SG-1100 - Ntopng Network Discovery finds strange 15.xxx addresses on disconnected OPT port
-
@johnpoz Thanks for the help everyone, I appreciate!
The MAC address stays the same. It's indeed the MAC of the board manufacturer like stephenw10 says.
The monitored interfaces are only LAN and OPT. The WAN port is excluded in the ntopng config. Also the WAN interface listens to a 192.178 address because the 1100 box is only separating the LAB from the LAN.
On the WAN port there are no rules except to block private and bogon networks. So everything is dropped.
I have only ntopng running as a package, further a minimal install.
I am not sure but I would think normal behaviour would be to see all your regular devices and this Globalscale device in every interface with identical MAC addresses and the different IP's of the firewall interfaces, like you see below:
On interface mvneta0.4091 / LAN port I see:
10.10.10.1 [name of host] Globalscale Technologies, Inc. Globalsc_MACOn interface mvneta0.4092 interface / OPT port I see:
10.20.20.1 [no hostname] Globalscale Technologies, Inc. Globalsc_MACIt stayed like this for many hours and now again the 10.20.20.1 changed to the 15.xxx.xxx address? I am really breaking my head this.
I have only 1 computer directly connected to the LAN port. This is the interface that shows the correct IP.
The WAN port is directly connected to the ISP modem.
The OPT port > mvneta0.4092 is connected to nothing and sometimes I have connected a Synology NAS which I pulled out a couple of times for testing but the Synology has a 10.xx address.
The 15.xx address brings me to DXC US Latin America Corporation (ESLAC) which says me nothing.
Thanks again for any help or ideas you could provide!
-
This could simply be a bug in ntopng’s active discovery code. Compared to the main ntopng code, it’s rather immature and little used. I do not recommend it.
-
Do you have any custom outbound NAT rules on OPT?
-
@dennypage Thanks for the input! Interesting idea. I thought about it but I am not familiar with the source code and the inner workings of ntopng.
Do you have any ideas about how a bug could result in a strange public ip addresses being sticked on the ip address of the interface?
There has to be some way it's getting this public ip's.
I still want to find out what's happening here but do you have any recommendations for monitoring egress traffic totals for a specific firewall rule? For example xx mb per month?
Thanks again!
-
@stephenw10 Thanks again Stephen. The only NAT rules are two automatic generated outbound NAT rules on the WAN interface.
Interface WAN - Source [127.0.0.0, 10.10.10.1, 10.20.20.1]
NAT address = WAN address -
I found something when looking in the States table on the SG-1100.
It seems that every time I run network discovery on ntopng, a connection is being opened FROM my WAN interface TO exactly the same 15.xxx ip address that is being sticked on the OPT interface.
WAN tcp 192.xxx.xxx.xxx:51949 -> 15.179.xxx.xxx:22 SYN_SENT:CLOSED 2 / 0 120 B / 0 B
WAN tcp 192.xxx.xxx.xxx:62155 -> 15.179.xxx.xxx:80 SYN_SENT:CLOSED 2 / 0 120 B / 0 BIt's trying to connect to port 20 and 80 on this address.
The WAN interface has almost no configuration. It get's a 192.168.xxx.xxx address from the ISP router, IPv6 is turned off and it block private and bogon networks. That's it.
Can someone explain this?
-
@JohnUtiu said in SG-1100 - Ntopng Network Discovery finds strange 15.xxx addresses on disconnected OPT port:
Do you have any ideas about how a bug could result in a strange public ip addresses being sticked on the ip address of the interface?
The last two ntopng core dumps that were brought to my attention were memory corruption resulting from the use of active network discovery.
-
@JohnUtiu said in SG-1100 - Ntopng Network Discovery finds strange 15.xxx addresses on disconnected OPT port:
WAN tcp 192.xxx.xxx.xxx:51949 -> 15.179.xxx.xxx:22 SYN_SENT:CLOSED 2 / 0 120 B / 0 B
WAN tcp 192.xxx.xxx.xxx:62155 -> 15.179.xxx.xxx:80 SYN_SENT:CLOSED 2 / 0 120 B / 0 BAccording to ipinfo.io and the RIPE db the IP range 15.179.0.0 to 15.188.255.255 is part of Amazon Technologies Inc..
You got an Amazon device that calls home?
-
@JohnUtiu said in SG-1100 - Ntopng Network Discovery finds strange 15.xxx addresses on disconnected OPT port:
WAN tcp 192.xxx.xxx.xxx:51949 -> 15.179.xxx.xxx:22 SYN_SENT:CLOSED 2 / 0 120 B / 0 B
If that is not your address, why are you hiding it? Like me hiding that making a connection to 8.8.x.x ???
-
@patient0 said in SG-1100 - Ntopng Network Discovery finds strange 15.xxx addresses on disconnected OPT port:
According to ipinfo.io and the RIPE db the IP range 15.179.0.0 to 15.188.255.255 is part of Amazon Technologies Inc..
You got an Amazon device that calls home?
More likely it's ntopng itself.
-
@JohnUtiu said in SG-1100 - Ntopng Network Discovery finds strange 15.xxx addresses on disconnected OPT port:
It seems that every time I run network discovery on ntopng, a connection is being opened FROM my WAN interface TO exactly the same 15.xxx ip address that is being sticked on the OPT interface.
WAN tcp 192.xxx.xxx.xxx:51949 -> 15.179.xxx.xxx:22 SYN_SENT:CLOSED 2 / 0 120 B / 0 B
WAN tcp 192.xxx.xxx.xxx:62155 -> 15.179.xxx.xxx:80 SYN_SENT:CLOSED 2 / 0 120 B / 0 BIt's trying to connect to port 20 and 80 on this address.
Where are you geographically?
-
@dennypage said in SG-1100 - Ntopng Network Discovery finds strange 15.xxx addresses on disconnected OPT port:
More likely it's ntopng itself.
Yeah and if some public internet IP wasn't obfuscated we could prob look up its PTR and glean some insight to what is is..
You want help identifying what some odd public IP is, which you know isn't your actual IP, or the IP of your gateway from your isp - why are you hiding it.. Why are you hiding your rfc1918 IP as well?
-
@JohnUtiu said in SG-1100 - Ntopng Network Discovery finds strange 15.xxx addresses on disconnected OPT port:
WAN tcp 192.xxx.xxx.xxx:51949 -> 15.179.xxx.xxx:22 SYN_SENT:CLOSED 2 / 0 120 B / 0 B
WAN tcp 192.xxx.xxx.xxx:62155 -> 15.179.xxx.xxx:80 SYN_SENT:CLOSED 2 / 0 120 B / 0 BIt's trying to connect to port 20 and 80 on this address.
Btw, assume that you meant port 22 rather than port 20. This is ssh.
Some of the (really bad) things ntopng does when active discovery is enabled is to run ssh, snmp and http probes against hosts it finds in the network.
-
@dennypage Thanks for your input and ideas Denny! Your're right, I was talking about port 22. I also believe it could be something ntopng does. It's a really clean and simple install of a SG-1100 with only a computer and a NAS in separate section of a LAN. But I can't think of any reason for the 15.xxx address.
-
@patient0 Thanks for the input patien0, I only have a computer and a NAS. No Amazon tech here.
And @johnpoz You are totally right about the ip masking, just a habit I guess, but maybe it's useful to provide some more detailed ip info for troubleshooting as I am sure the ip has nothing to do with me.
15.179.219.190
15.195.195.181 -
@JohnUtiu said in SG-1100 - Ntopng Network Discovery finds strange 15.xxx addresses on disconnected OPT port:
ntopng ... on a Netgate 1100
FYI Netgate marks that package as "requires SSD" due to the usually high I/O generated:
https://www.netgate.com/supported-pfsense-plus-packagesYou might check https://docs.netgate.com/pfsense/en/latest/troubleshooting/disk-lifetime.html.
-
@SteveITS Sorry for the delay. Thanks a lot for this information! I have uninstalled the package. @dennypage was also did not recommend it.
Thanks everyone! -
@JohnUtiu Too bad, we could not find out what was going one with the 15.xxx ip's. Maybe the ntopng community has an idea about it. I will let you know if I find out what was going on.
