Page 2 of 2
Re: foreign ip address on active connection.
Posted: Mon May 19, 2014 9:39 am
by throughwalls
I would keep blocking ip addresses you do not want to be accessed.
Which computer is initiating the connections?
Re: foreign ip address on active connection.
Posted: Wed May 21, 2014 5:03 pm
by coits
I have tried to block using iptables but to no avail, also use to cat nf_conntrack and grep for that ip address, but no info was returned.
I am now puzzled!!!
Re: foreign ip address on active connection.
Posted: Wed May 21, 2014 6:31 pm
by pbix
Could be NTP, DHCP or couple of other ligit things. I don't think I would attempt to block it.
Re: foreign ip address on active connection.
Posted: Thu May 22, 2014 8:50 am
by throughwalls
Or block away and see what happens.
Which computer on your LAN is initiating the connection?
Re: foreign ip address on active connection.
Posted: Thu May 22, 2014 7:57 pm
by Expediter
I have the same issue as the OP and I have no idea which machine is initiating it. This is what the connection entry looks like:
udp
142.254.179.173:67 0.000 kBytes
255.255.255.255:68 104.832 kBytes
And from the connected hosts page:
Hostname Host IP Host MAC
(unknown) 142.254.179.173 unknown 0 0 1
Re: foreign ip address on active connection.
Posted: Fri May 23, 2014 2:50 am
by coits
I have no idea who is initiating the connection, all I can see is this info, and 1 udp connection.
(unknown) 96.49.0.1 unknown 0 0 1
I'll need to observe who initiate the connection, to see who's the culprit.
regards
Re: foreign ip address on active connection.
Posted: Sat May 31, 2014 6:18 am
by n0pin
DHCP uses ports 67 and 68, so It has probably something to do with assigning IP adresses. Maybe they are used by your ISP to assign you IPs, but I don't know why would they broadcast to entire network (255.255.255.255).
I sometimes observe these connections too, but they all point from private IP address to 255.255.255.255.