Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    SG-1100 - Ntopng Network Discovery finds strange 15.xxx addresses on disconnected OPT port

    Scheduled Pinned Locked Moved General pfSense Questions
    28 Posts 7 Posters 1.9k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • J
      JohnUtiu
      last edited by

      Hi everyone,

      I am using ntopng Community v.6.0.240423 (FreeBSD 15.0) on a Netgate 1100 (latest software version) on a LAN.

      Everytime I run Network Discovery in ntopng for the mvneta0.4092 interface / OPT port, ntopng thinks something is connected but there is no cable in this port.

      IP: 15.xxx.xxx.xxx ,
      Manufacturer: Globalscale Technologies, Inc.
      MAC Address: Globalsc_XXXXXXX

      On every run of Network Discovery the ip address changes but it always starts with 15.

      Exactly the same MAC address also shows up on the mvneta0.4091 interface / LAN port. But there it is showing me the local (gateway) ip I use to connect to the Netgate 1100 management interface which I would expect because of the way the SG-1100 operates.

      Why do I see the local (gateway) ip on the mvneta0.4091 interface / LAN port but a strange? 15.xxx.xxx.xxx IP on the mvneta0.4092 interface / OPT port instead of the other local (gateway) ip that is configured for that interface?

      Thanks a lot for any help you could provide!

      Best regards

      John

      johnpozJ S J 3 Replies Last reply Reply Quote 0
      • stephenw10S
        stephenw10 Netgate Administrator
        last edited by

        Something broadcasting to it maybe? Do you see that IP on any other port? Could be a VLAN being untagged on all ports.

        J 2 Replies Last reply Reply Quote 1
        • JonathanLeeJ
          JonathanLee
          last edited by

          Is that your gateway?

          Make sure to upvote

          J 1 Reply Last reply Reply Quote 1
          • J
            JohnUtiu @JonathanLee
            last edited by

            @JonathanLee Thanks for your quick reply. Both mvneta0.4091 and mvneta0.4092 (LAN port and OPT port) have a gateway in the 10.xxx range.
            It's just a lab within a LAN. Mvneta0.4090 (WAN port) gets a 192 address (also internal) from a modem / router.

            1 Reply Last reply Reply Quote 0
            • J
              JohnUtiu @stephenw10
              last edited by

              @stephenw10 Thanks for your quick reply! I could not find this address anywhere else.

              Update: I did nothing but wait and now, after some hours it seems to display correctly on both interfaces.

              On interface mvneta0.4091 / LAN port I see:
              10.10.10.1 [name of host] Globalscale Technologies, Inc. Globalsc_MAC

              On interface mvneta0.4092 interface / OPT port I see:
              10.20.20.1 [no hostname] Globalscale Technologies, Inc. Globalsc_MAC

              Any idea's, based on this new information? I am a bit worried about seeing public IP's (15.xxx.xxx.xxx) in a LAN. I really do not understand this.

              1 Reply Last reply Reply Quote 0
              • J
                JohnUtiu @stephenw10
                last edited by

                @stephenw10

                VLAN setup is default for the SG-1100

                VLAN(s) table
                VLAN group VLAN tag Members Description Action
                0 1 0 Default System VLAN
                1 4090 0t,3 WAN
                2 4091 0t,2 LAN
                3 4092 0t,1 OPT

                1 Reply Last reply Reply Quote 0
                • johnpozJ
                  johnpoz LAYER 8 Global Moderator @JohnUtiu
                  last edited by

                  @JohnUtiu said in SG-1100 - Ntopng Network Discovery finds strange 15.xxx addresses on disconnected OPT port:

                  MAC Address: Globalsc_XXXXXXX

                  What is this mac address of, you say the 15 address changes - but is the mac staying the same?

                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                  If you get confused: Listen to the Music Play
                  Please don't Chat/PM me for help, unless mod related
                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                  J 1 Reply Last reply Reply Quote 2
                  • stephenw10S
                    stephenw10 Netgate Administrator
                    last edited by

                    The Globalscale MAC will be the 1100. They are the board manufacturer.

                    johnpozJ 1 Reply Last reply Reply Quote 1
                    • johnpozJ
                      johnpoz LAYER 8 Global Moderator @stephenw10
                      last edited by

                      @stephenw10 yeah but he says his 15.x address is changing - quite possible this is wan IP?

                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                      If you get confused: Listen to the Music Play
                      Please don't Chat/PM me for help, unless mod related
                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                      1 Reply Last reply Reply Quote 1
                      • stephenw10S
                        stephenw10 Netgate Administrator
                        last edited by

                        Yup could be

                        1 Reply Last reply Reply Quote 1
                        • J
                          JohnUtiu @johnpoz
                          last edited by

                          @johnpoz Thanks for the help everyone, I appreciate!

                          The MAC address stays the same. It's indeed the MAC of the board manufacturer like stephenw10 says.

                          The monitored interfaces are only LAN and OPT. The WAN port is excluded in the ntopng config. Also the WAN interface listens to a 192.178 address because the 1100 box is only separating the LAB from the LAN.

                          On the WAN port there are no rules except to block private and bogon networks. So everything is dropped.

                          I have only ntopng running as a package, further a minimal install.

                          I am not sure but I would think normal behaviour would be to see all your regular devices and this Globalscale device in every interface with identical MAC addresses and the different IP's of the firewall interfaces, like you see below:

                          On interface mvneta0.4091 / LAN port I see:
                          10.10.10.1 [name of host] Globalscale Technologies, Inc. Globalsc_MAC

                          On interface mvneta0.4092 interface / OPT port I see:
                          10.20.20.1 [no hostname] Globalscale Technologies, Inc. Globalsc_MAC

                          It stayed like this for many hours and now again the 10.20.20.1 changed to the 15.xxx.xxx address? I am really breaking my head this.

                          I have only 1 computer directly connected to the LAN port. This is the interface that shows the correct IP.

                          The WAN port is directly connected to the ISP modem.

                          The OPT port > mvneta0.4092 is connected to nothing and sometimes I have connected a Synology NAS which I pulled out a couple of times for testing but the Synology has a 10.xx address.

                          The 15.xx address brings me to DXC US Latin America Corporation (ESLAC) which says me nothing.

                          Thanks again for any help or ideas you could provide!

                          1 Reply Last reply Reply Quote 0
                          • dennypageD
                            dennypage
                            last edited by

                            This could simply be a bug in ntopng’s active discovery code. Compared to the main ntopng code, it’s rather immature and little used. I do not recommend it.

                            J 1 Reply Last reply Reply Quote 2
                            • stephenw10S
                              stephenw10 Netgate Administrator
                              last edited by

                              Do you have any custom outbound NAT rules on OPT?

                              J 1 Reply Last reply Reply Quote 0
                              • J
                                JohnUtiu @dennypage
                                last edited by

                                @dennypage Thanks for the input! Interesting idea. I thought about it but I am not familiar with the source code and the inner workings of ntopng.

                                Do you have any ideas about how a bug could result in a strange public ip addresses being sticked on the ip address of the interface?

                                There has to be some way it's getting this public ip's.

                                I still want to find out what's happening here but do you have any recommendations for monitoring egress traffic totals for a specific firewall rule? For example xx mb per month?

                                Thanks again!

                                dennypageD 1 Reply Last reply Reply Quote 0
                                • J
                                  JohnUtiu @stephenw10
                                  last edited by

                                  @stephenw10 Thanks again Stephen. The only NAT rules are two automatic generated outbound NAT rules on the WAN interface.

                                  Interface WAN - Source [127.0.0.0, 10.10.10.1, 10.20.20.1]
                                  NAT address = WAN address

                                  1 Reply Last reply Reply Quote 0
                                  • J
                                    JohnUtiu
                                    last edited by

                                    I found something when looking in the States table on the SG-1100.

                                    It seems that every time I run network discovery on ntopng, a connection is being opened FROM my WAN interface TO exactly the same 15.xxx ip address that is being sticked on the OPT interface.

                                    WAN tcp 192.xxx.xxx.xxx:51949 -> 15.179.xxx.xxx:22 SYN_SENT:CLOSED 2 / 0 120 B / 0 B
                                    WAN tcp 192.xxx.xxx.xxx:62155 -> 15.179.xxx.xxx:80 SYN_SENT:CLOSED 2 / 0 120 B / 0 B

                                    It's trying to connect to port 20 and 80 on this address.

                                    The WAN interface has almost no configuration. It get's a 192.168.xxx.xxx address from the ISP router, IPv6 is turned off and it block private and bogon networks. That's it.

                                    Can someone explain this?

                                    patient0P johnpozJ dennypageD 4 Replies Last reply Reply Quote 0
                                    • dennypageD
                                      dennypage @JohnUtiu
                                      last edited by

                                      @JohnUtiu said in SG-1100 - Ntopng Network Discovery finds strange 15.xxx addresses on disconnected OPT port:

                                      Do you have any ideas about how a bug could result in a strange public ip addresses being sticked on the ip address of the interface?

                                      The last two ntopng core dumps that were brought to my attention were memory corruption resulting from the use of active network discovery.

                                      1 Reply Last reply Reply Quote 1
                                      • patient0P
                                        patient0 @JohnUtiu
                                        last edited by

                                        @JohnUtiu said in SG-1100 - Ntopng Network Discovery finds strange 15.xxx addresses on disconnected OPT port:

                                        WAN tcp 192.xxx.xxx.xxx:51949 -> 15.179.xxx.xxx:22 SYN_SENT:CLOSED 2 / 0 120 B / 0 B
                                        WAN tcp 192.xxx.xxx.xxx:62155 -> 15.179.xxx.xxx:80 SYN_SENT:CLOSED 2 / 0 120 B / 0 B

                                        According to ipinfo.io and the RIPE db the IP range 15.179.0.0 to 15.188.255.255 is part of Amazon Technologies Inc..

                                        You got an Amazon device that calls home?

                                        dennypageD J 2 Replies Last reply Reply Quote 1
                                        • johnpozJ
                                          johnpoz LAYER 8 Global Moderator @JohnUtiu
                                          last edited by

                                          @JohnUtiu said in SG-1100 - Ntopng Network Discovery finds strange 15.xxx addresses on disconnected OPT port:

                                          WAN tcp 192.xxx.xxx.xxx:51949 -> 15.179.xxx.xxx:22 SYN_SENT:CLOSED 2 / 0 120 B / 0 B

                                          If that is not your address, why are you hiding it? Like me hiding that making a connection to 8.8.x.x ???

                                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                                          If you get confused: Listen to the Music Play
                                          Please don't Chat/PM me for help, unless mod related
                                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                                          1 Reply Last reply Reply Quote 1
                                          • dennypageD
                                            dennypage @patient0
                                            last edited by

                                            @patient0 said in SG-1100 - Ntopng Network Discovery finds strange 15.xxx addresses on disconnected OPT port:

                                            According to ipinfo.io and the RIPE db the IP range 15.179.0.0 to 15.188.255.255 is part of Amazon Technologies Inc..

                                            You got an Amazon device that calls home?

                                            More likely it's ntopng itself.

                                            johnpozJ 1 Reply Last reply Reply Quote 1
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.