1:3a:ef:62:08:00 SRC=69.197.128.26 DST=192.168.100.101 LEN=44 TOS=0x00 PREC=0x00 TTL=32 ID=0 PROTO=TCP SPT=48788 DPT=80 WINDOW=972 RES=0x00 RST URGP=0

My understanding is that DPT stands for "destination port", but since I have ufw configured to allow incoming connections on port 80, I'm puzzled as to why I'd be seeing such a log message -- a log message which seems to be indicating ufw blocked a connection attempt on that port.

The following are the relevant lines from ufw status:

To                         Action      From
--                         ------      ----
80/tcp                     ALLOW       Anywhere
80/tcp                     ALLOW       Anywhere (v6)

I've now seen this on both Ubuntu 11.10, and now (after upgrading the same machine) on Ubuntu 12.04.

share|improve this question
    
Two questions first: Why are you using Ubuntu 11.10, which is end-of-life (May 9, 2013)? Why do you want inbound connections on Port 80? This is exceptionally bad security practice. –  david6 May 26 '13 at 0:22
    
(1) I'm going to try upgrading to a more recent (hopefully latest) Ubunutu (but to answer your question, because it's a pain as I have to coordinate with our hosting provider). (2) How else does one run a web-server? Doesn't that require allowing clients to connect on port 80? –  Chris W. May 26 '13 at 15:56
    
I've upgraded to Ubuntu 12.04, the latest LTS release, but still seeing the mystery log messages unfortunately... –  Chris W. May 28 '13 at 16:15
    
I'm also seeing this on 12.10. Interestingly I'm seeing it block addresses from Google's crawlers. –  Caffeine Coma Jun 9 '13 at 16:19
add comment

2 Answers

up vote 1 down vote accepted

The thread referenced by Caffeine Coma indicates this is related to low-level technicalities in closing TCP network connections... Obscure and subtle differences between the way operating systems (Windows, Mac, Linux) handle connection termination apparently result in some harmless confusion between server and client, and this somehow results in the above-described log messages.

I don't entirely understand the technicalities, nor why this would lead to UFW "BLOCK" log messages, but I'll take it, as it's the only answer I've come across that makes any sense, and I've seen no other symptom of something being wrong on my server -- only these harmless (albeit annoying) UFW log messages.

Refer to the mentioned forum thread for a more technical explanation.

share|improve this answer
add comment

I'm curious about this too, as I'm getting similar log entries even from Googlebot servers.

This thread seems to say that it's nothing to worry about, but it seems very odd to me to have these register as a BLOCK in UFW.

share|improve this answer
    
Thanks for the link, CC. I don't fully understand it, but it seems to explain the log messages I'm seeing. –  Chris W. Jun 16 '13 at 18:30
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.