0

When using iftop on my wlan0 interface, there are a few link-local addresses connecting.

How and where can I filter these connections?

I have very specific UFW rules blocking 169.254.0.0/16, but I am not seeing any "UFW BLOCK" in my kernel/syslog.

The strange thing is that there isn't even a UFW AUDIT or UFW ALLOW for these connections, but they sure do show up in iftop.

This scares me that I have ufw specifically configured block these addresses, and yet iftop shows them connecting, and there's nothing in the log about them at all. Could this be a telepathy exploit?

1 Answer 1

0

You may be mis-reading what iftop is telling you. When you run iftop, it puts the interface in promiscuous mode and thus will receive every packet visible on the wire, regardless of where those packets are addressed, particularly broadcast packets.

The 169.254.. packets are being transmitted by any devices on the same network which failed to get a DHCP response and ended up using the self-assigned IP range instead. Generally these packets are un-routable anyway.

UFW/IPTables is only going to log blocking a packet when that packet was specifically addressed for that specific host and then rejected by UFW. There is likely a rule in your table that either discards or accepts broadcast traffic without logging about it.

If you launch iftop with the -F cidr options, you can get it to ignore the broadcast packets and focus the display on just the traffic to/from your host, for example:

iftop -F 192.168.1.10/32

Packets with that one IP address (192.168.1.10) in either the dst or src field will get displayed, the others will be silently filtered out of the display.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .