Seeing a lot af weard stuff in /var/messages

edge · Nov 20, 2009

Anyone here who can explain what is happening?
It's really filling up my /var/log/messages file!

Nov 20 16:56:12 host kernel: IN=eth0 OUT= MAC=00:14:22:b0:37:dd:00:04:80:85:34:00:08:00 SRC=125.60.241.195 DST=195.184.65.69 LEN=60 TOS=0x00 PREC=0x00 TTL=39 ID=18329 DF PROTO=$
Nov 20 16:56:12 host kernel: IN=eth0 OUT= MAC=00:14:22:b0:37:dd:00:04:80:85:34:00:08:00 SRC=80.127.30.189 DST=195.184.65.69 LEN=48 TOS=0x00 PREC=0x00 TTL=119 ID=11308 DF PROTO=$
Nov 20 16:56:12 host kernel: IN=eth0 OUT= MAC=01:00:5e:00:00:01:00:1e:c9:b7:9b:32:08:00 SRC=91.196.170.169 DST=224.0.0.1 LEN=412 TOS=0x00 PREC=0x00 TTL=1 ID=0 DF PROTO=UDP SPT=$
Nov 20 16:56:12 host kernel: IN=eth0 OUT= MAC=01:00:5e:00:00:01:00:1e:c9:b7:9b:32:08:00 SRC=91.196.170.169 DST=224.0.0.1 LEN=412 TOS=0x00 PREC=0x00 TTL=1 ID=0 DF PROTO=UDP SPT=$
N
Click to expand...

falko · Nov 21, 2009

Do you know the SRC IPs?

edge · Nov 21, 2009

falko said: ↑

Do you know the SRC IPs?
Click to expand...

Sorry you got me here..
SRC as in what?

Hans · Nov 21, 2009

Don't know either what these messages mean, but one of the(SRC=Source) IP-address (91.196.170.169) is a default page of the H-Sphere hosting controlpanel. As you can see here: http:///91.196.170.169

falko · Nov 22, 2009

edge said: ↑

Sorry you got me here..
SRC as in what?
Click to expand...

These IPs:

Nov 20 16:56:12 host kernel: IN=eth0 OUT= MAC=00:14:22:b0:37:dd:00:04:80:85:34:00:08:00 SRC=125.60.241.195 DST=195.184.65.69 LEN=60 TOS=0x00 PREC=0x00 TTL=39 ID=18329 DF PROTO=$
Nov 20 16:56:12 host kernel: IN=eth0 OUT= MAC=00:14:22:b0:37:dd:00:04:80:85:34:00:08:00 SRC=80.127.30.189 DST=195.184.65.69 LEN=48 TOS=0x00 PREC=0x00 TTL=119 ID=11308 DF PROTO=$
Nov 20 16:56:12 host kernel: IN=eth0 OUT= MAC=01:00:5e:00:00:01:00:1e:c9:b7:9b:32:08:00 SRC=91.196.170.169 DST=224.0.0.1 LEN=412 TOS=0x00 PREC=0x00 TTL=1 ID=0 DF PROTO=UDP SPT=$
Nov 20 16:56:12 host kernel: IN=eth0 OUT= MAC=01:00:5e:00:00:01:00:1e:c9:b7:9b:32:08:00 SRC=91.196.170.169 DST=224.0.0.1 LEN=412 TOS=0x00 PREC=0x00 TTL=1 ID=0 DF PROTO=UDP SPT=$
N
Click to expand...

edge · Nov 22, 2009

They do not belong to the ISP that I'm hosting my servers.
I guess that it's maybe somekind of broadcast or so.

For now I have added all the IP's to my firewall. Lets wait and see what's going to happen next.

Log in or Sign up

Seeing a lot af weard stuff in /var/messages

edge Active Member Moderator

falko Super Moderator Howtoforge Staff

edge Active Member Moderator

Hans Moderator Moderator

falko Super Moderator Howtoforge Staff

edge Active Member Moderator

Share This Page

Log in or Sign up

Seeing a lot af weard stuff in /var/messages

edge Active Member Moderator

falko Super Moderator Howtoforge Staff

edge Active Member Moderator

Hans Moderator Moderator

falko Super Moderator Howtoforge Staff

edge Active Member Moderator

Share This Page

Useful Searches