SG-1100 - Ntopng Network Discovery finds strange 15.xxx addresses on disconnected OPT port
-
Something broadcasting to it maybe? Do you see that IP on any other port? Could be a VLAN being untagged on all ports.
-
Is that your gateway?
-
This post is deleted! -
This post is deleted! -
This post is deleted! -
@JohnUtiu said in SG-1100 - Ntopng Network Discovery finds strange 15.xxx addresses on disconnected OPT port:
MAC Address: Globalsc_XXXXXXX
What is this mac address of, you say the 15 address changes - but is the mac staying the same?
-
The Globalscale MAC will be the 1100. They are the board manufacturer.
-
@stephenw10 yeah but he says his 15.x address is changing - quite possible this is wan IP?
-
Yup could be
-
This post is deleted! -
This could simply be a bug in ntopng’s active discovery code. Compared to the main ntopng code, it’s rather immature and little used. I do not recommend it.
-
Do you have any custom outbound NAT rules on OPT?
-
This post is deleted! -
This post is deleted! -
This post is deleted! -
@JohnUtiu said in SG-1100 - Ntopng Network Discovery finds strange 15.xxx addresses on disconnected OPT port:
Do you have any ideas about how a bug could result in a strange public ip addresses being sticked on the ip address of the interface?
The last two ntopng core dumps that were brought to my attention were memory corruption resulting from the use of active network discovery.
-
@JohnUtiu said in SG-1100 - Ntopng Network Discovery finds strange 15.xxx addresses on disconnected OPT port:
WAN tcp 192.xxx.xxx.xxx:51949 -> 15.179.xxx.xxx:22 SYN_SENT:CLOSED 2 / 0 120 B / 0 B
WAN tcp 192.xxx.xxx.xxx:62155 -> 15.179.xxx.xxx:80 SYN_SENT:CLOSED 2 / 0 120 B / 0 BAccording to ipinfo.io and the RIPE db the IP range 15.179.0.0 to 15.188.255.255 is part of Amazon Technologies Inc..
You got an Amazon device that calls home?
-
@JohnUtiu said in SG-1100 - Ntopng Network Discovery finds strange 15.xxx addresses on disconnected OPT port:
WAN tcp 192.xxx.xxx.xxx:51949 -> 15.179.xxx.xxx:22 SYN_SENT:CLOSED 2 / 0 120 B / 0 B
If that is not your address, why are you hiding it? Like me hiding that making a connection to 8.8.x.x ???
-
@patient0 said in SG-1100 - Ntopng Network Discovery finds strange 15.xxx addresses on disconnected OPT port:
According to ipinfo.io and the RIPE db the IP range 15.179.0.0 to 15.188.255.255 is part of Amazon Technologies Inc..
You got an Amazon device that calls home?
More likely it's ntopng itself.
-
@JohnUtiu said in SG-1100 - Ntopng Network Discovery finds strange 15.xxx addresses on disconnected OPT port:
It seems that every time I run network discovery on ntopng, a connection is being opened FROM my WAN interface TO exactly the same 15.xxx ip address that is being sticked on the OPT interface.
WAN tcp 192.xxx.xxx.xxx:51949 -> 15.179.xxx.xxx:22 SYN_SENT:CLOSED 2 / 0 120 B / 0 B
WAN tcp 192.xxx.xxx.xxx:62155 -> 15.179.xxx.xxx:80 SYN_SENT:CLOSED 2 / 0 120 B / 0 BIt's trying to connect to port 20 and 80 on this address.
Where are you geographically?
