The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Crazy syslog message

Discussion in 'General Discussion' started by Deker, Feb 9, 2014.

  1. Deker

    Deker Well-Known Member

    Joined:
    Feb 15, 2011
    Messages:
    79
    Likes Received:
    1
    Trophy Points:
    8
    Hello,

    I'm getting the following massage 100+ times a minute and unable to stop it.
    It preventing me to access SSH and run ssh commands.
    Code:
    Message from syslogd@***at Feb  9 17:08:38 ...
     kernel:[2645464.138196] nf_ct_ftp: dropping packetIN= OUT=eth0 SRC=36.80.15.85 DST=95.48.29.11 LEN=53 TOS=0x10 PREC=0x00 TTL=64 ID=50794 DF PROTO=TCP SPT=21 DPT=13490 SEQ=2790617378 ACK=292684928 WINDOW=14600 RES=0x00 ACK PSH FIN URGP=0
    
    The SRC IP is the main IP of my server.
    I also tried to update kernel but I failed everytime due to this crazy message.

    Any idea would be greatly appreciated

    - sorry if posted in wrong forum
     
    #1 Deker, Feb 9, 2014
    Last edited: Feb 9, 2014
  2. cPanelPeter

    cPanelPeter Technical Analyst III
    Staff Member

    Joined:
    Sep 23, 2013
    Messages:
    569
    Likes Received:
    15
    Trophy Points:
    18
    cPanel Access Level:
    Root Administrator
    Twitter:
    Hello,

    Looks like a bad network card or some other routing problem on your network. Your server is dropping a packet (that's never good).
     
  3. Deker

    Deker Well-Known Member

    Joined:
    Feb 15, 2011
    Messages:
    79
    Likes Received:
    1
    Trophy Points:
    8
    You mean it's a hardware issue?
     
  4. cPanelPeter

    cPanelPeter Technical Analyst III
    Staff Member

    Joined:
    Sep 23, 2013
    Messages:
    569
    Likes Received:
    15
    Trophy Points:
    18
    cPanel Access Level:
    Root Administrator
    Twitter:
    Hello,

    Possibly yes. It's difficult to tell, but dropped packets from your own IP is never good. It's acceptable if your firewall is blocking or throttling an IP address, but that should never happen to your own IP address.
     
  5. Deker

    Deker Well-Known Member

    Joined:
    Feb 15, 2011
    Messages:
    79
    Likes Received:
    1
    Trophy Points:
    8
    Thanks Peter
    I've asked my server provider to check the issue but they sent me the following answer:
    Since I know that search engines are useless in my case, so do you have any idea?
     
  6. ThinIce

    ThinIce Well-Known Member

    Joined:
    Apr 27, 2006
    Messages:
    346
    Likes Received:
    7
    Trophy Points:
    18
    Location:
    Disillusioned in England
    cPanel Access Level:
    Root Administrator
    It would be at your own risk (i.e. make sure it isn't protecting anything that isn't restricted in another manner) but I'd disable the firewall for a brief period to test, if the message persists you've disproved their assertion and can tell them to look at the hardware for you.
     
  7. Deker

    Deker Well-Known Member

    Joined:
    Feb 15, 2011
    Messages:
    79
    Likes Received:
    1
    Trophy Points:
    8
    It was CSF !
    I've disbaled csf and the messages are stopped.
    Thank you so much man
     
  8. ThinIce

    ThinIce Well-Known Member

    Joined:
    Apr 27, 2006
    Messages:
    346
    Likes Received:
    7
    Trophy Points:
    18
    Location:
    Disillusioned in England
    cPanel Access Level:
    Root Administrator
    Is it working well / without the error once you've upgraded your kernel? If not you might want to request help over at ConfigServer Community Forum • Index page as CSF/LFD provides lots of great protection for your server...
     
Loading...

Share This Page