Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I have the following UFW Block entry. How do I get the source MAC? I'm getting a ton from the same MAC=e8:11:32:cb:d9:42:54:04:a6:ba:22:f8:08:00 doing port scanning. If it matters, I'm using 12.04 LTS.

Feb  4 17:46:06 ChromeBox-Server kernel: [663960.096168] [UFW BLOCK] IN=eth0 OUT= MAC=e8:11:32:cb:d9:42:54:04:a6:ba:22:f8:08:00 SRC=123.129.216.39 DST=192.168.1.10 LEN=48 TOS=0x00 PREC=0x20 TTL=115 ID=49547 PROTO=TCP SPT=1535 DPT=22 WINDOW=65535 RES=0x00 SYN URGP=0
share|improve this question

2 Answers 2

up vote 0 down vote accepted

MAC=e8:11:32:cb:d9:42:54:04:a6:ba:22:f8:08:00 can be broken up as

  • destination MAC (in this case this is the MAC address of your card, since it is an incoming packet): e8:11:32:cb:d9:42

  • source MAC: 54:04:a6:ba:22:f8

  • EtherType: 08:00

So if you want to programmatically extract the source MAC you can do something like this:

cat ufw.log | awk '{print $11}' | cut -d ':' -f7-12
share|improve this answer
    
This makes sense. Now to block that source MAC. –  user244712 Feb 6 at 3:50
    
@user244712 That question was asked and answered here: askubuntu.com/questions/410023/… –  falconer Feb 6 at 12:29
    
Haven't seen any log activity since I blocked that MAC. I used: iptables -I INPUT -p udp -m mac --mac-source 54:04:a6:ba:22:f8 -j REJECT –  user244712 Feb 7 at 5:16
    
And iptables -I INPUT -p tcp -m mac --mac-source 54:04:a6:ba:22:f8 -j REJECT –  user244712 Feb 7 at 5:17
    
What's the difference in REJECT or DROP? Answer: REJECT sends a response. DROP just doesn't respond at all forcing a timeout. –  user244712 Feb 7 at 5:17

It looks like your network settings may be using IPv6, as MAC=e8:11:32:cb:d9:42:54:04:a6:ba:22:f8:08:00 is an IPv6 address, probably that of your current network connection. A true MAC (Media Access Control) address would only be six groups of hex digits: aa:bb:11:12:34:56.

The teller in this is the DPT=22. They are trying to find open SSH ports. This is fine if you don't have port 22 open (which I generally don't recommend). If you do have/need port 22 open, I hope your username/password combo is robust. You might also want to check out something like Fail2Ban which will impose temporary blocks after a number of failed login attempts, including SSH logins.

If you're constantly getting port-scanned by the same IP - SRC=123.129.216.39 - set up a DENY or DROP rule in UFW for that IP. sudo ufw deny from 123.129.216.39

share|improve this answer
    
I already have Fail2Ban up and running. No, SSH isn't on port 22. This is just one of numerous open port attempts. All on standard ports. It's probably a script kiddie since they haven't bothered to spoof the MAC because the MACs are all the same. –  user244712 Feb 6 at 3:13
    
Is the source IP rotating? Just curious. I was getting hit hard for a few days with attempts on my SMTP server from a group of IPs. +1 for Fail2Ban - nice to have that watching your back. –  douggro Feb 6 at 6:37
    
Yep. IP was bouncing around but the MAC was the same. Haven't had any log activity since I blocked that MAC. –  user244712 Feb 7 at 5:13

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.