This message is flooding my syslog, how to find where it comes from?

The existing answer is correct in its technical analysis of the firewall log entry, but it's missing one point that makes the conclusion incorrect. The packet

  • Is a RST (reset) packet
  • from SRC=35.162.106.154
  • to your host at DST=104.248.41.4
  • via TCP
  • from his port SPT=25
  • to your port DPT=50616
  • and has been BLOCKed by UFW.

Port 25 (the source port) is commonly used for email. Port 50616 is in the ephemeral port range, meaning there's no consistent user for this port. A TCP "reset" packet can be sent in response to a number of unexpected situations, such as data arriving after a connection has been closed, or data being sent without first establishing a connection.

35.162.106.154 reverse-resolves to cxr.mx.a.cloudfilter.net, a domain used by the CloudMark email filtering service.

Your computer, or someone pretending to be your computer, is sending data to one of CloudMark's servers. The data is arriving unexpectedly, and the server is responding with a RST to ask the sending computer to stop. Given that the firewall is dropping the RST rather than passing it through to some application, the data that's causing the RST to be sent isn't coming from your computer. Instead, you're probably seeing backscatter from a denial-of-service attack, where the attacker is sending out floods of packets with forged "from" addresses in an attempt to knock CloudMark's mail servers offline (perhaps to make spamming more effective).


The messages stems from UFW, the "uncomplicated firewall" and it tells you that someone

  • from SRC=35.162.106.154
  • tried to connect to your host at DST=104.248.41.4
  • via TCP
  • from their port SPT=25
  • to your port DPT=50616
  • and that UFW has successfully BLOCKed that attempt.

According to this site the source address 35.162.106.154 is some Amazon machine (probably an AWS). According to this site the port 50616 may be used for Xsan Filesystem Access.

So it's an attempt from IP=35.162.106.154 to access your files. Quite normal and nothing to be really worried about because that's what firewalls are for: rejecting such attempts.

Tags:

Networking

Recent Posts