[SOLVED] lot of traffic on br0

[ziolupo]

After upgrading my ac68u to 380.64 I'm receiving a lot of log messages done like this one:
Dec 29 17:57:25 kernel: ACCEPT IN=br0 OUT=br0 SRC=192.168.0.28 DST=192.168.0.132 LEN=44 TOS=0x00 PREC=0x00 TTL=127 ID=18738 PROTO=UDP SPT=59426 DPT=8612 LEN=24 MARK=0x1
Dec 29 17:57:25 kernel: ACCEPT IN=br0 OUT=br0 SRC=192.168.0.28 DST=192.168.0.226 LEN=44 TOS=0x00 PREC=0x00 TTL=127 ID=8440 PROTO=UDP SPT=59425 DPT=8611 LEN=24 MARK=0x1
Dec 29 17:57:25 kernel: ACCEPT IN=br0 OUT=br0 SRC=192.168.0.28 DST=192.168.0.133 LEN=44 TOS=0x00 PREC=0x00 TTL=127 ID=29147 PROTO=UDP SPT=59426 DPT=8612 LEN=24 MARK=0x1
Dec 29 17:57:25 kernel: ACCEPT IN=br0 OUT=br0 SRC=192.168.0.28 DST=192.168.0.134 LEN=44 TOS=0x00 PREC=0x00 TTL=127 ID=25993 PROTO=UDP SPT=59426 DPT=8612 LEN=24 MARK=0x1
Dec 29 17:57:25 kernel: ACCEPT IN=br0 OUT=br0 SRC=192.168.0.28 DST=192.168.0.135 LEN=44 TOS=0x00 PREC=0x00 TTL=127 ID=7617 PROTO=UDP SPT=59426 DPT=8612 LEN=24 MARK=0x1
Dec 29 17:57:26 kernel: ACCEPT IN=br0 OUT=br0 SRC=192.168.0.28 DST=192.168.0.136 LEN=44 TOS=0x00 PREC=0x00 TTL=127 ID=13386 PROTO=UDP SPT=59426 DPT=8612 LEN=24 MARK=0x1
Dec 29 17:57:26 kernel: ACCEPT IN=br0 OUT=br0 SRC=192.168.0.28 DST=192.168.0.137 LEN=44 TOS=0x00 PREC=0x00 TTL=127 ID=3332 PROTO=UDP SPT=59426 DPT=8612 LEN=24 MARK=0x1

I cannot understand if is something due to the new version or something due to my windows10 machine (the 192.168.0.28 is a win10 machine). I've never noticed this traffic before (but it could be my fault).

Thank you for helping

Best Regards
ZioLupo

 

[ColinTaylor]

A quick look on Google suggests that it might be a Canon network printer/software. Do you have a canon printer configured on the W10 machine?

 

[ziolupo]

Thank you Colin.

You were right! What I cannot understand is why I didn't have those logs before!
Nevertheless after uninstalling the driver the problem is solved. Now I will try to install the driver again to see if it's working or not.

Thanks again!

 

[mberteotti]

Thank you Colin.

You were right! What I cannot understand is why I didn't have those logs before!
Nevertheless after uninstalling the driver the problem is solved. Now I will try to install the driver again to see if it's working or not.

Thanks again!

I've noticed the same problem... have you found any solution? Canon driver of my MX925 is the same of 2 years ago, nothing has changed. Is it possible to avoid logging br0 to br0 traffic??

 

[ColinTaylor]

Presumably you are seeing this because you have turned on the logging of accepted packets?

Edit: I see you have started another thread here.

 

[mberteotti]

Presumably you are seeing this because you have turned on the logging of accepted packets?

Edit: I see you have started another thread here.

Logging accepted packets option has always been on but only recently syslog has been flooded with accept messages. Never seen before... nothing changed on router, probably in win10...

 

[ziolupo]

I've noticed the same problem... have you found any solution? Canon driver of my MX925 is the same of 2 years ago, nothing has changed. Is it possible to avoid logging br0 to br0 traffic??

I did something... Honestly speaking I did a lot of things and I cannot remember exectly what I did.... but now I don't have that traffic anymore.

I will try to repeat those steps in another PC and I will let you know (if I will be able to switch it off again!)

 

[zyme]

I had the same thing happen recently with my ASUS RT-AC56U on ASUSWRT-Merlin 380.65.

-Goto Firewall (Scroll down - under advanced) on the general Tab has an entry for Logged Packets Type,which changed to Both (Accepted would have caused the same log flooding).
-The setting wasn't changeable for me because I had Enable firewall set to No (webui bug); So I had to change it to Yes then you can change the setting to none, and if you want then set Enable Firewall back to No.

P.S. - Personally I left the firewall on and changed Logged packet type to Dropped so I'll be able to see what the firewall blocks (I have a machine set to DMZ and WAN ping response enabled, so there should in theory be virtually no dropped packets by the router. According to Merlin this Firewall En Yes setting has next to no resource usage and shouldn't be noticeable compared to everything else the router has running, so I'm curious to see what it does since the word firewall is very vague and can be an extremely general description. =)