Odd System Log Entries-

Discussions for BiPAC 8900 series: 8900AX-1600, 8900AX-2400, 8900X
Post Reply
rich4596
Posts: 16
Joined: Thu Nov 21, 2019 8:03 pm

Odd System Log Entries-

Post by rich4596 »

8900 AX 2400, firmware d46

Noticed an unusal string of entries in the System log this evening. Anyone have any clue what they could be in response to?

There's nothing in the security log other than the usual multiple kern alert kernel: Intrusion -> TCP packet from [ppp1.1] xxx.xxx.xxx. which are usual port scans.

Extract of System Log-

Mar 8 19:26:40 kern warn kernel: upnp/2533: potentially unexpected fatal signal 11.
Mar 8 19:26:40 kern warn kernel: Cpu 1
Mar 8 19:26:40 kern warn kernel: $ 0 : 00000000 10008d01 00000000
Mar 8 19:26:40 kern info kernel: 00419418
Mar 8 19:26:40 kern warn kernel: $ 4 :
Mar 8 19:26:40 kern info kernel: 00000000
Mar 8 19:26:40 kern info kernel: 00419cd8 00000400
Mar 8 19:26:40 kern info kernel: 00000001
Mar 8 19:26:40 kern warn kernel: $ 8 :
Mar 8 19:26:40 kern info kernel: 00000000
Mar 8 19:26:40 kern info kernel: 00000fa3
Mar 8 19:26:40 kern info kernel: 800b28c8
Mar 8 19:26:40 kern info kernel: fffffff8
Mar 8 19:26:40 kern warn kernel: $12 :
Mar 8 19:26:40 kern info kernel: c037452c
Mar 8 19:26:40 kern info kernel: c0374530
Mar 8 19:26:40 kern info kernel: 000378a5
Mar 8 19:26:40 kern info kernel: 00000000
Mar 8 19:26:40 kern warn kernel: $16 :
Mar 8 19:26:40 kern info kernel: 0054aae4
Mar 8 19:26:40 kern info kernel: 0054a1e4
Mar 8 19:26:40 kern info kernel: 00000000
Mar 8 19:26:40 kern info kernel: 0054986c
Mar 8 19:26:40 kern warn kernel: $20 :
Mar 8 19:26:40 kern info kernel: 00549204
Mar 8 19:26:40 kern info kernel: 005491e4
Mar 8 19:26:40 kern info kernel: 005491c4
Mar 8 19:26:40 kern info kernel: 00419018
Mar 8 19:26:40 kern warn kernel: $24 : 00000000 7731a7e0
Mar 8 19:26:40 kern info kernel:
Mar 8 19:26:40 kern info kernel:
Mar 8 19:26:40 kern warn kernel: $28 : 00434340 7fff64f0 00419164 00412140
Mar 8 19:26:40 kern warn kernel: Hi : 00000000
Mar 8 19:26:41 kern warn kernel: Lo : 3b9aca00
Mar 8 19:26:41 kern warn kernel: epc : 7731a7e0 0x7731a7e0
Mar 8 19:26:41 kern warn kernel: Tainted: P
Mar 8 19:26:41 kern warn kernel: ra : 00412140 0x412140
Mar 8 19:26:41 kern warn kernel: Status: 00008d13 USER EXL IE
Mar 8 19:26:41 kern warn kernel: Cause : 00000008
Mar 8 19:26:41 kern warn kernel: BadVA : 00000000
Mar 8 19:26:41 kern warn kernel: PrId : 0002a080 (Broadcom BMIPS4350)

Thanks!
billion_fan
Posts: 5374
Joined: Tue Jul 19, 2011 4:30 pm

Re: Odd System Log Entries-

Post by billion_fan »

rich4596 wrote: Mon Mar 08, 2021 9:10 pm 8900 AX 2400, firmware d46

Noticed an unusal string of entries in the System log this evening. Anyone have any clue what they could be in response to?

There's nothing in the security log other than the usual multiple kern alert kernel: Intrusion -> TCP packet from [ppp1.1] xxx.xxx.xxx. which are usual port scans.

Extract of System Log-

Mar 8 19:26:40 kern warn kernel: upnp/2533: potentially unexpected fatal signal 11.
Mar 8 19:26:40 kern warn kernel: Cpu 1
Mar 8 19:26:40 kern warn kernel: $ 0 : 00000000 10008d01 00000000
Mar 8 19:26:40 kern info kernel: 00419418
Mar 8 19:26:40 kern warn kernel: $ 4 :
Mar 8 19:26:40 kern info kernel: 00000000
Mar 8 19:26:40 kern info kernel: 00419cd8 00000400
Mar 8 19:26:40 kern info kernel: 00000001
Mar 8 19:26:40 kern warn kernel: $ 8 :
Mar 8 19:26:40 kern info kernel: 00000000
Mar 8 19:26:40 kern info kernel: 00000fa3
Mar 8 19:26:40 kern info kernel: 800b28c8
Mar 8 19:26:40 kern info kernel: fffffff8
Mar 8 19:26:40 kern warn kernel: $12 :
Mar 8 19:26:40 kern info kernel: c037452c
Mar 8 19:26:40 kern info kernel: c0374530
Mar 8 19:26:40 kern info kernel: 000378a5
Mar 8 19:26:40 kern info kernel: 00000000
Mar 8 19:26:40 kern warn kernel: $16 :
Mar 8 19:26:40 kern info kernel: 0054aae4
Mar 8 19:26:40 kern info kernel: 0054a1e4
Mar 8 19:26:40 kern info kernel: 00000000
Mar 8 19:26:40 kern info kernel: 0054986c
Mar 8 19:26:40 kern warn kernel: $20 :
Mar 8 19:26:40 kern info kernel: 00549204
Mar 8 19:26:40 kern info kernel: 005491e4
Mar 8 19:26:40 kern info kernel: 005491c4
Mar 8 19:26:40 kern info kernel: 00419018
Mar 8 19:26:40 kern warn kernel: $24 : 00000000 7731a7e0
Mar 8 19:26:40 kern info kernel:
Mar 8 19:26:40 kern info kernel:
Mar 8 19:26:40 kern warn kernel: $28 : 00434340 7fff64f0 00419164 00412140
Mar 8 19:26:40 kern warn kernel: Hi : 00000000
Mar 8 19:26:41 kern warn kernel: Lo : 3b9aca00
Mar 8 19:26:41 kern warn kernel: epc : 7731a7e0 0x7731a7e0
Mar 8 19:26:41 kern warn kernel: Tainted: P
Mar 8 19:26:41 kern warn kernel: ra : 00412140 0x412140
Mar 8 19:26:41 kern warn kernel: Status: 00008d13 USER EXL IE
Mar 8 19:26:41 kern warn kernel: Cause : 00000008
Mar 8 19:26:41 kern warn kernel: BadVA : 00000000
Mar 8 19:26:41 kern warn kernel: PrId : 0002a080 (Broadcom BMIPS4350)

Thanks!
Its seems the UPNP service has crashed.

Please try the following

1. Login to the router
2. Click on Advanced Setup >> UPNP
3. Disable the UPNP option and click on 'Apply'
4. Re-enable the UPNP option and click on 'Apply'
5. Check to see if these logs occur again
rich4596
Posts: 16
Joined: Thu Nov 21, 2019 8:03 pm

Re: Odd System Log Entries-

Post by rich4596 »

Rgr, thanks for that. Have cycled UPnP and will keep an eye on it. Thank you!
rich4596
Posts: 16
Joined: Thu Nov 21, 2019 8:03 pm

Re: Odd System Log Entries-

Post by rich4596 »

Still happening unfortunately. No loss of functionality, and only exhibits in the log file, just puzzling. I don't recall seeing it before ver d46


Apr 6 20:33:31 kern warn kernel: upnp/2403: potentially unexpected fatal signal 11.
Apr 6 20:33:31 kern warn kernel: Cpu 0
Apr 6 20:33:31 kern warn kernel: $ 0 : 00000000 10008d00 00000000
Apr 6 20:33:31 kern info kernel: 00419418
Apr 6 20:33:31 kern warn kernel: $ 4 : 00000000 00419cd8
Apr 6 20:33:31 kern info kernel: 00000400
Apr 6 20:33:31 kern info kernel: 00000001
Apr 6 20:33:31 kern warn kernel: $ 8 : 00000000
Apr 6 20:33:31 kern info kernel: 00000fa3 800b28c8
Apr 6 20:33:31 kern info kernel: fffffff8
Apr 6 20:33:31 kern warn kernel: $12 : c037452c
Apr 6 20:33:31 kern info kernel: 8d882a43 00068cba
Apr 6 20:33:31 kern info kernel: 00000000
Apr 6 20:33:31 kern warn kernel: $16 : 00a089f4
Apr 6 20:33:31 kern info kernel: 00a08a54 00000000
Apr 6 20:33:31 kern info kernel: 00a0886c
Apr 6 20:33:31 kern warn kernel: $20 : 00a08204
Apr 6 20:33:31 kern info kernel: 00a081e4 00a081c4
Apr 6 20:33:31 kern info kernel: 00419018
Apr 6 20:33:31 kern warn kernel: $24 : 00000001
Apr 6 20:33:31 kern info kernel: 770067e0
Apr 6 20:33:31 kern info kernel:
Apr 6 20:33:31 kern warn kernel: $28 : 00434340
Apr 6 20:33:31 kern info kernel: 7fb13a40 00419164
Apr 6 20:33:31 kern info kernel: 00412140
Apr 6 20:33:31 kern warn kernel: Hi : 088fb2fc
Apr 6 20:33:31 kern warn kernel: Lo : e5bb2a83
Apr 6 20:33:31 kern warn kernel: epc : 770067e0 0x770067e0
Apr 6 20:33:31 kern warn kernel: Tainted: P
Apr 6 20:33:31 kern warn kernel: ra : 00412140 0x412140
Apr 6 20:33:31 kern warn kernel: Status: 00008d13 USER
Apr 6 20:33:31 kern info kernel: EXL IE
Apr 6 20:33:31 kern warn kernel: Cause : 00000008
Apr 6 20:33:31 kern warn kernel: BadVA : 00000000
Apr 6 20:33:31 kern warn kernel: PrId : 0002a080 (Broadcom BMIPS4350)
billion_fan
Posts: 5374
Joined: Tue Jul 19, 2011 4:30 pm

Re: Odd System Log Entries-

Post by billion_fan »

I'll check with our engineers and get back to you :D
billion_fan
Posts: 5374
Joined: Tue Jul 19, 2011 4:30 pm

Re: Odd System Log Entries-

Post by billion_fan »

rich4596 wrote: Thu Apr 08, 2021 8:57 am Still happening unfortunately. No loss of functionality, and only exhibits in the log file, just puzzling. I don't recall seeing it before ver d46


Apr 6 20:33:31 kern warn kernel: upnp/2403: potentially unexpected fatal signal 11.
Apr 6 20:33:31 kern warn kernel: Cpu 0
Apr 6 20:33:31 kern warn kernel: $ 0 : 00000000 10008d00 00000000
Apr 6 20:33:31 kern info kernel: 00419418
Apr 6 20:33:31 kern warn kernel: $ 4 : 00000000 00419cd8
Apr 6 20:33:31 kern info kernel: 00000400
Apr 6 20:33:31 kern info kernel: 00000001
Apr 6 20:33:31 kern warn kernel: $ 8 : 00000000
Apr 6 20:33:31 kern info kernel: 00000fa3 800b28c8
Apr 6 20:33:31 kern info kernel: fffffff8
Apr 6 20:33:31 kern warn kernel: $12 : c037452c
Apr 6 20:33:31 kern info kernel: 8d882a43 00068cba
Apr 6 20:33:31 kern info kernel: 00000000
Apr 6 20:33:31 kern warn kernel: $16 : 00a089f4
Apr 6 20:33:31 kern info kernel: 00a08a54 00000000
Apr 6 20:33:31 kern info kernel: 00a0886c
Apr 6 20:33:31 kern warn kernel: $20 : 00a08204
Apr 6 20:33:31 kern info kernel: 00a081e4 00a081c4
Apr 6 20:33:31 kern info kernel: 00419018
Apr 6 20:33:31 kern warn kernel: $24 : 00000001
Apr 6 20:33:31 kern info kernel: 770067e0
Apr 6 20:33:31 kern info kernel:
Apr 6 20:33:31 kern warn kernel: $28 : 00434340
Apr 6 20:33:31 kern info kernel: 7fb13a40 00419164
Apr 6 20:33:31 kern info kernel: 00412140
Apr 6 20:33:31 kern warn kernel: Hi : 088fb2fc
Apr 6 20:33:31 kern warn kernel: Lo : e5bb2a83
Apr 6 20:33:31 kern warn kernel: epc : 770067e0 0x770067e0
Apr 6 20:33:31 kern warn kernel: Tainted: P
Apr 6 20:33:31 kern warn kernel: ra : 00412140 0x412140
Apr 6 20:33:31 kern warn kernel: Status: 00008d13 USER
Apr 6 20:33:31 kern info kernel: EXL IE
Apr 6 20:33:31 kern warn kernel: Cause : 00000008
Apr 6 20:33:31 kern warn kernel: BadVA : 00000000
Apr 6 20:33:31 kern warn kernel: PrId : 0002a080 (Broadcom BMIPS4350)
Our engineers are asking if any applications on your network are using UPNP?
rich4596
Posts: 16
Joined: Thu Nov 21, 2019 8:03 pm

Re: Odd System Log Entries-

Post by rich4596 »

That's a good question! I'm not sure it's a simple process to determine what devices and apps actually need UPnP.

The household is typical of many, with cloud-based cameras, Amazon fire TV media boxes, NAS drives and PCs running the usual mix of VPN (though I've not run the router's own L2TP/IPSEC for a few months), Teams, Skype etc etc. Then there's the kid's laptops and tablets which are constantly running a plethora of gawd-knows what multiplayer games.

I guess one approach might be to turn off UPnP on the router and seeing who shouts while checking the logs.
billion_fan
Posts: 5374
Joined: Tue Jul 19, 2011 4:30 pm

Re: Odd System Log Entries-

Post by billion_fan »

rich4596 wrote: Thu Apr 15, 2021 8:32 am That's a good question! I'm not sure it's a simple process to determine what devices and apps actually need UPnP.

The household is typical of many, with cloud-based cameras, Amazon fire TV media boxes, NAS drives and PCs running the usual mix of VPN (though I've not run the router's own L2TP/IPSEC for a few months), Teams, Skype etc etc. Then there's the kid's laptops and tablets which are constantly running a plethora of gawd-knows what multiplayer games.

I guess one approach might be to turn off UPnP on the router and seeing who shouts while checking the logs.
Leave UPNP on for now, as app like Skype and multiplayer games normally open ports, I'll update my engineers and get back to you.
Post Reply