System Log Entries

  • ATTENTION! As of November 1, 2020, you are not able to reply to threads 6 months after the thread is opened if there are more than 500 posts in the thread.
    Threads will not be locked, so posts may still be edited by their authors.
    Just start a new thread on the topic to post if you get an error message when trying to reply to a thread.

outlaw78

Occasional Visitor
I have 384.18 currently but this was on the last build as well. My system log shows these entries multiple times and several times a day:

"dnsmasq[437]: failed to send packet: Operation not permitted"

And this usually shows up before it:

"dnsmasq[437]: possible DNS-rebind attack detected: 2ruly5aj-ae33608f3dea4a7e42219ac5732d33bfb25dba5e-mob.d.aa.online-metrix.net"

My log is completely full of the failed to send packet though.

Any ideas?
 

davidkassa

New Around Here
My log is filled up with the "failed to send packet: Operation not permitted" message too. It's annoying but I have yet to see any problem.
 

eibgrad

Very Senior Member
This is nothing more than DNSMasq protecting you from rebind attacks.

If you lookup the IP of the domain name, you'll see it returns 0.0.0.0, which falls into the category of a *private* (rather than public) network, something typically found in a rebind attack. DNSmasq is refusing to return that IP to the client to protect it. IOW, it's working as intended.
Code:
$ nslookup 2ruly5aj-ae33608f3dea4a7e42219ac5732d33bfb25dba5e-mob.d.aa.online-metrix.net
Server:        127.0.0.53
Address:    127.0.0.53#53

Non-authoritative answer:
Name:    2ruly5aj-ae33608f3dea4a7e42219ac5732d33bfb25dba5e-mob.d.aa.online-metrix.net
Address: 0.0.0.0

Why some ppl get more of these than others is probably just a matter of the websites you happen to frequent, and whether they are more likely to be of malicious intent.
 

davidkassa

New Around Here
Interesting, I never put those two lines together. My kids have securely.com on their school iPads so I get the rebind error and ignore it.

The other one seemed to go away when I toggle AiProtect.
 

Similar threads

Latest threads

Sign Up For SNBForums Daily Digest

Get an update of what's new every day delivered to your mailbox. Sign up here!
Top