Message from syslogd

[morteza3245]

Hi
my putty was open in my system , after 5/6H i see below log in putty, what is them? how i can resolve them?

[email protected] [/var/cpanel]#
Message from [email protected] at Nov  8 09:27:34 ...
 kernel:[739509.894667] nf_ct_ftp: dropping packetIN= OUT=eth0 SRC=188.40.89.145 DST=206.72.194.14 LEN=53 TOS=0x10 PREC=0x00 TTL=64 ID=52082 DF PROTO=TCP SPT=21 DPT=4252 SEQ=2814533456 ACK=4008658383 WINDOW=14600 RES=0x00 ACK PSH URGP=0 UID=0 GID=0

Message from [email protected] at Nov  8 09:27:34 ...
 kernel:[739509.895413] nf_ct_ftp: dropping packetIN= OUT=eth0 SRC=188.40.89.145 DST=206.72.194.14 LEN=53 TOS=0x10 PREC=0x00 TTL=64 ID=52083 DF PROTO=TCP SPT=21 DPT=4252 SEQ=2814533456 ACK=4008658383 WINDOW=14600 RES=0x00 ACK PSH FIN URGP=0 UID=0 GID=0
^C

Thanks!

 

[cPanelMichael]

Hello

It's not abnormal to see this alert, and it does not indicate an issue with your system. It's to indicate the loss of a packet during the connection (not necessarily your own connection). You can search for the term "nf_ct_ftp: dropping packet" on a search engine and see several results from other users asking about this message for more information.

Thank you.

 

[sneader]

Hi Michael. I have this issue also. The message is fine... the problem is that it's output to the console instead of to /var/log/messages. There are some other threads on this, but I admit I have not absorbed them all and I still have this same issue on several of my boxes. Maybe there is a solution out there. It only seems to affect FTP logging.

- Scott

 

[cPanelMichael]

The message itself does not stem from a cPanel process. It's more of a Kernel/OS/Firewall issue. There is a thread on this here:

Seems to be an attack - nf_ct_ftp

However, you have replied to that thread already. Searching for "nf_ct_ftp" yields several results on search engines.

Thank you.

 

[sneader]

Hi Michael. Yep, have wasted quite a bit of time on this. It may not be cPanel's "fault" but often times we find solutions to our hosting/server issues here in this forum. Bottom line is that there seem to be a lot of cPanel server admins with this same problem, and I've never seen a solution to the problem anywhere (here or elsewhere).

What's especially annoying is that END USERS also see these alerts! i.e. any valid user that happens to be SSH'd into the server, also sees these firewall alerts. Not very cool.

- Scott