It seems that my Mac is trying to contact the default IP of my Surf SOHO MK3. I don’t have the knowledge to understand what the log is telling me. I was hoping someone could give me a clue as to what is going on.
Firewall: Denied CONN=lan MAC=XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX SRC=192.168.YYY.YYY DST=192.168.50.1 LEN=64 TOS=0x00 PREC=0x00 TTL=63 ID=0 DF PROTO=TCP SPT=51597 DPT=80 WINDOW=65535 RES=0x00 SYN URGP=0 MARK=0x2
That log shows your MAC trying to connect to port 80 (ie http) on the SOHO router. Do you have a browser open to the web admin UI? Some browsers show a thumbnail of the most recently visited pages on startup and update the thumbnail on each launch - maybe it was that?
I’m not sure what you mean by “thumbnail” or why one would generate these odd calls. To me a thumbnail is a small image like the one next to your name. Is there another meaning that I am unaware of?
Here is an example on Chrome (taken from this page which has more info):
See how this start page is showing images of the most visited websites? That is what I was guessing, that you have been repeatedly to the web ui recently and so your browser might be trying to show you updated renders of your most visited sites including the router interface (which fails because you have it blocked).
Guess one way to check would be to start your browser and see if the time of start coincides with a logged event, or install a personal software firewall on your device and get that to block access to your router too and ask for notification when an app tries to access it.
Now I see what you mean. After some investigation it looks like the source port is Apple’s SAN which makes sense because this is a work laptop and might be trying to access a network drive. It’s just puzzling as to why the call was directed there. I’ve changed the defaults and I would like to think OSX would realize that.