8

Here's an example log message:

May 25 10:36:07 myserver kernel: [7057243.392334] [UFW BLOCK] IN=eth0 OUT= MAC=00:02:55:67:82:eb:00:06:b1:3a:ef:62:08:00 SRC=69.197.128.26 DST=192.168.100.101 LEN=44 TOS=0x00 PREC=0x00 TTL=32 ID=0 PROTO=TCP SPT=48788 DPT=80 WINDOW=972 RES=0x00 RST URGP=0

My understanding is that DPT stands for "destination port", but since I have ufw configured to allow incoming connections on port 80, I'm puzzled as to why I'd be seeing such a log message -- a log message which seems to be indicating ufw blocked a connection attempt on that port.

The following are the relevant lines from ufw status:

To                         Action      From
--                         ------      ----
80/tcp                     ALLOW       Anywhere
80/tcp                     ALLOW       Anywhere (v6)

I've now seen this on both Ubuntu 11.10, and now (after upgrading the same machine) on Ubuntu 12.04.

Improve this question
4
  • Two questions first: Why are you using Ubuntu 11.10, which is end-of-life (May 9, 2013)? Why do you want inbound connections on Port 80? This is exceptionally bad security practice.
    – david6
    May 26, 2013 at 0:22
  • 5
    (1) I'm going to try upgrading to a more recent (hopefully latest) Ubunutu (but to answer your question, because it's a pain as I have to coordinate with our hosting provider). (2) How else does one run a web-server? Doesn't that require allowing clients to connect on port 80?
    – Chris W.
    May 26, 2013 at 15:56
  • I've upgraded to Ubuntu 12.04, the latest LTS release, but still seeing the mystery log messages unfortunately...
    – Chris W.
    May 28, 2013 at 16:15
  • I'm also seeing this on 12.10. Interestingly I'm seeing it block addresses from Google's crawlers.
    – Caffeine Coma
    Jun 9, 2013 at 16:19

3 Answers 3

Reset to default
7

The thread referenced by Caffeine Coma indicates this is related to low-level technicalities in closing TCP network connections... Obscure and subtle differences between the way operating systems (Windows, Mac, Linux) handle connection termination apparently result in some harmless confusion between server and client, and this somehow results in the above-described log messages.

I don't entirely understand the technicalities, nor why this would lead to UFW "BLOCK" log messages, but I'll take it, as it's the only answer I've come across that makes any sense, and I've seen no other symptom of something being wrong on my server -- only these harmless (albeit annoying) UFW log messages.

Refer to the mentioned forum thread for a more technical explanation.

Improve this answer
2

I can explain it a bit in detail, without getting technical.

I'll just use a simile.

Just imaging two people talking to each other and let's asume that they do business with each other and furthermore that they agree to conduct their business in a certain way.

Every time they have a transaction, it is done the same way.

  1. Meet and Greet - they agree that a transaction is only successful if they sit in the same room and shake hands, at the beginning. It's a mandatory step.

  2. Listening and Re"send" - They agree that a transaction is only successful, if all the data necessary to this transaction is understood and if one side doesn't get a proper response, they reevalute the status and "retalk" about certain aspects of this transaction, until both sides are satisfied with the result and agree that the transaction is in order.

This includes

  1. a) The confirmation in form of a handshake at the beginning of every meetup and b) A final confirmation at the end from both sides. Also the seller has to remain in the room for a certain time until he is sure the buyer has left satsified.

The TCP connections work in a similar way. Is there soemthing wrong then the firewall tells you about this.

Could be a fake buyer, who just says hello and then leaves again (probe) Could be a real buyer, which isn't so certain anymore in the middle of things and leaves the room (user) Could be a communications problem (routing, network, etc.)

HTH, s1mmel

Improve this answer
0

I'm curious about this too, as I'm getting similar log entries even from Googlebot servers.

This thread seems to say that it's nothing to worry about, but it seems very odd to me to have these register as a BLOCK in UFW.

Improve this answer
1
  • Thanks for the link, CC. I don't fully understand it, but it seems to explain the log messages I'm seeing.
    – Chris W.
    Jun 16, 2013 at 18:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .