UFW messages in 100s of Thousands in an hour

spandey · 09-18-2010, 08:15 AM

I am newbie in Linux using Mint 9 Isadora. I am flooded with UFW messages. I would like to how to interpret these messages. I am a bit scared..

TB0ne · 09-18-2010, 11:16 AM

Quote:

Originally Posted by spandey

I am newbie in Linux using Mint 9 Isadora. I am flooded with UFW messages. I would like to how to interpret these messages. I am a bit scared..

Not much anyone can do for you, based on your question. You don't tell us about your environment, where this machine is, how long it's been going on, or even provide a sample of these messages. We don't know what services are running on that box, or what you've looked at so far.

Provide details, and perhaps we can help.

spandey · 09-18-2010, 07:28 PM

Sorry I was in panic mode..Here are some info..

I am using this dekstop for personal use. My PC is connected to DSL modem via ethernet. The modem is in Bridge mode and I need to connect using Network Manager. There are no routers involved.

Linux Mint Isadora is installed. Default UFW is on. I am trying to find out manual for output SYNTAX of UFW so that I can interpret each one and try to findout what it is rather than asking questions again and again.

some samples...
Sep 18 18:11:17 spandey-desktop kernel: [ 108.412242] [UFW BLOCK] IN=ppp0 OUT= MAC= SRC=203.77.189.88 DST=117.197.238.169 LEN=1460 TOS=0x00 PREC=0x20 TTL=55 ID=13459 DF PROTO=TCP SPT=80 DPT=3859 WINDOW=12513 RES=0x00 ACK URGP=0
Sep 18 18:11:17 spandey-desktop kernel: [ 108.419297] [UFW AUDIT] IN=ppp0 OUT= MAC= SRC=203.77.189.88 DST=117.197.238.169 LEN=1460 TOS=0x00 PREC=0x20 TTL=55 ID=13460 DF PROTO=TCP SPT=80 DPT=3859 WINDOW=12513 RES=0x00 ACK URGP=0
Sep 18 18:11:17 spandey-desktop kernel: [ 108.419315] [UFW BLOCK] IN=ppp0 OUT= MAC= SRC=203.77.189.88 DST=117.197.238.169 LEN=1460 TOS=0x00 PREC=0x20 TTL=55 ID=13460 DF PROTO=TCP SPT=80 DPT=3859 WINDOW=12513 RES=0x00 ACK URGP=0
---------------------------------------------------------------

TB0ne · 09-19-2010, 10:12 AM

Quote:

Originally Posted by spandey

Sorry I was in panic mode..Here are some info..

I am using this dekstop for personal use. My PC is connected to DSL modem via ethernet. The modem is in Bridge mode and I need to connect using Network Manager. There are no routers involved.

Linux Mint Isadora is installed. Default UFW is on. I am trying to find out manual for output SYNTAX of UFW so that I can interpret each one and try to findout what it is rather than asking questions again and again.

Panic mode is never helpful, espeically when you don't know if you NEED to panic.

Some things that will help you:
https://help.ubuntu.com/10.04/server.../firewall.html
http://manpages.ubuntu.com/manpages/...an8/ufw.8.html

Explains operation of the firewall, and how to set/check logs. If you've enabled logging of anything over MEDIUM, you'll get lots of messages. Setting to LOW is usually recommended.