Mailinglist Archive: opensuse (878 mails)

< Previous Next >
Re: [opensuse] firewall message
В Wed, 5 Aug 2015 21:43:13 -0400
Fr David Ousley <davidousley@xxxxxxxxxxx> пишет:

This message keeps showing up repeatedly in the journalctl log:

Aug 05 21:29:43 linux2 kernel: SFW2-INext-DROP-DEFLT IN=enp3s0 OUT=
MAC=33:33:00:00:00:fb:a0:88:b4:c5:99:9c:86:dd
SRC=fe80:0000:0000:0000:c534:6352:2873:f469
DST=ff02:0000:0000:0000:0000:0000:0000:00fb LEN=88

I gather it has to do with the firewall. The MAC address does not seem
to match any of the devices on the local network (which is small). Can
anyone tell me what it means and what I should do about it?


MAC 33:33:xx:xx:xx is IPv6 multicast address and ff02::fb is mDNSv6. So
someone tries to transmit mDNS packets which are multicast by
definition. a0:88:b4 is Intel so full MAC would be a0:88_b4_c5:99:9c. I
do not know what last 2 bytes in MAC field of log message mean.

IPv6 fe80 prefix is for link-local addresses; they usually use
modified MAC in the lower part, but here it does not look like it. But
in principle that can be anything.

Do you have device with MAC a0:88_b4_c5:99:9c?

Running OpenSuse 13.2, wired ethernet connection to router.

Thanks.

Fr Ousley

--
To unsubscribe, e-mail: opensuse+unsubscribe@xxxxxxxxxxxx
To contact the owner, e-mail: opensuse+owner@xxxxxxxxxxxx

< Previous Next >
References