Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

currently I have this non-stop output in system log:

[   89.115236] FW REJECT (input): IN=eth0 OUT= MAC=ff:ff:ff:ff:ff:ff:00:23:5e:6f:ab:d9:08:00 SRC=10.158.0.1 DST=255.255.255.255 LEN=389 TOS=0x00 PREC=0x00 TTL=255 ID=51601 PROTO=UDP SPT=67 DPT=68 LEN=369

Is this normal or is there somebody behind ASA in Alabama trying to sniff at mine eth0 ?

When I activate ipkungfu --panic then it disappears after a while, but when ipkungfu --panic is switched off, then it comes back ... ???

who is that ? how can I find out more ?

share|improve this question
    
Isn't 10.158.0.1 your router? –  Eric Carvalho Jun 8 '13 at 18:31
    
no it is not a router - it is address of ASA - leading to a supercomputer - would like to know, how to trace on from there ? –  dschinn1001 Jun 8 '13 at 19:57
add comment

1 Answer 1

From that syslog line I can tell you the host 10.158.0.1 (SRC=10.158.0.1) is broadcasting (DST=255.255.255.255) a UDP packet (PROTO=UDP) from port 67 (SPT=67) to port (DPT=68).

Port 67/UDP and 68/UDP are used by DHCP server client respectively.

This is the expected behavior if the ASA firewall is a DHCP server. That logged packet can be a DHCP Offer or a DHCP acknowledgement.

Reference: http://en.wikipedia.org/wiki/Dynamic_Host_Configuration_Protocol

share|improve this answer
    
is this normal, that system log is NOT scrolling perpetually ( should watching the traffic without pause ? ) at present system log is not scrolling ? when I do apt-get install --reinstall rsyslogd then it is scrolling again ? –  dschinn1001 Jun 9 '13 at 9:56
    
now I have this output today ? : cracklib: no dictionary update necessary. –  dschinn1001 Jun 9 '13 at 13:58
    
@dschinn1001 I think it's a regular auto-update of cracklib. Might the first time that you noticed. "On Debian systems, pam_cracklib's dictionaries live in /var/cache/cracklib and are rebuilt nightly by the /usr/sbin/update-cracklib script." Source deer-run.com/~hal/sysadmin/pam_cracklib.html –  knb Dec 8 '13 at 11:09
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.