I have observed that one computer on my home network (192.168.1.60) is trying to access port 631 of my main computer (192.168.1.253). I'm not carrying out any printing. I would want to know if there is a security problem.
This is from /var/log/ufw.log. It's happening since August 3 2021.
Aug 30 09:57:19 skunkworks kernel: [ 3150.549098] [UFW BLOCK] IN=enp1s0f0 OUT= MAC=10:dd:b1:ea:b8:8b:74:e5:0b:39:e8:20:08:00 SRC=192.168.1.60 DST=192.168.1.253 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=52383 DF PROTO=TCP SPT=32864 DPT=631 WINDOW=64240 RES=0x00 SYN URGP=0
Aug 30 09:57:21 skunkworks kernel: [ 3152.832252] [UFW BLOCK] IN=enp1s0f0 OUT= MAC=10:dd:b1:ea:b8:8b:74:e5:0b:39:e8:20:08:00 SRC=192.168.1.60 DST=192.168.1.253 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=9216 DF PROTO=TCP SPT=32866 DPT=631 WINDOW=64240 RES=0x00 SYN URGP=0
Aug 30 09:57:22 skunkworks kernel: [ 3153.845528] [UFW BLOCK] IN=enp1s0f0 OUT= MAC=10:dd:b1:ea:b8:8b:74:e5:0b:39:e8:20:08:00 SRC=192.168.1.60 DST=192.168.1.253 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=9217 DF PROTO=TCP SPT=32866 DPT=631 WINDOW=64240 RES=0x00 SYN URGP=0
Aug 30 09:57:25 skunkworks kernel: [ 3156.221825] [UFW BLOCK] IN=enp1s0f0 OUT= MAC=10:dd:b1:ea:b8:8b:74:e5:0b:39:e8:20:08:00 SRC=192.168.1.60 DST=192.168.1.253 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=38839 DF PROTO=TCP SPT=32870 DPT=631 WINDOW=64240 RES=0x00 SYN URGP=0
Aug 30 09:57:26 skunkworks kernel: [ 3157.223484] [UFW BLOCK] IN=enp1s0f0 OUT= MAC=10:dd:b1:ea:b8:8b:74:e5:0b:39:e8:20:08:00 SRC=192.168.1.60 DST=192.168.1.253 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=38840 DF PROTO=TCP SPT=32870 DPT=631 WINDOW=64240 RES=0x00 SYN URGP=0
Aug 30 09:57:28 skunkworks kernel: [ 3159.735831] [UFW BLOCK] IN=enp1s0f0 OUT= MAC=10:dd:b1:ea:b8:8b:74:e5:0b:39:e8:20:08:00 SRC=192.168.1.60 DST=192.168.1.253 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=59238 DF PROTO=TCP SPT=32874 DPT=631 WINDOW=64240 RES=0x00 SYN URGP=0
Aug 30 09:57:29 skunkworks kernel: [ 3160.760546] [UFW BLOCK] IN=enp1s0f0 OUT= MAC=10:dd:b1:ea:b8:8b:74:e5:0b:39:e8:20:08:00 SRC=192.168.1.60 DST=192.168.1.253 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=59239 DF PROTO=TCP SPT=32874 DPT=631 WINDOW=64240 RES=0x00 SYN URGP=0
This traffic is first observed when 192.168.1.60 boots, before any user is logged in. It also happens randomly after logging in.
Ufw blocks it. I'm not carrying out any printer activity on 192.168.1.60. It has neither local, USB, or network printers configured. 192.168.1.253 does have a shared printer, but it's behind the firewall. (It is shared in order to print from local VMs).
Does this activity indicate that 192.168.1.60 may be compromised?
Could it be that 192.168.1.60 is just trying to discover printers on the network?
Both computers are Ubuntu 20.04.3. This is the firewall of 192.168.1.253:
Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing), disabled (routed)
New profiles: skip
To Action From
-- ------ ----
224.0.0.1 DENY IN Anywhere
ff02::1 DENY IN Anywhere (v6)
Anywhere DENY OUT 224.0.0.1
Anywhere (v6) DENY OUT ff02::1
