Back in the dark ages when I ran stock Tomato 1.28 on a WRT54GL, I liked to set the inbound connection logging to log WAN-to-LAN connections that the router's firewall allowed. I've noticed in the Toastman builds, however, that the log quickly gets full of things like this: Code: Jan 13 09:25:14 router user.warn kernel: ACCEPT IN=vlan2 OUT= MACSRC=00:24:c4:27:81:d9 MACDST=ff:ff:ff:ff:ff:ff MACPROTO=0800 SRC=10.22.64.1 DST=255.255.255.255 LEN=399 TOS=0x00 PREC=0x00 TTL=255 ID=34489 PROTO=UDP SPT=67 DPT=68 LEN=379 It seems this is someone or something trying to broadcast to my LAN on UDP port 68. Is there a way to make the log only show actual connections, as it used to? Also, what are these weird UDP connections and why is the firewall allowing them through? Edit: The source MAC is the same as the MAC of my WAN gateway - not my cable modem but whatever the cable modem talks to. But the reported IP in the log (10.22.64.1) is different than the IP that shows for that MAC in the Active Devices page. Not sure what's going on there. Thanks!