Strange connections to 1701, 4500 and 500, 2408 ports
-
So, I noticed something strange and ran a capture and this is the result. I am also seeing ARP requests for this IP address which is not even on my subnet.
I see a lot of traffic being generated to a IP
162.159.192.4 to ports 1701, 4500, 2408 and 500.
Any idea what this could be? As it is certainly not traffic I am generating.
The address at 172.16.101.12 is my Laptop, running Ubuntu 22.04.
Attached is the capture.
Thanks!
-
@deanfourie well clearly it is traffic your generating - your client is the source of the of the traffic.. That is a clouldflare IP.
2408 is their old railgun product port.. Not real clear on how it actually works, it is being deprecated though.. 4500 is ESP, and 500 is ISAKMP..
But all those are coming from your 172.16.101.12 IP..
Those arps are not from your laptop, but most likely your router? 172.16.101.1 is asking about that IP.. from a sophos device.
You doing anything with WARP from cloudflare?
WARP UDP ports
WARP utilizes UDP for all of its communications. By default, the UDP port required for WARP is UDP 2408. WARP can fallback to UDP 500, UDP 1701, or UDP 4500.
Before you log in to your Zero Trust organization, you may see the IPv4 range 162.159.192.0/24. This IP is used for consumer WARP services (1.1.1.1 w/ WARP) and is not required for Zero Trust deployments.
-
@johnpoz Yea sorry just after I posted this I figured out it was WARP haha.
WARP was being blocked and obviously falling back to use IPsec etc.
I opened 2408 and away she goes, problem solved. Also, I've not had to open 2408 before because usually I am using WARP with zero trust, however this is not supported on Linux so now it is using 2408 which is new, hence the confusion.
Sorry my bad.
