Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Please help with system logs

    Scheduled Pinned Locked Moved General pfSense Questions
    2 Posts 2 Posters 1.2k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • DaReaLDeviLD
      DaReaLDeviL
      last edited by

      Good Morning,

      I just searched the logs and found some entries that I don't know how to handle:

      the IP is my Macbook and the log is from "Routing" - every few minutes I get spammed with that.

      Jun 3 08:21:25 miniupnpd[98076]: SSDP packet sender 192.168.1.199:64391 not from a LAN, ignoring
      Jun 3 08:21:25 miniupnpd[98076]: SSDP packet sender 192.168.1.199:64391 not from a LAN, ignoring
      Jun 3 08:17:09 miniupnpd[98076]: SSDP packet sender 192.168.1.199:64391 not from a LAN, ignoring
      Jun 3 08:17:09 miniupnpd[98076]: SSDP packet sender 192.168.1.199:64391 not from a LAN, ignoring
      Jun 3 08:15:01 miniupnpd[98076]: SSDP packet sender 192.168.1.199:64391 not from a LAN, ignoring
      Jun 3 08:15:01 miniupnpd[98076]: SSDP packet sender 192.168.1.199:64391 not from a LAN, ignoring
      Jun 3 08:13:57 miniupnpd[98076]: SSDP packet sender 192.168.1.199:64391 not from a LAN, ignoring
      Jun 3 08:13:57 miniupnpd[98076]: SSDP packet sender 192.168.1.199:64391 not from a LAN, ignoring
      Jun 3 08:13:25 miniupnpd[98076]: SSDP packet sender 192.168.1.199:64391 not from a LAN, ignoring
      Jun 3 08:13:25 miniupnpd[98076]: SSDP packet sender 192.168.1.199:64391 not from a LAN, ignoring
      Jun 3 08:13:09 miniupnpd[98076]: SSDP packet sender 192.168.1.199:64391 not from a LAN, ignoring
      Jun 3 08:13:09 miniupnpd[98076]: SSDP packet sender 192.168.1.199:64391 not from a LAN, ignoring
      Jun 3 08:13:01 miniupnpd[98076]: SSDP packet sender 192.168.1.199:64391 not from a LAN, ignoring
      Jun 3 08:13:01 miniupnpd[98076]: SSDP packet sender 192.168.1.199:64391 not from a LAN, ignoring

      The other spam I get is from the "Resolver" and looks like this

      Jun 3 08:20:20 dnsmasq[12752]: read /etc/hosts - 32 addresses
      Jun 3 08:14:24 dnsmasq[12752]: read /etc/hosts - 32 addresses
      Jun 3 08:12:51 dnsmasq[12752]: read /etc/hosts - 32 addresses
      Jun 3 08:11:52 dnsmasq[12752]: read /etc/hosts - 32 addresses
      Jun 3 08:11:46 dnsmasq[12752]: read /etc/hosts - 32 addresses
      Jun 3 08:10:37 dnsmasq[12752]: read /etc/hosts - 32 addresses
      Jun 3 08:09:07 dnsmasq[12752]: read /etc/hosts - 32 addresses
      Jun 3 08:07:45 dnsmasq[12752]: read /etc/hosts - 33 addresses
      Jun 3 08:04:57 dnsmasq[12752]: read /etc/hosts - 33 addresses

      Please help me where I have to search that this spamming stops. Where can be the issue (despite of me).

      VM PFSense 2.4.3 (amd64) on Dell PowerEdge T410
      Xeon E5620 @ 2.40GHz 2 CPUs: 4GB Ram: 60GB Disk
      ISP (MNet) 1xModem (Vigor 130) 1xWan, 3xLan (PFSense)

      1 Reply Last reply Reply Quote 0
      • M
        MindfulCoyote
        last edited by

        @DaReaLDeviL:

        Jun 3 08:21:25 miniupnpd[98076]: SSDP packet sender 192.168.1.199:64391 not from a LAN, ignoring
        Jun 3 08:21:25 miniupnpd[98076]: SSDP packet sender 192.168.1.199:64391 not from a LAN, ignoring

        You appear to be using a routing daemon of some kind, are you running RIP? Without knowing your exact routing setup, I'm just guessing, but you could probably prevent these log entries with a firewall rule on your LAN interface since they are all from the same IP and port… but if you are actually using UPnP on your network then filtering it out of your router could break things. (I suspect it won't, but what do I know?)

        I'd try a rule like this:

        ID  Proto  Source        Port    Destination  Port      Gateway      Queue        Schedule
        block *  IPv4  192.168.1.199  64391    LAN Address  *        *            *

        @DaReaLDeviL:

        Jun 3 08:20:20 dnsmasq[12752]: read /etc/hosts - 32 addresses
        Jun 3 08:09:07 dnsmasq[12752]: read /etc/hosts - 32 addresses

        This one I can't help with other than to suggest you double-check all your dnsmasq settings? Maybe reboot the router to see if it clears up?

        Err

        –
        Erreu Gedmon

        Firewalls are hard...
        but the book makes it easier: https://portal.pfsense.org/book/

        1 Reply Last reply Reply Quote 0
        • First post
          Last post
        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.