Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I use iptables to log all incoming connections. While going through the log in var/log/messages, I notice that there are some incoming connections from another computer to an unassigned LAN ip address, example:

Jan 7 23:31:28 some kernel: [ 1863.117105] IPTABLES: IN=wlan0 OUT= MAC=ff:ff:ff:ff:ff:ff:00:12:34:56:e1:e1:08:00 SRC= DST= LEN=239 TOS=0x00 PREC=0x00 TTL=128 ID=37 PROTO=UDP SPT=138 DPT=138 LEN=219

My question is, if these connections are not destined to my server, why are they logged under INPUT? If they are being logged, does it mean that my server is accepting them if I do not filter out these explicitly? My current iptables configuration is:


-A INPUT -i lo -j ACCEPT
-A INPUT -j LOG --log-prefix "IPTABLES: " --log-level info
-A INPUT -p icmp -j ACCEPT
-A INPUT -p tcp --dport 80 -j ACCEPT

Does it mean that I have to add a -d to the last rule as in:

-A INPUT -p tcp -d --dport 80 -j ACCEPT

to filter out connections not destined to my server?

share|improve this question
up vote 3 down vote accepted

That is logging a packet to, assuming yoy have a 24 bitsubnet mask, then that means it is the broadcast adress. Broadcasts get sent to every computer on the network.

This particular packet is almost certainly a windows machine annoucing its name to the network.

share|improve this answer
I see... thanks for the additional info :) – Question Overflow Jan 7 '13 at 16:23

Presuming that your using a /24 network then your system is accepting that packet because it's to the 192.168.1/24 broadcast address this would be normal.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.