Solved Random UDP traffic from router to desktop?

[ipkpjersi]

Hi,

Every hour, I am getting traffic from my AX68U (running Merlin firmware) to my desktop (running Ubuntu 20.04 LTS). The source port is 1900 (so UPNP?) and the destination port is usually 49551 (sometimes 38715 or 53419). I have an SMTP relay server set up via SSMTP sending emails to my personal email for monitoring my hard drives for any errors, etc. However, when a UFW block happens, not only does it log it to dmesg (this is good), but it also tries to send an email, which results in this happening:

https://imgur.com/j6qI8td

Is there any way of identifying what is attempting to send traffic to my desktop, or any way to limit the spam somehow, or any way to disable the UFW block email sending but keep the dmesg logging? Depending on the SMTP relay used, having these spam emails either results in hitting a daily limit and being unable to send any additional emails, or likely incurring high expenses if I switch mail providers (currently using gmail free).

I would appreciate any suggestions or ideas.

Thanks.

 

[ColinTaylor]

Every hour, I am getting traffic from my AX68U (running Merlin firmware) to my desktop (running Ubuntu 20.04 LTS). The source port is 1900 (so UPNP?) and the destination port is usually 49551 (sometimes 38715 or 53419).

The fact that the source port is 1900 would normally indicate that this is a response to a query from your PC. Typically that would be something trying to detect the IGD. Or it may be trying to verify public IP address of the router.

 

[ipkpjersi]

I ended up fixing the email spam with two lines of sed (the PSAD one was a bunch of spam about multicast):

The email spam has gone away entirely now and I still have the logs as log files if I ever want to read them.