5

I'm seeing a lot of the following line in /var/log/syslog:

Jun 21 14:36:15 my-server kernel: [416219.080061] iptables denied: IN=eth0 OUT= MAC=ff:ff:ff:ff:ff:ff:the-mac-address:08:00 SRC=0.0.0.0 DST=255.255.255.255 LEN=328 TOS=0x00 PREC=0x00 TTL=128 ID=10081 PROTO=UDP SPT=68 DPT=67 LEN=308

This seems to happen just about every minute. Is this just my server trying to broadcast something and my own iptables denying it from happening? If so, what kind of service might do such a thing, and should I allow it? I'm running Postgres 9.2.4 on Ubuntu 12.04.2, and basically no other services aside from the basic, pre-installed packages.

masegaloeh
  • 18,236
  • 10
  • 57
  • 106
orokusaki
  • 2,763
  • 4
  • 32
  • 43

2 Answers2

11

Your original question has been answered by NickW above, but in case it's helpful to you the next time something like this happens, here's a quick way to tell for yourself.

The last bit of that log line says "PROTO=UDP SPT=68 DPT=67".

This means that the packet denied by the firewall was a UDP packet, whose source port is 68, and whose destination is port 67.

You can then do: "egrep -w '67|68' /etc/services" in a terminal, and the output (at least on my Ubuntu box) shows:

bootps      67/tcp              # BOOTP server
bootps      67/udp
bootpc      68/tcp              # BOOTP client
bootpc      68/udp

You can google bootp/dhcp to learn more about the differences/similarities. Just wanted to show how you can take apart the iptables log line for yourself, for future reference.

The log line tells you other useful stuff, like the fact that the packet is coming "IN=eth0" or inbound on your eth0 interface.

PS: Question for you: what do you mean by "The private network that my server is in blocks bcast"?

DictatorBob
  • 1,644
  • 11
  • 15
  • Thanks, +1 - Regarding "private network", I should rather say that my "cloud" hosting provider's local network that can be accessed via all "cloud" servers. – orokusaki Jun 21 '13 at 15:15
7

Those are just DHCP messages, either your server, or another is looking to configure an interface.

NickW
  • 10,263
  • 1
  • 20
  • 27
  • Thanks. Is it safe to ignore it (i.e., is it common to have this running constantly), or is it something I should disable? The private network that my server is in blocks bcast, FWIW. – orokusaki Jun 21 '13 at 15:00
  • Well, it might be worth understanding what is looking for a DHCP server (does your server have unconfigured interfaces?), are all the machines in the network yours? – NickW Jun 21 '13 at 15:09
  • There are other machines that aren't mine, in the same network. Regarding unconfigured interfaces, I didn't create any interfaces or even do anything to the server, pertaining to networking (aside from add gratuitous rules to iptables). – orokusaki Jun 21 '13 at 15:13
  • It's probably other machines then.. – NickW Jun 21 '13 at 15:18