Home / ubuntu / Questions / 860835
Accepted
php_nub_qq
Asked: 2016-12-16 00:00:36 +0800 CST

UFW Block translation

  • 772

I'm running version 16.04 and if I go into journalctl I can see a lot of this

Dec 15 06:55:12 x kernel: [UFW BLOCK] IN=eth0 OUT= MAC=<I suppose I should hide this> SRC=192.168.1.1 DST=224.0.0.1 LEN=32 TOS=0x00 PREC=0xC0 TTL=1 ID=0 DF PROTO=2

All the records are the same with the same data, what does that mean?

ufw

1 Answers

  1. Best Answer

    Those are multicast packets, sent by machine 192.168.1.1, which may be your router. They are sent to multicast address 224.0.0.1.

    From the Multicast over TCP/IP HOWTO:

    224.0.0.1 is the all-hosts group. If you ping that group, all multicast capable hosts on the network should answer, as every multicast capable host must join that group at start-up on all it's multicast capable interfaces.

    So there is a machine on your LAN, presumably your router, that is trying to identify other multicast-capable hosts on the network. Yours won't respond to the ping since the request is blocked by your firewall UFW.

    • 2