2

I'm using a router to connect to the internet at home. I used a long password with WPA2/AES, changed the SSID and changed the default password.

But strangely, even if I disconnect the router from the internet, I'm still getting UFW blocks (It's every minute, as I'm showing below)

Apr 12 10:59:59 nori-hidamari kernel: [  773.060910] [UFW BLOCK] IN=wlan0 OUT= MAC=fc:f8:ae:3d:f9:b9:3c:1e:04:7e:3d:32:08:00 SRC=192.168.0.1 DST=224.0.0.1 LEN=32 TOS=0x00 PREC=0x00 TTL=1 ID=19836 PROTO=2 
Apr 12 11:00:59 nori-hidamari kernel: [  833.031904] [UFW BLOCK] IN=wlan0 OUT= MAC=fc:f8:ae:3d:f9:b9:3c:1e:04:7e:3d:32:08:00 SRC=192.168.0.1 DST=224.0.0.1 LEN=32 TOS=0x00 PREC=0x00 TTL=1 ID=19838 PROTO=2 
Apr 12 11:01:59 nori-hidamari kernel: [  892.812248] [UFW BLOCK] IN=wlan0 OUT= MAC=fc:f8:ae:3d:f9:b9:3c:1e:04:7e:3d:32:08:00 SRC=192.168.0.1 DST=224.0.0.1 LEN=32 TOS=0x00 PREC=0x00 TTL=1 ID=19840 PROTO=2 
Apr 12 11:02:59 nori-hidamari kernel: [  952.666473] [UFW BLOCK] IN=wlan0 OUT= MAC=fc:f8:ae:3d:f9:b9:3c:1e:04:7e:3d:32:08:00 SRC=192.168.0.1 DST=224.0.0.1 LEN=32 TOS=0x00 PREC=0x00 TTL=1 ID=19842 PROTO=2 
Apr 12 11:03:59 nori-hidamari kernel: [ 1012.649716] [UFW BLOCK] IN=wlan0 OUT= MAC=fc:f8:ae:3d:f9:b9:3c:1e:04:7e:3d:32:08:00 SRC=192.168.0.1 DST=224.0.0.1 LEN=32 TOS=0x00 PREC=0x00 TTL=1 ID=19852 PROTO=2 
Apr 12 11:04:59 nori-hidamari kernel: [ 1072.520670] [UFW BLOCK] IN=wlan0 OUT= MAC=fc:f8:ae:3d:f9:b9:3c:1e:04:7e:3d:32:08:00 SRC=192.168.0.1 DST=224.0.0.1 LEN=32 TOS=0x00 PREC=0x00 TTL=1 ID=19854 PROTO=2 
Apr 12 11:05:59 nori-hidamari kernel: [ 1132.392421] [UFW BLOCK] IN=wlan0 OUT= MAC=fc:f8:ae:3d:f9:b9:3c:1e:04:7e:3d:32:08:00 SRC=192.168.0.1 DST=224.0.0.1 LEN=32 TOS=0x00 PREC=0x00 TTL=1 ID=19856 PROTO=2 
Apr 12 11:06:59 nori-hidamari kernel: [ 1192.248521] [UFW BLOCK] IN=wlan0 OUT= MAC=fc:f8:ae:3d:f9:b9:3c:1e:04:7e:3d:32:08:00 SRC=192.168.0.1 DST=224.0.0.1 LEN=32 TOS=0x00 PREC=0x00 TTL=1 ID=19910 PROTO=2 
Apr 12 11:07:59 nori-hidamari kernel: [ 1252.057452] [UFW BLOCK] IN=wlan0 OUT= MAC=fc:f8:ae:3d:f9:b9:3c:1e:04:7e:3d:32:08:00 SRC=192.168.0.1 DST=224.0.0.1 LEN=32 TOS=0x00 PREC=0x00 TTL=1 ID=20730 PROTO=2 
Apr 12 11:08:59 nori-hidamari kernel: [ 1312.009383] [UFW BLOCK] IN=wlan0 OUT= MAC=fc:f8:ae:3d:f9:b9:3c:1e:04:7e:3d:32:08:00 SRC=192.168.0.1 DST=224.0.0.1 LEN=32 TOS=0x00 PREC=0x00 TTL=1 ID=21310 PROTO=2 
Apr 12 11:09:59 nori-hidamari kernel: [ 1371.882191] [UFW BLOCK] IN=wlan0 OUT= MAC=fc:f8:ae:3d:f9:b9:3c:1e:04:7e:3d:32:08:00 SRC=192.168.0.1 DST=224.0.0.1 LEN=32 TOS=0x00 PREC=0x00 TTL=1 ID=21856 PROTO=2 
Apr 12 11:10:58 nori-hidamari kernel: [ 1431.752999] [UFW BLOCK] IN=wlan0 OUT= MAC=fc:f8:ae:3d:f9:b9:3c:1e:04:7e:3d:32:08:00 SRC=192.168.0.1 DST=224.0.0.1 LEN=32 TOS=0x00 PREC=0x00 TTL=1 ID=22388 PROTO=2 
Apr 12 11:11:58 nori-hidamari kernel: [ 1491.624027] [UFW BLOCK] IN=wlan0 OUT= MAC=fc:f8:ae:3d:f9:b9:3c:1e:04:7e:3d:32:08:00 SRC=192.168.0.1 DST=224.0.0.1 LEN=32 TOS=0x00 PREC=0x00 TTL=1 ID=22798 PROTO=2 
Apr 12 11:12:58 nori-hidamari kernel: [ 1551.442926] [UFW BLOCK] IN=wlan0 OUT= MAC=fc:f8:ae:3d:f9:b9:3c:1e:04:7e:3d:32:08:00 SRC=192.168.0.1 DST=224.0.0.1 LEN=32 TOS=0x00 PREC=0x00 TTL=1 ID=22838 PROTO=2 
Apr 12 11:13:58 nori-hidamari kernel: [ 1611.367003] [UFW BLOCK] IN=wlan0 OUT= MAC=fc:f8:ae:3d:f9:b9:3c:1e:04:7e:3d:32:08:00 SRC=192.168.0.1 DST=224.0.0.1 LEN=32 TOS=0x00 PREC=0x00 TTL=1 ID=22860 PROTO=2 
Apr 12 11:14:58 nori-hidamari kernel: [ 1671.238148] [UFW BLOCK] IN=wlan0 OUT= MAC=fc:f8:ae:3d:f9:b9:3c:1e:04:7e:3d:32:08:00 SRC=192.168.0.1 DST=224.0.0.1 LEN=32 TOS=0x00 PREC=0x00 TTL=1 ID=22862 PROTO=2

Ubuntu 14.04 is also updated. Is the problem from the router or from the OS? (I already checked that I'm the only person in the network, but still getting UFW blocks is really strange)

Thank you guys for helping me.

Improve this question
1
  • @bodhi.zazen I didn't understand much about the other thread, will continue to try to understand it.
    – Nori-chan
    Apr 12, 2015 at 18:10

1 Answer 1

Reset to default
3

Those packets are igmp packets from the router itself.

"The Internet Group Management Protocol (IGMP) is a communications protocol used by hosts and adjacent routers on IPv4 networks to establish multicast group memberships. IGMP is an integral part of IP multicast."

I do not use UFW, but in my iptables rule set I have a rule to drop those packets without logging, so as to avoid clutter in my log files.

Improve this answer
2
  • In other words, it's actually normal?
    – Nori-chan
    Apr 12, 2015 at 18:08
  • Yes, it is normal.
    – Doug Smythies
    Apr 12, 2015 at 18:12

Not the answer you're looking for? Browse other questions tagged .