When I run dmesg this comes up every second or so:

[22661.447946] [UFW BLOCK] IN=eth0 OUT= MAC=ee:54:32:37:94:5f:f0:4b:3a:4f:80:30:08:00 SRC= DST= LEN=40 TOS=0x00 PREC=0x00 TTL=37 ID=52549 DF PROTO=TCP SPT=25 DPT=50616 WINDOW=0 RES=0x00 RST URGP=0

How can I trace what is causing this message?

  • 1
    It is the annoying ufw logging. You can turn it off. It is also possible to configure ufw to use a different log channel, thus it won't contaminate dmesg, but it is very tricky (might require even a little ufw patch).
    – peterh
    Jul 26, 2019 at 19:08
  • FWIW if you're unfamiliar with UFW, you should probably not have your system connected directly to the internet.
    – MooseBoys
    Jul 28, 2019 at 4:16

2 Answers 2


The existing answer is correct in its technical analysis of the firewall log entry, but it's missing one point that makes the conclusion incorrect. The packet

  • Is a RST (reset) packet
  • from SRC=
  • to your host at DST=
  • via TCP
  • from his port SPT=25
  • to your port DPT=50616
  • and has been BLOCKed by UFW.

Port 25 (the source port) is commonly used for email. Port 50616 is in the ephemeral port range, meaning there's no consistent user for this port. A TCP "reset" packet can be sent in response to a number of unexpected situations, such as data arriving after a connection has been closed, or data being sent without first establishing a connection. reverse-resolves to cxr.mx.a.cloudfilter.net, a domain used by the CloudMark email filtering service.

Your computer, or someone pretending to be your computer, is sending data to one of CloudMark's servers. The data is arriving unexpectedly, and the server is responding with a RST to ask the sending computer to stop. Given that the firewall is dropping the RST rather than passing it through to some application, the data that's causing the RST to be sent isn't coming from your computer. Instead, you're probably seeing backscatter from a denial-of-service attack, where the attacker is sending out floods of packets with forged "from" addresses in an attempt to knock CloudMark's mail servers offline (perhaps to make spamming more effective).

  • 3
    +1 for the great analysis! I had no idea...
    – PerlDuck
    Jul 26, 2019 at 7:10

The messages stems from UFW, the "uncomplicated firewall" and it tells you that someone

  • from SRC=
  • tried to connect to your host at DST=
  • via TCP
  • from their port SPT=25
  • to your port DPT=50616
  • and that UFW has successfully BLOCKed that attempt.

According to this site the source address is some Amazon machine (probably an AWS). According to this site the port 50616 may be used for Xsan Filesystem Access.

So it's an attempt from IP= to access your files. Quite normal and nothing to be really worried about because that's what firewalls are for: rejecting such attempts.

  • It seems the attempted connection is from an amazon account, port 25 is a mail port should I report this or just ignore it? Spamming my logs Jul 25, 2019 at 12:09
  • 6
    @peterretief you can block it at your router; then you won't see it. But it might be wise to report this to your ISP.
    – Rinzwind
    Jul 25, 2019 at 12:11
  • 8
    Actually it says „RST“ not „SYN“ so it is a denied outgoing SMTP attempt packet which was filtered out.
    – eckes
    Jul 26, 2019 at 7:40
  • 3
    The other answer seems more likely to be correct to me.
    – Barmar
    Jul 26, 2019 at 16:21
  • 5
    @Barmar Indeed, and very kindly put. That one should be the accepted answer.
    – PerlDuck
    Jul 26, 2019 at 16:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .