2

Today I noticed when I plug in my 2TB external Toshiba hard drive, it triggers a ufw event in my logs:

Jul 20 11:24:20 linuxbox kernel: [152873.728277] [UFW BLOCK] IN=inet1 OUT= MAC= SRC=xxxa DST=xxxb LEN=64 TC=0 HOPLIMIT=1 FLOWLBL=434908 PROTO=UDP SPT=8612 DPT=8610 LEN=24

It even triggers the same event on all Linux computers I'm connected to via ssh at the time. Why does mounting an external harddrive trigger a UFW firewall event?

lsusb -t output:

/:  Bus 09.Port 1: Dev 1, Class=root_hub, Driver=xhci_hcd/2p, 5000M
|__ Port 2: Dev 2, If 0, Class=Mass Storage, Driver=usb-storage, 5000M
  • 1
    the port number is for canon printer discovery. bizarre. Are there multiple devices hidden in the drive? lsusb -t – meuh Jul 20 '16 at 18:15
  • @meuh I've added the lsusb -t output above. It is strange. I've never noticed it before. I just stuck another 4GB USB flash drive in the system and the same thing happen. It happened again when I ejected the drive. – jtlindsey Jul 20 '16 at 18:48
0

This seems to be a normal feature of the system. A thread was open on Kali forums concerning a similar issue, they did not found the culprit package, but the issue was closed, since it's a normal feature of the system that seemed to issue the requests. Reference : https://bugs.kali.org/view.php?id=3094

If i do a tcpdump :

sudo tcpdump port 8612 -XXX
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on wlo1, link-type EN10MB (Ethernet), capture size 262144 bytes
14:41:08.463778 IP Computer.8612 > 192.168.1.255.8612: UDP, length 16
    0x0000:  ffff ffff ffff 184f 3291 3f81 0800 4500  .......O2.?...E.
    0x0010:  002c 9242 4000 4011 e9c9 c0a8 1e65 c0a8  .,.B@.@......e..
    0x0020:  1eff 21a4 21a4 0018 6b25 424a 4e50 0201  ..!.!...k%BJNP..
    0x0030:  0000 0000 0000 0000 0000   

          ........

You see the k%BJNP?

It turns out the BJNP refer to Canon printers.

If i uninstall libsane, then i no longer see the port 8612 being blocked in the firewall if i attach a USB drive :

May 19 14:53:27 Device3 kernel: usb 2-3: new high-speed USB device number 11 using xhci_hcd
May 19 14:53:29 Computer kernel: usb 2-3: New USB device found, idVendor=048d, idProduct=1177
May 19 14:53:29 Computer kernel: usb 2-3: New USB device strings: Mfr=1, Product=2, SerialNumber=0
May 19 14:53:29 Computer kernel: usb 2-3: Product: USB Mass Storage Device
May 19 14:53:29 Computer kernel: usb 2-3: Manufacturer: Generic
May 19 14:53:29 Computer kernel: usb-storage 2-3:1.0: USB Mass Storage device detected
May 19 14:53:29 Computer kernel: scsi host2: usb-storage 2-3:1.0
May 19 14:53:29 Computer mtp-probe[9600]: checking bus 2, device 11: "/sys/devices/pci0000:00/0000:00:10.0/usb2/2-3"
May 19 14:53:29 Computer mtp-probe[9600]: bus: 2, device: 11 was not an MTP device
May 19 14:53:32 Computer kernel: scsi 2:0:0:0: Direct-Access     Generic  USB Flash Disk   0.00 PQ: 0 ANSI: 6
May 19 14:53:32 Computer kernel: sd 2:0:0:0: Attached scsi generic sg0 type 0
May 19 14:53:32 Computer kernel: sd 2:0:0:0: [sda] 31459328 512-byte logical blocks: (16.1 GB/15.0 GiB)
May 19 14:53:32 Computer kernel: sd 2:0:0:0: [sda] Write Protect is off
May 19 14:53:32 Computer kernel: sd 2:0:0:0: [sda] Mode Sense: 23 00 00 00
May 19 14:53:32 Computer kernel: sd 2:0:0:0: [sda] Write cache: disabled, read cache: enabled, doesn't support DPO or FUA
May 19 14:53:32 Computer kernel:  sda: sda1
May 19 14:53:33 Computer kernel: sd 2:0:0:0: [sda] Attached SCSI removable disk
May 19 14:53:34 Computer kernel: EXT4-fs (sda1): recovery complete
May 19 14:53:34 Computer kernel: EXT4-fs (sda1): mounted filesystem with ordered data mode. Opts: (null)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.