Article View: chi.internet
Article #325Weird observation
From: Mark Anderson
Date: Mon, 20 Feb 2012 23:03
Date: Mon, 20 Feb 2012 23:03
17 lines
2344 bytes
2344 bytes
I'm running a completely open wireless with a Centos box as a firewall/gateway/dhcpd/dns provider. The firewall (iptables) only lets certain ports through. So I have wireshark up on it monitoring what ports various devices want and opening them up to see the traffic. If it looks legit I let that service through. This is an experimental network. Anyway, something very weird has been happening. An Android HTC device has been transmitting one of those WHO has this IP? ARP messages. The IP address maps to some outfit called the DoD network (22 range). My wireless subnet is in the 192.168 private IP range. The HTC device hits my centos box with about a dozen or so of these and the Centos box dumps all its SOA DNS records from the DNS server via MDNS. I realize I need to figure out how to stop this in bind but I found this behaviour very strange. I'm running the lates bind, 9.7.4 CentOS has to offer.
Technical Details
Message-ID:
<MPG.29ac9b419cda81719897ed@news.speakeasy.net>Path:
arc1-ca.pugleaf.net!t13ni51166bkb.0!nntp.google.com!news2.google.com!Xl.tags.giganews.com!border1.nntp.dca.giganews.com!nntp.giganews.com!local2.nntp.dca.giganews.com!nntp.megapath.net!news.megapath.net.POSTED!not-for-mailShow Full Headers
Complete Article Headers
X-Google-Thread: 10d5fa,952a21450c2c3f39,start
X-Google-NewGroupId: yes
X-Google-Attributes: gid837b0c45a0,domainid0,public,usenet
X-Google-Language: ENGLISH,ASCII-7-bit
Received: by 10.205.129.137 with SMTP id hi9mr1670193bkc.8.1329779001389;
Mon, 20 Feb 2012 15:03:21 -0800 (PST)
Path: arc1-ca.pugleaf.net!t13ni51166bkb.0!nntp.google.com!news2.google.com!Xl.tags.giganews.com!border1.nntp.dca.giganews.com!nntp.giganews.com!local2.nntp.dca.giganews.com!nntp.megapath.net!news.megapath.net.POSTED!not-for-mail
NNTP-Posting-Date: Mon, 20 Feb 2012 17:03:20 -0600
From: Mark Anderson <mea@nospambradnylion.com>
Newsgroups: chi.internet
Subject: Weird observation
Date: Mon, 20 Feb 2012 18:03:22 -0500
Message-ID: <MPG.29ac9b419cda81719897ed@news.speakeasy.net>
MIME-Version: 1.0
User-Agent: MicroPlanet-Gravity/3.0.4
Lines: 18
X-Usenet-Provider: http://www.giganews.com
NNTP-Posting-Host: 66.92.134.90
X-Trace: sv3-AoihguON4YEt4hlckaN229/6lVyxcFHR+XrAa7Cspafwpyvnv5tdwvyRFEH+4xtw8yl3WLCG4j3d0vt!Da2o4d0jLe/2Nsa9egTXS59EvKbZLB7Eif+BWrDWgvefCf7+gpQkmcJtIsXkUrdWb6IVyOy1D3Vb!6sJ9uROC+VFcE8ioDTI5IGuSYcQx
X-Abuse-and-DMCA-Info: Please be sure to forward a copy of ALL headers
X-Abuse-and-DMCA-Info: Otherwise we will be unable to process your complaint properly
X-Postfilter: 1.3.40
X-Original-Bytes: 1906
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit