currently I have this non-stop output in system log:

[   89.115236] FW REJECT (input): IN=eth0 OUT= MAC=ff:ff:ff:ff:ff:ff:00:23:5e:6f:ab:d9:08:00 SRC= DST= LEN=389 TOS=0x00 PREC=0x00 TTL=255 ID=51601 PROTO=UDP SPT=67 DPT=68 LEN=369

Is this normal or is there somebody behind ASA in Alabama trying to sniff at mine eth0 ?

When I activate ipkungfu --panic then it disappears after a while, but when ipkungfu --panic is switched off, then it comes back ... ???

who is that ? how can I find out more ?

  • Isn't your router? – Eric Carvalho Jun 8 '13 at 18:31
  • no it is not a router - it is address of ASA - leading to a supercomputer - would like to know, how to trace on from there ? – dschinn1001 Jun 8 '13 at 19:57

From that syslog line I can tell you the host (SRC= is broadcasting (DST= a UDP packet (PROTO=UDP) from port 67 (SPT=67) to port (DPT=68).

Port 67/UDP and 68/UDP are used by DHCP server client respectively.

This is the expected behavior if the ASA firewall is a DHCP server. That logged packet can be a DHCP Offer or a DHCP acknowledgement.

Reference: http://en.wikipedia.org/wiki/Dynamic_Host_Configuration_Protocol

  • is this normal, that system log is NOT scrolling perpetually ( should watching the traffic without pause ? ) at present system log is not scrolling ? when I do apt-get install --reinstall rsyslogd then it is scrolling again ? – dschinn1001 Jun 9 '13 at 9:56
  • now I have this output today ? : cracklib: no dictionary update necessary. – dschinn1001 Jun 9 '13 at 13:58
  • @dschinn1001 I think it's a regular auto-update of cracklib. Might the first time that you noticed. "On Debian systems, pam_cracklib's dictionaries live in /var/cache/cracklib and are rebuilt nightly by the /usr/sbin/update-cracklib script." Source deer-run.com/~hal/sysadmin/pam_cracklib.html – knb Dec 8 '13 at 11:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.