I run a blog self-hosted with Wordpress. I'm getting frequent email notifications from LFD regarding UDP_IN blocks. I usually get 10+ emails daily about it.
The email looks like following:
Hits: 11 Blocked: Temporary Block
Sample of block hits: host kernel: Firewall: UDP_IN Blocked IN=venet0 OUT= MAC= SRC=x.x.x.x DST=x.x.x.x LEN=xxx TOS=0x00 PREC=0x00 TTL=xxx ID=xxxxx PROTO=UDP SPT=xxx DPT=xxx LEN=xxx
Almost everytime the blocked IP address is different. I want to know is it some kind of attack or is it a false positive?
Thanks in advance.