SG-1100 - Ntopng Network Discovery finds strange 15.xxx addresses on disconnected OPT port
-
Do you have any custom outbound NAT rules on OPT?
-
@dennypage Thanks for the input! Interesting idea. I thought about it but I am not familiar with the source code and the inner workings of ntopng.
Do you have any ideas about how a bug could result in a strange public ip addresses being sticked on the ip address of the interface?
There has to be some way it's getting this public ip's.
I still want to find out what's happening here but do you have any recommendations for monitoring egress traffic totals for a specific firewall rule? For example xx mb per month?
Thanks again!
-
@stephenw10 Thanks again Stephen. The only NAT rules are two automatic generated outbound NAT rules on the WAN interface.
Interface WAN - Source [127.0.0.0, 10.10.10.1, 10.20.20.1]
NAT address = WAN address -
I found something when looking in the States table on the SG-1100.
It seems that every time I run network discovery on ntopng, a connection is being opened FROM my WAN interface TO exactly the same 15.xxx ip address that is being sticked on the OPT interface.
WAN tcp 192.xxx.xxx.xxx:51949 -> 15.179.xxx.xxx:22 SYN_SENT:CLOSED 2 / 0 120 B / 0 B
WAN tcp 192.xxx.xxx.xxx:62155 -> 15.179.xxx.xxx:80 SYN_SENT:CLOSED 2 / 0 120 B / 0 BIt's trying to connect to port 20 and 80 on this address.
The WAN interface has almost no configuration. It get's a 192.168.xxx.xxx address from the ISP router, IPv6 is turned off and it block private and bogon networks. That's it.
Can someone explain this?
-
@JohnUtiu said in SG-1100 - Ntopng Network Discovery finds strange 15.xxx addresses on disconnected OPT port:
Do you have any ideas about how a bug could result in a strange public ip addresses being sticked on the ip address of the interface?
The last two ntopng core dumps that were brought to my attention were memory corruption resulting from the use of active network discovery.
-
@JohnUtiu said in SG-1100 - Ntopng Network Discovery finds strange 15.xxx addresses on disconnected OPT port:
WAN tcp 192.xxx.xxx.xxx:51949 -> 15.179.xxx.xxx:22 SYN_SENT:CLOSED 2 / 0 120 B / 0 B
WAN tcp 192.xxx.xxx.xxx:62155 -> 15.179.xxx.xxx:80 SYN_SENT:CLOSED 2 / 0 120 B / 0 BAccording to ipinfo.io and the RIPE db the IP range 15.179.0.0 to 15.188.255.255 is part of Amazon Technologies Inc..
You got an Amazon device that calls home?
-
@JohnUtiu said in SG-1100 - Ntopng Network Discovery finds strange 15.xxx addresses on disconnected OPT port:
WAN tcp 192.xxx.xxx.xxx:51949 -> 15.179.xxx.xxx:22 SYN_SENT:CLOSED 2 / 0 120 B / 0 B
If that is not your address, why are you hiding it? Like me hiding that making a connection to 8.8.x.x ???
-
@patient0 said in SG-1100 - Ntopng Network Discovery finds strange 15.xxx addresses on disconnected OPT port:
According to ipinfo.io and the RIPE db the IP range 15.179.0.0 to 15.188.255.255 is part of Amazon Technologies Inc..
You got an Amazon device that calls home?
More likely it's ntopng itself.
-
@JohnUtiu said in SG-1100 - Ntopng Network Discovery finds strange 15.xxx addresses on disconnected OPT port:
It seems that every time I run network discovery on ntopng, a connection is being opened FROM my WAN interface TO exactly the same 15.xxx ip address that is being sticked on the OPT interface.
WAN tcp 192.xxx.xxx.xxx:51949 -> 15.179.xxx.xxx:22 SYN_SENT:CLOSED 2 / 0 120 B / 0 B
WAN tcp 192.xxx.xxx.xxx:62155 -> 15.179.xxx.xxx:80 SYN_SENT:CLOSED 2 / 0 120 B / 0 BIt's trying to connect to port 20 and 80 on this address.
Where are you geographically?
-
@dennypage said in SG-1100 - Ntopng Network Discovery finds strange 15.xxx addresses on disconnected OPT port:
More likely it's ntopng itself.
Yeah and if some public internet IP wasn't obfuscated we could prob look up its PTR and glean some insight to what is is..
You want help identifying what some odd public IP is, which you know isn't your actual IP, or the IP of your gateway from your isp - why are you hiding it.. Why are you hiding your rfc1918 IP as well?
-
@JohnUtiu said in SG-1100 - Ntopng Network Discovery finds strange 15.xxx addresses on disconnected OPT port:
WAN tcp 192.xxx.xxx.xxx:51949 -> 15.179.xxx.xxx:22 SYN_SENT:CLOSED 2 / 0 120 B / 0 B
WAN tcp 192.xxx.xxx.xxx:62155 -> 15.179.xxx.xxx:80 SYN_SENT:CLOSED 2 / 0 120 B / 0 BIt's trying to connect to port 20 and 80 on this address.
Btw, assume that you meant port 22 rather than port 20. This is ssh.
Some of the (really bad) things ntopng does when active discovery is enabled is to run ssh, snmp and http probes against hosts it finds in the network.
-
@dennypage Thanks for your input and ideas Denny! Your're right, I was talking about port 22. I also believe it could be something ntopng does. It's a really clean and simple install of a SG-1100 with only a computer and a NAS in separate section of a LAN. But I can't think of any reason for the 15.xxx address.
-
@patient0 Thanks for the input patien0, I only have a computer and a NAS. No Amazon tech here.
And @johnpoz You are totally right about the ip masking, just a habit I guess, but maybe it's useful to provide some more detailed ip info for troubleshooting as I am sure the ip has nothing to do with me.
15.179.219.190
15.195.195.181 -
@JohnUtiu said in SG-1100 - Ntopng Network Discovery finds strange 15.xxx addresses on disconnected OPT port:
ntopng ... on a Netgate 1100
FYI Netgate marks that package as "requires SSD" due to the usually high I/O generated:
https://www.netgate.com/supported-pfsense-plus-packagesYou might check https://docs.netgate.com/pfsense/en/latest/troubleshooting/disk-lifetime.html.
-
@SteveITS Sorry for the delay. Thanks a lot for this information! I have uninstalled the package. @dennypage was also did not recommend it.
Thanks everyone! -
@JohnUtiu Too bad, we could not find out what was going one with the 15.xxx ip's. Maybe the ntopng community has an idea about it. I will let you know if I find out what was going on.
