Ok so every 5 mins something is trying to communicate with an ip address (69.42.215.252) but it seems like it is coming from my ipfire box itself. Ive watched on tshark and dont see this ip address show up at all in the logs
EDIT: this is happening when /usr/bin/ddns update-all is kicking off at 5 min intervals
anyone know how to exclude this from the drop hostile entries?