Kernel echoing messages on VC (unwanted behavior)

lhoff · 12-05-2003, 12:41 PM

I've been getting this message echoed across my virtual console screen constantly (stepping on whatever work I'm doing, including file management activity in Midnight Commander):

Dec 5 12:03:00 kernel: IN=eth0 OUT= MAC= SRC=192.168.1.2 DST=192.168.1.255 LEN=254 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=138 DPT=138 LEN=234
Dec 5 12:03:00 kernel: IN=eth0 OUT= MAC= SRC=192.168.1.2 DST=192.168.1.255 LEN=237 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=138 DPT=138 LEN=217
Dec 5 12:03:00 kernel: IN=eth0 OUT= MAC= SRC=192.168.1.5 DST=192.168.1.255 LEN=254 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=138 DPT=138 LEN=234
Dec 5 12:03:00 kernel: IN=eth0 OUT= MAC= SRC=192.168.1.5 DST=192.168.1.255 LEN=237 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=138 DPT=138 LEN=217
Dec 5 12:03:00 kernel: IN=eth0 OUT= MAC= SRC=192.168.1.8 DST=192.168.1.255 LEN=254 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=138 DPT=138 LEN=234
Dec 5 12:03:00 kernel: IN=eth0 OUT= MAC= SRC=192.168.1.8 DST=192.168.1.255 LEN=237 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=138 DPT=138 LEN=217
Dec 5 12:15:00 kernel: IN=eth0 OUT= MAC= SRC=192.168.1.2 DST=192.168.1.255 LEN=254 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=138 DPT=138 LEN=234
Dec 5 12:15:00 kernel: IN=eth0 OUT= MAC= SRC=192.168.1.2 DST=192.168.1.255 LEN=237 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=138 DPT=138 LEN=217

This only happens on the screen at the server: if I work on a term at a workstation on the network, it doesn't happen. Where should I look for whatever's causing this? Thanks!

Specs:
IBM Aptiva 2159
Pentium I (yes, ONE!...)
64MB RAM
20GB HD
Mandrake 8.1

Doergn · 12-05-2003, 12:47 PM

What you see there is the logging of your Shorewall (Firewall).
For howto change this behaviour goto
http://www.shorewall.net/
(FAY/HowTo) Section.

But afaik it's not that easy to tell shorewall to log in some different file.

Regards

Dirk

lhoff · 12-05-2003, 01:13 PM

Actually, yes and no.

I'm not running Shorewall, but Linux Firewall. However, a quick look at my LOG chain shows that it executes on EVERYTHING. So, some judicious changes now keep it from doing so on traffic within the LAN.

Thanks!

/bin/bash · 12-05-2003, 03:28 PM

What you need to do is edit /etc/syslog.conf on the server, and if there are any lines ending with /dev/console then change that to a file.