Getting False Positive Blocks From an Unknown IP Range

[pkothari7]

We are getting blocks from an unknown IP range which is not visible in any of our other logs besides lfd logs. It does not cause any harm as of now but it looks like a csf bug itself. Please suggest some solution if there is available or fix it in next update.

Blocks that we are getting is as below:

Time: Mon Nov 29 05:35:47 2021 -0800
IP: 0.172.31.183 (-)
Connections: 2160
Blocked: Temporary Block for 600 seconds [CT_LIMIT]

Connections:
tcp6: 0.172.31.183:50832 -> 12.10.129.225:7999 (ESTABLISHED)
tcp6: 0.172.31.183:49727 -> 12.10.129.225:7999 (ESTABLISHED)
tcp6: 0.172.31.183:65189 -> 12.10.129.225:7999 (ESTABLISHED)

[ForumAdmin]

That looks like a problem translating /proc/net/tcp6. It would help if you can post the following:

1. The OS and version
2. The kernel and version
3. The contents of /proc/net/tcp6

[pkothari7]

Thank you for quick response. Here's what you asked for.

1. The OS and version

CentOS Linux release 7.9.2009 (Core)

2. The kernel and version

Linux 3.10.0-1160.31.1.el7.x86_64 #1 SMP Thu Jun 10 13:32:12 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux

3.The contents of /proc/net/tcp6

sl local_address remote_address st tx_queue rx_queue tr tm->when retrnsmt uid timeout inode
0: 0000000000000000FFFF00000100007F:8071 00000000000000000000000000000000:0000 0A 00000000:00000000 00:00000000 00000000 1010 0 29979 1 ffff954ff6420840 100 0 0 10 0
1: 00000000000000000000000000000000:1F36 00000000000000000000000000000000:0000 0A 00000000:00000000 00:00000000 00000000 1010 0 24895 1 ffff954ff8ee0840 100 0 0 10 0
2: 00000000000000000000000000000000:0016 00000000000000000000000000000000:0000 0A 00000000:00000000 00:00000000 00000000 0 0 15933 1 ffff954ef8e10000 100 0 0 10 0
3: 0000000000000000FFFF00000100007F:1F38 00000000000000000000000000000000:0000 0A 00000000:00000000 00:00000000 00000000 1010 0 25277 1 ffff954ff8ee39c0 100 0 0 10 0
4: 00000000000000000000000001000000:1F38 00000000000000000000000000000000:0000 0A 00000000:00000000 00:00000000 00000000 1010 0 25274 1 ffff954ff8ee3180 100 0 0 10 0
5: 0000000000000000FFFF00000100007F:3819 00000000000000000000000000000000:0000 0A 00000000:00000000 00:00000000 00000000 1010 0 30801 1 ffff954ef7f998c0 100 0 0 10 0
6: 0000000000000000FFFF00000100007F:1F39 00000000000000000000000000000000:0000 0A 00000000:00000000 00:00000000 00000000 1010 0 24972 1 ffff954ff8ee1080 100 0 0 10 0
7: 00000000000000000000000001000000:1F39 00000000000000000000000000000000:0000 0A 00000000:00000000 00:00000000 00000000 1010 0 20364 1 ffff954ef7f98000 100 0 0 10 0
8: 00000000000000000000000000000000:199C 00000000000000000000000000000000:0000 0A 00000000:00000000 00:00000000 00000000 0 0 14767 1 ffff954ff8ee0000 100 0 0 10 0
9: 00000000000000000000000000000000:1F3F 00000000000000000000000000000000:0000 0A 00000000:00000000 00:00000000 00000000 1010 0 29406 1 ffff954ff668b180 100 0 0 10 0
10: 00000000000000000000000000000000:1645 00000000000000000000000000000000:0000 0A 00000000:00000000 00:00000000 00000000 1010 0 29929 1 ffff954ff6420000 100 0 0 10 0
11: 0000000000000000FFFF0000E101A8C0:1F36 0000000000000000FFFF00005EE26241:3914 05 00000000:00000000 03:00000661 00000000 0 0 0 3 ffff954f5c89cd00
12: 0000000000000000FFFF0000E101A8C0:6E0A 0000000000000000FFFF0000DC01A8C0:0CEA 01 00000000:00000000 02:00007F37 00000000 1010 0 1938195342 2 ffff954f4ae418c0 20 4 14 10 -1
13: 0000000000000000FFFF0000E101A8C0:6DF8 0000000000000000FFFF0000DC01A8C0:0CEA 01 00000000:00000000 02:0000159D 00000000 1010 0 1938119427 2 ffff954e6048f380 20 4 0 10 -1
14: 0000000000000000FFFF0000E101A8C0:6E02 0000000000000000FFFF0000DC01A8C0:0CEA 01 00000000:00000000 02:00006B37 00000000 1010 0 1938177711 2 ffff954e4104b180 20 4 0 10 -1
15: 0000000000000000FFFF0000E101A8C0:4A1A 0000000000000000FFFF0000048AC068:01BB 08 00000000:00000020 00:00000000 00000000 1010 0 1937693059 1 ffff954e473939c0 20 4 28 10 -1
16: 0000000000000000FFFF00000100007F:1F38 0000000000000000FFFF00000100007F:85A4 01 00000000:00000000 02:000098D0 00000000 1010 0 1938593859 2 ffff954e42b9d280 20 4 31 10 -1
17: 0000000000000000FFFF0000E101A8C0:1F36 0000000000000000FFFF00005EE26241:3904 05 00000000:00000000 03:0000020C 00000000 0 0 0 3 ffff954f5c89cc00
18: 0000000000000000FFFF0000E101A8C0:1F36 0000000000000000FFFF00005EE26241:3922 05 00000000:00000000 03:00000A45 00000000 0 0 0 3 ffff954f5c89c900
19: 0000000000000000FFFF00000100007F:85A4 0000000000000000FFFF00000100007F:1F38 01 00000000:00000000 00:00000000 00000000 1010 0 1938589533 1 ffff954e42b9b9c0 20 4 0 16 -1
20: 0000000000000000FFFF0000E101A8C0:1F36 0000000000000000FFFF00005EE26241:3926 05 00000000:00000000 03:00000A45 00000000 0 0 0 3 ffff954e76462000
21: 0000000000000000FFFF0000E101A8C0:1F36 0000000000000000FFFF00005EE26241:394A 01 00000000:00000000 00:00000000 00000000 1010 0 1938678116 1 ffff954e42b99080 20 4 29 10 -1
22: 0000000000000000FFFF0000E101A8C0:1F36 0000000000000000FFFF00005EE26241:3928 05 00000000:00000000 03:00000A45 00000000 0 0 0 3 ffff954f5c89cf00
23: 0000000000000000FFFF0000E101A8C0:4A20 0000000000000000FFFF0000048AC068:01BB 08 00000000:00000020 00:00000000 00000000 1010 0 1937688678 1 ffff954f4ae43180 20 4 28 10 -1
24: 0000000000000000FFFF0000E101A8C0:1F36 0000000000000000FFFF00005EE26241:392E 05 00000000:00000000 03:00000A45 00000000 0 0 0 3 ffff954e76462d00
25: 0000000000000000FFFF0000E101A8C0:1F36 0000000000000000FFFF00005EE26241:3940 01 00000000:00000000 00:00000000 00000000 1010 0 1938675737 1 ffff954e42b9a940 20 4 29 10 -1
26: 0000000000000000FFFF0000E101A8C0:1F36 0000000000000000FFFF00006F01A8C0:F006 06 00000000:00000000 03:00001385 00000000 0 0 0 3 ffff954f5c89ce00
27: 0000000000000000FFFF0000E101A8C0:1F36 0000000000000000FFFF00005EE26241:390E 05 00000000:00000000 03:00000661 00000000 0 0 0 3 ffff954f5c89c100
28: 0000000000000000FFFF0000E101A8C0:1F36 0000000000000000FFFF00005EE26241:3948 01 00000000:00000000 00:00000000 00000000 1010 0 1938678115 1 ffff954e42b98840 20 4 29 10 -1
29: 0000000000000000FFFF0000E101A8C0:4A18 0000000000000000FFFF0000048AC068:01BB 08 00000000:00000020 00:00000000 00000000 1010 0 1937691301 1 ffff954e6048dac0 20 4 28 10 -1
30: 0000000000000000FFFF0000E101A8C0:4A1E 0000000000000000FFFF0000048AC068:01BB 08 00000000:00000020 00:00000000 00000000 1010 0 1937692287 1 ffff954e4104ca40 20 4 28 10 -1
31: 0000000000000000FFFF0000E101A8C0:6E08 0000000000000000FFFF0000DC01A8C0:0CEA 01 00000000:00000000 02:00008337 00000000 1010 0 1938192599 2 ffff954e6048a100 20 4 16 10 -1
32: 0000000000000000FFFF0000E101A8C0:1F36 0000000000000000FFFF00005EE26241:392A 05 00000000:00000000 03:00000A45 00000000 0 0 0 3 ffff954f5c89c000
33: 0000000000000000FFFF0000E101A8C0:1F36 0000000000000000FFFF00005EE26241:3924 05 00000000:00000000 03:00000A45 00000000 0 0 0 3 ffff954f5c89c500
34: 0000000000000000FFFF0000E101A8C0:1F36 0000000000000000FFFF00005EE26241:3910 05 00000000:00000000 03:00000661 00000000 0 0 0 3 ffff954f5c89c200
35: 0000000000000000FFFF0000E101A8C0:1F36 0000000000000000FFFF00005EE26241:3916 05 00000000:00000000 03:00000661 00000000 0 0 0 3 ffff954f5c89c700
36: 0000000000000000FFFF0000E101A8C0:6E30 0000000000000000FFFF0000DC01A8C0:0CEA 01 00000000:00000000 02:00007B37 00000000 1010 0 1938374248 2 ffff954e6048ca40 20 4 0 10 -1
37: 0000000000000000FFFF0000E101A8C0:1F36 0000000000000000FFFF00005EE26241:392C 05 00000000:00000000 03:00000A45 00000000 0 0 0 3 ffff954e76462f00
38: 0000000000000000FFFF0000E101A8C0:1F36 0000000000000000FFFF00005EE26241:3906 05 00000000:00000000 03:0000020C 00000000 0 0 0 3 ffff954f5c89c300
39: 0000000000000000FFFF0000E101A8C0:4A16 0000000000000000FFFF0000048AC068:01BB 08 00000000:00000020 00:00000000 00000000 1010 0 1937688677 1 ffff954f4ae42100 20 4 28 10 -1
40: 0000000000000000FFFF0000E101A8C0:1F36 0000000000000000FFFF00005EE26241:3946 01 00000000:00000000 00:00000000 00000000 1010 0 1938678114 1 ffff954e42b9e300 20 4 29 10 -1
41: 0000000000000000FFFF0000E101A8C0:1F36 0000000000000000FFFF00005EE26241:394C 01 00000000:00000000 00:00000000 00000000 1010 0 1938678117 1 ffff954e42b9f380 20 4 29 10 -1
42: 0000000000000000FFFF0000E101A8C0:6E50 0000000000000000FFFF0000DC01A8C0:0CEA 01 00000000:00000000 02:0000966A 00000000 1010 0 1938588261 2 ffff954e4104d280 20 4 16 10 -1
43: 0000000000000000FFFF0000E101A8C0:4A14 0000000000000000FFFF0000048AC068:01BB 08 00000000:00000020 00:00000000 00000000 1010 0 1937692286 1 ffff954e41048000 20 4 28 10 -1
44: 0000000000000000FFFF0000E101A8C0:4A12 0000000000000000FFFF0000048AC068:01BB 08 00000000:00000020 00:00000000 00000000 1010 0 1937688676 1 ffff954f4ae41080 20 4 28 14 -1
45: 0000000000000000FFFF0000E101A8C0:1F36 0000000000000000FFFF00005EE26241:3912 05 00000000:00000000 03:00000661 00000000 0 0 0 3 ffff954f5c89ca00
46: 0000000000000000FFFF0000E101A8C0:1F36 0000000000000000FFFF00005EE26241:3902 05 00000000:00000000 03:0000020C 00000000 0 0 0 3 ffff954f5c89c800
47: 0000000000000000FFFF0000E101A8C0:1F36 0000000000000000FFFF00005EE26241:393E 01 00000000:00000000 00:00000000 00000000 1010 0 1938670916 1 ffff954e42b9c200 20 4 29 10 -1
48: 0000000000000000FFFF0000E101A8C0:199C 0000000000000000FFFF00006F01A8C0:F79C 06 00000000:00000000 03:0000137E 00000000 0 0 0 3 ffff954f5c89c600
49: 0000000000000000FFFF0000E101A8C0:4A1C 0000000000000000FFFF0000048AC068:01BB 08 00000000:00000020 00:00000000 00000000 1010 0 1937693060 1 ffff954e47396b40 20 4 28 10 -1
50: 0000000000000000FFFF0000E101A8C0:4A10 0000000000000000FFFF0000048AC068:01BB 08 00000000:00000020 00:00000000 00000000 1010 0 1937688675 1 ffff954f4ae44a40 20 4 28 10 -1

[pkothari7]

We are still receiving these blocks from weird tcp6 IP. It would be great if any of you can suggest, how to fix it.