Good day, Can someone please be so kind, as to explain me what this means: Dec 1 06:44:06 GWY-01 Shorewall:logdrop:DROP: IN=eth0 OUT= MAC=01:00:5e:00:00:01:00:00:ca:26:cb:b2:08:00 SRC=10.54.255.250 DST=224.0.0.1 LEN=28 TOS=00 PREC=0x00 TTL=1 ID=56528 PROTO=2 i''m behind a motorola surfboard cable modem 5100e the modem, issues a dhcp ip to my firewall, the modem has an ip addr. of 192.168.100.1, just for http information on the modem. my firewall uses pump to get the dhcp address, and i''m in the 192.168.10.x subnet on my lan.. so, i''m kinda lost receiving this messages, cause i don''t know where the src address of 10.54.255.250 is originating, and the dst address of 224.0.0.1, don''t have a clue what that mean. and i''m seeing something like 1000+ hits per day, of this message in the log thnks in advance reggie ----------------------------------------------------------- ~~ The Science of Doing it Right ~~ -----------------------------------------------------------
On Mon, 2003-12-01 at 15:39, Reginald Richardson wrote:> Good day, > > Can someone please be so kind, as to explain me what this means: > > Dec 1 06:44:06 GWY-01 Shorewall:logdrop:DROP: IN=eth0 OUT= MAC=01:00:5e:00:00:01:00:00:ca:26:cb:b2:08:00 SRC=10.54.255.250 DST=224.0.0.1 LEN=28 TOS=00 PREC=0x00 TTL=1 ID=56528 PROTO=2 > > i''m behind a motorola surfboard cable modem 5100e > > the modem, issues a dhcp ip to my firewall, the modem has an ip addr. of 192.168.100.1, just for http information on the modem. > > my firewall uses pump to get the dhcp address, and i''m in the 192.168.10.x subnet on my lan.. > > so, i''m kinda lost receiving this messages, cause i don''t know where the src address of 10.54.255.250 is originating, and the dst address of 224.0.0.1, don''t have a clue what that mean. > > and i''m seeing something like 1000+ hits per day, of this message in the log >It''s probably some device owned by one of your neighbors. If the messages annoy you, simply modify your rfc1918 file to drop packets from that address. -Tom -- Tom Eastep \ Nothing is foolproof to a sufficiently talented fool Shoreline, \ http://shorewall.net Washington USA \ teastep@shorewall.net
On Mon, 2003-12-01 at 15:39, Reginald Richardson wrote:> > so, i''m kinda lost receiving this messages, cause > i don''t know where the src address of 10.54.255.250 > is originating, and the dst address of 224.0.0.1, > don''t have a clue what that mean. >224.0.0.1 is a multicast address (in other words, it''s a form of broadcast which is why your system is capturing it in the first place). -Tom -- Tom Eastep \ Nothing is foolproof to a sufficiently talented fool Shoreline, \ http://shorewall.net Washington USA \ teastep@shorewall.net