1

I was able to see this "UFW BLOCK" in Syslog at different times.

Dec 15 01:22:23 node1 kernel: [4837640.303204] [UFW BLOCK] IN=enp4s2 OUT= MAC=xx:xx:xx SRC=192.168.x.x DST=192.168.x.x LEN=40 TOS=0x00 PREC=0x00 TTL=64 ID=29016 DF PROTO=TCP SPT=33988 DPT=4000 WINDOW=501 RES=0x00 ACK FIN URGP=0

This is not constantly seen, but once per day in recent days.

Improve this question
1
  • 1
    the SRC and DST "192.168.x.x" Ip addresses are devices on your LAN - do you know what devices have those IP addresses (by the way, no need to "hide" private non routable IP addresses)
    – Jaromanda X
    Dec 20, 2022 at 2:54

1 Answer 1

Reset to default
0

Something on your LAN is trying to reach port 4000/TCP on your (Ubuntu?) machine.

Could be a lot of things, you should probably check the machine from which the traffic originates. I am assuming that the DST (destination IP) is the same machine that is blocking the traffic but you are not giving us much to go on.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .