SG-1100 - Ntopng Network Discovery finds strange 15.xxx addresses on disconnected OPT port
-
@JohnUtiu said in SG-1100 - Ntopng Network Discovery finds strange 15.xxx addresses on disconnected OPT port:
MAC Address: Globalsc_XXXXXXX
What is this mac address of, you say the 15 address changes - but is the mac staying the same?
-
The Globalscale MAC will be the 1100. They are the board manufacturer.
-
@stephenw10 yeah but he says his 15.x address is changing - quite possible this is wan IP?
-
Yup could be
-
This post is deleted! -
This could simply be a bug in ntopng’s active discovery code. Compared to the main ntopng code, it’s rather immature and little used. I do not recommend it.
-
Do you have any custom outbound NAT rules on OPT?
-
This post is deleted! -
This post is deleted! -
This post is deleted! -
@JohnUtiu said in SG-1100 - Ntopng Network Discovery finds strange 15.xxx addresses on disconnected OPT port:
Do you have any ideas about how a bug could result in a strange public ip addresses being sticked on the ip address of the interface?
The last two ntopng core dumps that were brought to my attention were memory corruption resulting from the use of active network discovery.
-
@JohnUtiu said in SG-1100 - Ntopng Network Discovery finds strange 15.xxx addresses on disconnected OPT port:
WAN tcp 192.xxx.xxx.xxx:51949 -> 15.179.xxx.xxx:22 SYN_SENT:CLOSED 2 / 0 120 B / 0 B
WAN tcp 192.xxx.xxx.xxx:62155 -> 15.179.xxx.xxx:80 SYN_SENT:CLOSED 2 / 0 120 B / 0 BAccording to ipinfo.io and the RIPE db the IP range 15.179.0.0 to 15.188.255.255 is part of Amazon Technologies Inc..
You got an Amazon device that calls home?
-
@JohnUtiu said in SG-1100 - Ntopng Network Discovery finds strange 15.xxx addresses on disconnected OPT port:
WAN tcp 192.xxx.xxx.xxx:51949 -> 15.179.xxx.xxx:22 SYN_SENT:CLOSED 2 / 0 120 B / 0 B
If that is not your address, why are you hiding it? Like me hiding that making a connection to 8.8.x.x ???
-
@patient0 said in SG-1100 - Ntopng Network Discovery finds strange 15.xxx addresses on disconnected OPT port:
According to ipinfo.io and the RIPE db the IP range 15.179.0.0 to 15.188.255.255 is part of Amazon Technologies Inc..
You got an Amazon device that calls home?
More likely it's ntopng itself.
-
@JohnUtiu said in SG-1100 - Ntopng Network Discovery finds strange 15.xxx addresses on disconnected OPT port:
It seems that every time I run network discovery on ntopng, a connection is being opened FROM my WAN interface TO exactly the same 15.xxx ip address that is being sticked on the OPT interface.
WAN tcp 192.xxx.xxx.xxx:51949 -> 15.179.xxx.xxx:22 SYN_SENT:CLOSED 2 / 0 120 B / 0 B
WAN tcp 192.xxx.xxx.xxx:62155 -> 15.179.xxx.xxx:80 SYN_SENT:CLOSED 2 / 0 120 B / 0 BIt's trying to connect to port 20 and 80 on this address.
Where are you geographically?
-
@dennypage said in SG-1100 - Ntopng Network Discovery finds strange 15.xxx addresses on disconnected OPT port:
More likely it's ntopng itself.
Yeah and if some public internet IP wasn't obfuscated we could prob look up its PTR and glean some insight to what is is..
You want help identifying what some odd public IP is, which you know isn't your actual IP, or the IP of your gateway from your isp - why are you hiding it.. Why are you hiding your rfc1918 IP as well?
-
@JohnUtiu said in SG-1100 - Ntopng Network Discovery finds strange 15.xxx addresses on disconnected OPT port:
WAN tcp 192.xxx.xxx.xxx:51949 -> 15.179.xxx.xxx:22 SYN_SENT:CLOSED 2 / 0 120 B / 0 B
WAN tcp 192.xxx.xxx.xxx:62155 -> 15.179.xxx.xxx:80 SYN_SENT:CLOSED 2 / 0 120 B / 0 BIt's trying to connect to port 20 and 80 on this address.
Btw, assume that you meant port 22 rather than port 20. This is ssh.
Some of the (really bad) things ntopng does when active discovery is enabled is to run ssh, snmp and http probes against hosts it finds in the network.
-
This post is deleted! -
This post is deleted! -
@JohnUtiu said in SG-1100 - Ntopng Network Discovery finds strange 15.xxx addresses on disconnected OPT port:
ntopng ... on a Netgate 1100
FYI Netgate marks that package as "requires SSD" due to the usually high I/O generated:
https://www.netgate.com/supported-pfsense-plus-packagesYou might check https://docs.netgate.com/pfsense/en/latest/troubleshooting/disk-lifetime.html.
