3CX Debian Instance - IP tables bombarding syslog

[DaveB-Opt]

I'm getting multiple entries on our Debian instance which seem to be having an impact on our server (call quality).
During the evening (when these entries decrease) we're getting a better call quality.
The entries provide a MAC address that's not valid.
What can I do to diagnose these entries?

Sep 3 13:16:01 OMG-3CX-VOIP kernel: [61693.269111] iptables[DOS]: IN=eth0 OUT= MAC=33:33:00:00:00:01:ac:86:74:d9:02:e0:86:dd SRC=fe80:0000:0000:0000:ae86:74ff:fed9:02e0 DST=ff02:0000:0000:0000:0000:0000:0000:0001 LEN=52 TC=0 HOPLIMIT=1 FLOWLBL=822758 PROTO=UDP SPT=16962 DPT=16962 LEN=12
Sep 3 13:16:11 OMG-3CX-VOIP kernel: [61703.276693] iptables[DOS]: IN=eth0 OUT= MAC=33:33:00:00:00:01:ac:86:74:d9:02:e0:86:dd SRC=fe80:0000:0000:0000:ae86:74ff:fed9:02e0 DST=ff02:0000:0000:0000:0000:0000:0000:0001 LEN=52 TC=0 HOPLIMIT=1 FLOWLBL=822758 PROTO=UDP SPT=16962 DPT=16962 LEN=12
Sep 3 13:16:21 OMG-3CX-VOIP kernel: [61713.285775] iptables[DOS]: IN=eth0 OUT= MAC=33:33:00:00:00:01:ac:86:74:d9:02:e0:86:dd SRC=fe80:0000:0000:0000:ae86:74ff:fed9:02e0 DST=ff02:0000:0000:0000:0000:0000:0000:0001 LEN=52 TC=0 HOPLIMIT=1 FLOWLBL=822758 PROTO=UDP SPT=16962 DPT=16962 LEN=12
Sep 3 13:16:31 OMG-3CX-VOIP kernel: [61723.294381] iptables[DOS]: IN=eth0 OUT= MAC=33:33:00:00:00:01:ac:86:74:d9:02:e0:86:dd SRC=fe80:0000:0000:0000:ae86:74ff:fed9:02e0 DST=ff02:0000:0000:0000:0000:0000:0000:0001 LEN=52 TC=0 HOPLIMIT=1 FLOWLBL=822758 PROTO=UDP SPT=16962 DPT=16962 LEN=12
Sep 3 13:16:41 OMG-3CX-VOIP kernel: [61733.303231] iptables[DOS]: IN=eth0 OUT= MAC=33:33:00:00:00:01:ac:86:74:d9:02:e0:86:dd SRC=fe80:0000:0000:0000:ae86:74ff:fed9:02e0 DST=ff02:0000:0000:0000:0000:0000:0000:0001 LEN=52 TC=0 HOPLIMIT=1 FLOWLBL=822758 PROTO=UDP SPT=16962 DPT=16962 LEN=12
Sep 3 13:16:51 OMG-3CX-VOIP kernel: [61743.315151] iptables[DOS]: IN=eth0 OUT= MAC=33:33:00:00:00:01:ac:86:74:d9:02:e0:86:dd SRC=fe80:0000:0000:0000:ae86:74ff:fed9:02e0 DST=ff02:0000:0000:0000:0000:0000:0000:0001 LEN=52 TC=0 HOPLIMIT=1 FLOWLBL=822758 PROTO=UDP SPT=16962 DPT=16962 LEN=12

 

[AWS2P]

by hasard did you set in openmesh devices syslog server settings pointing on your pbx ?

 

[DaveB-Opt]

by hasard did you set in openmesh devices syslog server settings pointing on your pbx ?

I don't remember configuring a syslog server on my instance.
I'm struggling to find the settings for it - where about's are they?

 

[AWS2P]

if you have OM wifi devices on your LAN then you should have an online account manager on which you can have access to all settings used on your OM devices , this is from here where you have to search if a syslog setting is on and perhaps pointing on same computer as your PBX server

 

[AWS2P]

don't know if this can help to check on PBX machine
https://www.howtoforge.com/tutorial/rsyslog-centralized-log-server-in-debian-9/

 

[cobaltit]

Well, I used a lot of OpenMesh in the past so I recognize the OUI but yes, if you didn't, you can look it up as @JohnS_3CX mentioned. And no I wouldn't worry about the entries, it's just log spam.

 

[cobaltit]

And it's not OpenMesh sending stuff to 3CX as a syslog server. It's simply IP tables seeing the traffic OpenMesh is generating.

 

[SweetAction]

Long time OpenMesh Installer here.

cobaltit is correct when he mentions that OM does does weird things with APs.
The long story short of it is.... OM built their own AP roaming system and uses some VLANs to pass that traffic around. Newer versions of the firmware offer true 802.11r, but not default enabled. Depending on your switches and how you have things configured, you could see strange network behavior. See: https://kb.datto.com/hc/en-us/articles/360024059271 and https://kb.datto.com/hc/en-us/articles/360023805232-Client-Roaming-Frequently-Asked-Questions

 

[AWS2P]

Mine are always sticked as "beta" for 802.11r feature.

For syslog settings this exist in advanced settings