Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 2 replies
  • Subscribers 2 subscribers
  • Views 1504 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

netbios-datagrams (udp) are logged but I don't want them to be logged.

zeek
I have the following definitions and rule. Why then am I getting the logs below? 

Cheers,
-zeek

eth0_Network__  192.168.1.0  255.255.255.0

netbios-dgm  tcp/udp  138  138

1  eth0_Network__  Any  eth0_Network__  Allow

Aug  1 10:20:19 dingus kernel: UDP Drop: IN=eth0 OUT= MAC=ff:ff:ff:ff:ff:ff:00:10:a4:7a:cd:10:08:00 SRC=192.168.1.150 DST=192.168.1.255 LEN=229 TOS=0x00 PREC=0x00 TTL=128 ID=15678 PROTO=UDP SPT=138 DPT=138 LEN=209

Aug  1 10:24:29 dingus kernel: UDP Drop: IN=eth0 OUT= MAC=ff:ff:ff:ff:ff:ff:00:60:97:6a:93:33:08:00 SRC=192.168.1.10 DST=192.168.1.255 LEN=248 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=138 DPT=138 LEN=228

Aug  1 10:24:29 dingus kernel: UDP Drop: IN=eth0 OUT= MAC=ff:ff:ff:ff:ff:ff:00:60:97:6a:93:33:08:00 SRC=192.168.1.10 DST=192.168.1.255 LEN=235 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=138 DPT=138 LEN=215

Aug  1 10:31:12 dingus kernel: UDP Drop: IN=eth0 OUT= MAC=ff:ff:ff:ff:ff:ff:22:3b:6e:af:cc:36:08:00 SRC=192.168.1.149 DST=192.168.1.255 LEN=229 TOS=0x00 PREC=0x00 TTL=128 ID=37009 PROTO=UDP SPT=138 DPT=138 LEN=209

Aug  1 10:32:22 dingus kernel: UDP Drop: IN=eth0 OUT= MAC=ff:ff:ff:ff:ff:ff:00:10:a4:7a:cd:10:08:00 SRC=192.168.1.150 DST=192.168.1.255 LEN=229 TOS=0x00 PREC=0x00 TTL=128 ID=15724 PROTO=UDP SPT=138 DPT=138 LEN=209


This thread was automatically locked due to age.