Docker0 Connection Spam in Logs

General
1

Hello!
Over the past couple of days, I can’t remember when this started to crop up, my journal logs are filled with:

[UFW BLOCK] IN=docker0 OUT= MAC= SRC=172.17.0.1 DST=239.192.152.143 LEN=165 TOS=0x00 PREC=0x00 TTL=32 ID=4232 DF PROTO=UDP SPT=6771 DPT=6771 LEN=145

every 20 or so seconds.
My ufw rules look like this:

Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing), deny (routed)
New profiles: skip

To                         Action      From
--                         ------      ----
2222/tcp                   ALLOW IN    Anywhere                  
80                         ALLOW IN    Anywhere                  
443                        ALLOW IN    Anywhere                  
Anywhere                   ALLOW IN    192.168.1.0/24            
58846/tcp                  ALLOW IN    Anywhere                  
47417/tcp                  ALLOW IN    Anywhere                  
47417/udp                  ALLOW IN    Anywhere                  
2222/tcp (v6)              ALLOW IN    Anywhere (v6)             
80 (v6)                    ALLOW IN    Anywhere (v6)             
443 (v6)                   ALLOW IN    Anywhere (v6)             
58846/tcp (v6)             ALLOW IN    Anywhere (v6)             
47417/tcp (v6)             ALLOW IN    Anywhere (v6)             
47417/udp (v6)             ALLOW IN    Anywhere (v6)

I’m running Docker on a 64-bit Raspberry Pi, Debian 11.
This is with the Docker service stopped, & all containers offline.

The closest thing I have to a solution right now is this stackoverflow question, but I don’t want to resort to that just yet given I have no idea why it’s trying to reach 239.192.152.143 on the specified port.

Am I missing something completely obvious? I got no clue so apologies in advance if it’s something stupid, & any help is appreciated!

2

Nobody’s got an idea?

3

Seen this?

1 Like
4

Damm… that’s pretty much spot on.
I do have a deluge instance running 24/7.
Well in that case, I’ll be good with whitelisting to prevent error messages correct?

Also, if you don’t mind, however did you find that post? I’d looked it up, but not properly it seems, as using your answer it’s all available.

Anyways, many thanks for identifying the issue, I can now rest much easier :slight_smile:

5

Since there has been so much regarding log4j (Apache Log4j 2 CVE-2021-44228 - Docker Blog)
i thought it might be a compromised image, so i google the IP.

But its because deluge is using LPD then, to find more peers, you can either disable this in deluge or just let it be, it wont matter

6

I see, thanks once again for clarifying. I’ll likely just let it be.

1 Like