Firewall log question - what am I looking at
-
I am constantly seeing all this in my firewall log status>system logs>firewall
my internal lan is 192.168.1.0/24 and external wan is dhcp from att
so what are all there 192.168.0.1 doing?
-
Well clearly you have a box on wrong address space sending out SSDP multicast traffic
http://en.wikipedia.org/wiki/Simple_Service_Discovery_Protocol
I would look a little deeper to what mac address its coming from so you can figure out what it is and then fix it to not send out SSDP or correct its IP to be on your network.
-
I cant seem to find the mac address? I did find this what does it mean?
-
Its on your LAN interface, so I take it someone just typo'd the standard 192.168 address space. I find it unlikely you would be seeing a public routed network address on your lan interface.
And yes 192.167 is owned by
inetnum: 192.167.0.0 - 192.167.0.255
netname: INFN-CT
descr: INFN - Sezione di Catania
country: ITDo a sniff (capture under diag) of the traffic on your lan - and find the mac of the device that is sending out the traffic. Its happening enough that you should not have to capture for long to snag a packet and be able to see the mac.
-
ok after a packet capture I identified ip and the mac address and it corresponds to my att dsl modem, Why is this bleeding over so much into the lan?
Is this normal? it looks like its putting allot of bits throught the system that do not need to be there?
Att DSL modem w/dhcp to > WAN port > LAN port
-
so your modem as a 192.167 address??? On the lan side?? that makes no sense – and why are you seeing it on the lan interface of your pfsense box?
What specific model of modem, and how is it connected to your network?
-
here is my sys info screen… looks like I messed up I must have typoed 168 while packet captureing
do the dns server here look correct? 168.0.1 does come back to my modem and i I can log into my modem on the lan side through the wan I guess att dsl modem siemens speedscream 4100b
-
ok here is a copy of the packet capture
18:46:40.847261 00:1c:f0:f4:8d:ba > ff:ff:ff:ff:ff:ff, ethertype IPv4 (0x0800), length 294: (tos 0x0, ttl 127, id 20022, offset 0, flags [none], proto UDP (17), length 280)
192.167.0.1.1900 > 239.255.255.250.1900: [udp sum ok] UDP, length 252any ideas?
-
I know exactly what the traffic was (SSDP), no need for a capture. Even though really thats just basic info about the packet no data there.
Where are you getting 168.0.1 from?? The packet capture and your blocked firewalls clearly show 192.167
192.167.0.1.1900 > 239.255.255.250.1900: [udp sum ok] UDP, length 252
What does a DNS server have to do with anything? Why would you be pointing to a 192.168.0.1 address for DNS though?
If that traffic is your MODEM – why are you seeing it on your LAN interface?? From that mac, I can tell its a dlink
So let me ask again -- what is the exact model of your "modem" and why in the world would be connected to your LAN interface -- not going to work like that.. Is it an OLD Modem or something your just using as a switch? And you gave it a 192.167.0.1 address?
Are you behind a double nat? Why are you hiding your FULL wan IP?? Here -- just hide the last couple of octets and I can tell if you behind a NAT. But please draw out where this att modem you think is sending out the traffic -- why are you seeing that traffic on your LAN interface???
most anyone can tell for first couple of octets is what ISP your connected to.
As to bleed over, which is why I would like to see a drawing of your layout -- its NOT normally possible to see traffic from your MODEM on your LAN interface, not unless you had you lan connected to the same switch on the modem/router from your isp or something??
