Firewall Blocking Unknown LAN Address
-
The packets could also come from anonther not connected network adapter. So have you checked the Windows machines yet?
I'd something similar in my LAN from a not connected TAP adapter on a Windows PC.Link-local addresses are not routable so they must be originating from the same network segment, LAN in this case.
-
it could be some other device as well, I have a wireless bridge for directv that uses that 169 range as link local, but there is no way to turn it off or disable that functionality. Its pretty freaking lame if you ask me.
Yeah it can cause some noise in your logs, best to just not log it if you don't like the noise.
You can hit it via http on its actual IP it gets from dhcp.. And get lots of info and show the 169.x address
Vendor:LINKSYS
ModelName:WVBR0-25-USbr0 Link encap:Ethernet HWaddr BC:30:7D:B0:48:0C
inet addr:169.254.96.229 Bcast:0.0.0.0 Mask:255.255.0.0
inet6 addr: fe80::be30:7dff:feb0:480c/64 Scope:Link -
@kpa:
Link-local addresses are not routable so they must be originating from the same network segment, LAN in this case.
I know, I know, but Windows (and as I know also other systems) sends it out to the connected LAN interface, while the link-local address is assigned to another interface.
-
@kpa:
Link-local addresses are not routable so they must be originating from the same network segment, LAN in this case.
I know, I know, but Windows (and as I know also other systems) sends it out to the connected LAN interface, while the link-local address is assigned to another interface.
Are you sure about that? That would be violation of the specification that states that the link-local addresses must be local to the broadcast domain and can not cross routers. The only scenario where such TAP adapter and its link-local address would be visible if it's bridged with the LAN adapter.
-
No, it didn't come across a router, just across Windows. ;)
Same thing, if I assign 2 IPs in different ranges to 2 different network card on on PC, lets say one is in LAN1 and the other in LAN2, I can access the PC (Windows firewall disabled) by the LAN2 address over LAN1 interface. -
So I tried accessing the IP address using http and sure enough I get my dd-wrt wireless access point where I am sharing the connected USB drive using SAMBA.
Any thoughts on what could be happening before I take this issue over to the dd-wrt forum? I don't really understand what is happening, but I would really appreciate it if someone can help me phrase the issue so that I can convey the problem on the dd-wrt forum if this is considered a problem.
-
So I tried accessing the IP address using http and sure enough I get my dd-wrt wireless access point where I am sharing the connected USB drive using SAMBA.
Any thoughts on what could be happening before I take this issue over to the dd-wrt forum? I don't really understand what is happening, but I would really appreciate it if someone can help me phrase the issue so that I can convey the problem on the dd-wrt forum if this is considered a problem.
Does the dd-wrt device have a proper IP address either from DHCP or a static address? The intention of the link-local address is to provide means to access a host even if it does not have a DHCP/static configured address, that's how it works on IPv6. On IPv4 it's not well defined when a host should use a link-local address, it could be that the dd-wrt is using one even if the interfaces have proper IPv4 addresses configured.
-
so your sure its the dd-wrt machine? you have tracked the 169 by mac?
-
The 169 does not show up in the arp table. When I use http on the 169.254.255.1 address, it pulls up my dd-wrt admin page. The dd-wrt access point also has a valid LAN address where I normally access the admin page.
I did a tracert on the 169.254.255.1 and it comes back with my dd-wrt access point name.
-
well trace on that will just follow your default route out. So if that is your dd-wrt box then that is where it would end up sure..
To find it by mac, you say your logging firewall hits on it - so just sniff for (packet capture) on pfsense on the interface your seeing the logs and then you will know what mac is sending out the traffic.
-
Is there a software to view the packet download file? I tried opening it in notepad++, but it does not look like it is a text file. some information can be read, but I see anything resembling a MAC.
-
Wireshark would be the software I would suggest. Its free, but if all your looking for is the mac, just turn the details to full and you will see the mac in the details presented when you stop the capture you don't have to download it and open it.
But sure wireshark will show you all the details, mac and everything..
-
The 169 UDP broadcast is definitely coming from my dd-wrt access point that has Samba running to share a connected USB drive.
Don't know if this is normal, but I posted a question in the dd-wrt forum.
