15

When I run dmesg this comes up every second or so:

[22661.447946] [UFW BLOCK] IN=eth0 OUT= MAC=ee:54:32:37:94:5f:f0:4b:3a:4f:80:30:08:00 SRC=35.162.106.154 DST=104.248.41.4 LEN=40 TOS=0x00 PREC=0x00 TTL=37 ID=52549 DF PROTO=TCP SPT=25 DPT=50616 WINDOW=0 RES=0x00 RST URGP=0

How can I trace what is causing this message?

  • 1
    It is the annoying ufw logging. You can turn it off. It is also possible to configure ufw to use a different log channel, thus it won't contaminate dmesg, but it is very tricky (might require even a little ufw patch). – peterh - Reinstate Monica Jul 26 '19 at 19:08
  • FWIW if you're unfamiliar with UFW, you should probably not have your system connected directly to the internet. – MooseBoys Jul 28 '19 at 4:16
56

The existing answer is correct in its technical analysis of the firewall log entry, but it's missing one point that makes the conclusion incorrect. The packet

  • Is a RST (reset) packet
  • from SRC=35.162.106.154
  • to your host at DST=104.248.41.4
  • via TCP
  • from his port SPT=25
  • to your port DPT=50616
  • and has been BLOCKed by UFW.

Port 25 (the source port) is commonly used for email. Port 50616 is in the ephemeral port range, meaning there's no consistent user for this port. A TCP "reset" packet can be sent in response to a number of unexpected situations, such as data arriving after a connection has been closed, or data being sent without first establishing a connection.

35.162.106.154 reverse-resolves to cxr.mx.a.cloudfilter.net, a domain used by the CloudMark email filtering service.

Your computer, or someone pretending to be your computer, is sending data to one of CloudMark's servers. The data is arriving unexpectedly, and the server is responding with a RST to ask the sending computer to stop. Given that the firewall is dropping the RST rather than passing it through to some application, the data that's causing the RST to be sent isn't coming from your computer. Instead, you're probably seeing backscatter from a denial-of-service attack, where the attacker is sending out floods of packets with forged "from" addresses in an attempt to knock CloudMark's mail servers offline (perhaps to make spamming more effective).

  • 3
    +1 for the great analysis! I had no idea... – PerlDuck Jul 26 '19 at 7:10
15

The messages stems from UFW, the "uncomplicated firewall" and it tells you that someone

  • from SRC=35.162.106.154
  • tried to connect to your host at DST=104.248.41.4
  • via TCP
  • from their port SPT=25
  • to your port DPT=50616
  • and that UFW has successfully BLOCKed that attempt.

According to this site the source address 35.162.106.154 is some Amazon machine (probably an AWS). According to this site the port 50616 may be used for Xsan Filesystem Access.

So it's an attempt from IP=35.162.106.154 to access your files. Quite normal and nothing to be really worried about because that's what firewalls are for: rejecting such attempts.

  • It seems the attempted connection is from an amazon account, port 25 is a mail port should I report this or just ignore it? Spamming my logs – peterretief Jul 25 '19 at 12:09
  • 6
    @peterretief you can block it at your router; then you won't see it. But it might be wise to report this to your ISP. – Rinzwind Jul 25 '19 at 12:11
  • 8
    Actually it says „RST“ not „SYN“ so it is a denied outgoing SMTP attempt packet which was filtered out. – eckes Jul 26 '19 at 7:40
  • 3
    The other answer seems more likely to be correct to me. – Barmar Jul 26 '19 at 16:21
  • 5
    @Barmar Indeed, and very kindly put. That one should be the accepted answer. – PerlDuck Jul 26 '19 at 16:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.