SG-1100 - Ntopng Network Discovery finds strange 15.xxx addresses on disconnected OPT port
-
Hi everyone,
I am using ntopng Community v.6.0.240423 (FreeBSD 15.0) on a Netgate 1100 (latest software version) on a LAN.
Everytime I run Network Discovery in ntopng for the mvneta0.4092 interface / OPT port, ntopng thinks something is connected but there is no cable in this port.
IP: 15.xxx.xxx.xxx ,
Manufacturer: Globalscale Technologies, Inc.
MAC Address: Globalsc_XXXXXXXOn every run of Network Discovery the ip address changes but it always starts with 15.
Exactly the same MAC address also shows up on the mvneta0.4091 interface / LAN port. But there it is showing me the local (gateway) ip I use to connect to the Netgate 1100 management interface which I would expect because of the way the SG-1100 operates.
Why do I see the local (gateway) ip on the mvneta0.4091 interface / LAN port but a strange? 15.xxx.xxx.xxx IP on the mvneta0.4092 interface / OPT port instead of the other local (gateway) ip that is configured for that interface?
Thanks a lot for any help you could provide!
Best regards
John
-
Something broadcasting to it maybe? Do you see that IP on any other port? Could be a VLAN being untagged on all ports.
-
Is that your gateway?
-
@JonathanLee Thanks for your quick reply. Both mvneta0.4091 and mvneta0.4092 (LAN port and OPT port) have a gateway in the 10.xxx range.
It's just a lab within a LAN. Mvneta0.4090 (WAN port) gets a 192 address (also internal) from a modem / router. -
@stephenw10 Thanks for your quick reply! I could not find this address anywhere else.
Update: I did nothing but wait and now, after some hours it seems to display correctly on both interfaces.
On interface mvneta0.4091 / LAN port I see:
10.10.10.1 [name of host] Globalscale Technologies, Inc. Globalsc_MACOn interface mvneta0.4092 interface / OPT port I see:
10.20.20.1 [no hostname] Globalscale Technologies, Inc. Globalsc_MACAny idea's, based on this new information? I am a bit worried about seeing public IP's (15.xxx.xxx.xxx) in a LAN. I really do not understand this.
-
VLAN setup is default for the SG-1100
VLAN(s) table
VLAN group VLAN tag Members Description Action
0 1 0 Default System VLAN
1 4090 0t,3 WAN
2 4091 0t,2 LAN
3 4092 0t,1 OPT -
@JohnUtiu said in SG-1100 - Ntopng Network Discovery finds strange 15.xxx addresses on disconnected OPT port:
MAC Address: Globalsc_XXXXXXX
What is this mac address of, you say the 15 address changes - but is the mac staying the same?
-
The Globalscale MAC will be the 1100. They are the board manufacturer.
-
@stephenw10 yeah but he says his 15.x address is changing - quite possible this is wan IP?
-
Yup could be
-
@johnpoz Thanks for the help everyone, I appreciate!
The MAC address stays the same. It's indeed the MAC of the board manufacturer like stephenw10 says.
The monitored interfaces are only LAN and OPT. The WAN port is excluded in the ntopng config. Also the WAN interface listens to a 192.178 address because the 1100 box is only separating the LAB from the LAN.
On the WAN port there are no rules except to block private and bogon networks. So everything is dropped.
I have only ntopng running as a package, further a minimal install.
I am not sure but I would think normal behaviour would be to see all your regular devices and this Globalscale device in every interface with identical MAC addresses and the different IP's of the firewall interfaces, like you see below:
On interface mvneta0.4091 / LAN port I see:
10.10.10.1 [name of host] Globalscale Technologies, Inc. Globalsc_MACOn interface mvneta0.4092 interface / OPT port I see:
10.20.20.1 [no hostname] Globalscale Technologies, Inc. Globalsc_MACIt stayed like this for many hours and now again the 10.20.20.1 changed to the 15.xxx.xxx address? I am really breaking my head this.
I have only 1 computer directly connected to the LAN port. This is the interface that shows the correct IP.
The WAN port is directly connected to the ISP modem.
The OPT port > mvneta0.4092 is connected to nothing and sometimes I have connected a Synology NAS which I pulled out a couple of times for testing but the Synology has a 10.xx address.
The 15.xx address brings me to DXC US Latin America Corporation (ESLAC) which says me nothing.
Thanks again for any help or ideas you could provide!
-
This could simply be a bug in ntopng’s active discovery code. Compared to the main ntopng code, it’s rather immature and little used. I do not recommend it.
-
Do you have any custom outbound NAT rules on OPT?
-
@dennypage Thanks for the input! Interesting idea. I thought about it but I am not familiar with the source code and the inner workings of ntopng.
Do you have any ideas about how a bug could result in a strange public ip addresses being sticked on the ip address of the interface?
There has to be some way it's getting this public ip's.
I still want to find out what's happening here but do you have any recommendations for monitoring egress traffic totals for a specific firewall rule? For example xx mb per month?
Thanks again!
-
@stephenw10 Thanks again Stephen. The only NAT rules are two automatic generated outbound NAT rules on the WAN interface.
Interface WAN - Source [127.0.0.0, 10.10.10.1, 10.20.20.1]
NAT address = WAN address -
I found something when looking in the States table on the SG-1100.
It seems that every time I run network discovery on ntopng, a connection is being opened FROM my WAN interface TO exactly the same 15.xxx ip address that is being sticked on the OPT interface.
WAN tcp 192.xxx.xxx.xxx:51949 -> 15.179.xxx.xxx:22 SYN_SENT:CLOSED 2 / 0 120 B / 0 B
WAN tcp 192.xxx.xxx.xxx:62155 -> 15.179.xxx.xxx:80 SYN_SENT:CLOSED 2 / 0 120 B / 0 BIt's trying to connect to port 20 and 80 on this address.
The WAN interface has almost no configuration. It get's a 192.168.xxx.xxx address from the ISP router, IPv6 is turned off and it block private and bogon networks. That's it.
Can someone explain this?
-
@JohnUtiu said in SG-1100 - Ntopng Network Discovery finds strange 15.xxx addresses on disconnected OPT port:
Do you have any ideas about how a bug could result in a strange public ip addresses being sticked on the ip address of the interface?
The last two ntopng core dumps that were brought to my attention were memory corruption resulting from the use of active network discovery.
-
@JohnUtiu said in SG-1100 - Ntopng Network Discovery finds strange 15.xxx addresses on disconnected OPT port:
WAN tcp 192.xxx.xxx.xxx:51949 -> 15.179.xxx.xxx:22 SYN_SENT:CLOSED 2 / 0 120 B / 0 B
WAN tcp 192.xxx.xxx.xxx:62155 -> 15.179.xxx.xxx:80 SYN_SENT:CLOSED 2 / 0 120 B / 0 BAccording to ipinfo.io and the RIPE db the IP range 15.179.0.0 to 15.188.255.255 is part of Amazon Technologies Inc..
You got an Amazon device that calls home?
-
@JohnUtiu said in SG-1100 - Ntopng Network Discovery finds strange 15.xxx addresses on disconnected OPT port:
WAN tcp 192.xxx.xxx.xxx:51949 -> 15.179.xxx.xxx:22 SYN_SENT:CLOSED 2 / 0 120 B / 0 B
If that is not your address, why are you hiding it? Like me hiding that making a connection to 8.8.x.x ???
-
@patient0 said in SG-1100 - Ntopng Network Discovery finds strange 15.xxx addresses on disconnected OPT port:
According to ipinfo.io and the RIPE db the IP range 15.179.0.0 to 15.188.255.255 is part of Amazon Technologies Inc..
You got an Amazon device that calls home?
More likely it's ntopng itself.
