🚀 go-pugleaf

In article bje@ripco.com says...
> > in quick succession resembling a buffer overflow exploit.
> 
> Probably not.
> 
> You left out more info than you gave, for one, how did you determine it was
> a HTC doing this? Looked up the mac address?

Yes.  Wireshark does a pretty good job doing reverse mapping identifying 
the manufacturers through those 3 octets in the MAC address.  They don't 
get them all however but those devices usually give themselves away by 
their behaviour.

> You also said in the other post DoD on 22, was it 224 by any chance?
> Although 22.0.0.0/8 still seems to be assigned to something called Defense
> Information Systems Agency, the 224.x stuff shows up on many things for the
> multicasting crap.

Maybe I didn't make myself clear.  The HTC device is pumping out an ARP 
request wanting my gateway to send its MAC address to the address in the 
22.0.0.0/8 range which I thought had something to do with the defense 
department.  These requests come in very quick succession and are not 
normal behaviour of any Android or any device I have ever seen.  Looking 
at the logs there are about 40 all at once with a couple of legit ARP 
requests thrown in the mix from the same device.  I suppose they could 
have used any external IP address to confuse the gateway since both its 
NICs in the 192.168.x.x/24 private ip space.  I suspect that whoever 
wrote the Android app that is doing this put the DoD IP address in as a 
joke.  The gateway should simply drop those requests into the bit bucket 
as fast as they come in.


The 224.x is the address my gateway uses to broadcast all my private DNS 
records one record at a time onto the wireless subnet for anyone 
listening to see.  This is not normal and totally unnecessary.  Apple 
phones do this a lot.  They dump owner info via MDNS so when someone 
uses an Iphone or an Apple laptop most of the time I see both the first 
and last name of the person using that device.  I'm not sure Apple users 
realize this.  PCs are the worst I've seen generating network garbage 
but I only see mobile devices like phones and laptops.  

Granted hiding my private namespace is security through obscurity (i.e. 
no one knows that xxx.yyy.com gets the user to the computer I'm typing 
this message on right now.  Broadcasting the names of all my hosts to 
any yahoo listening on that open subnet is not a good thing because the 
people listening are probably true attackers -- especially if they did 
something to generate that dump.  I could eliminate my private namespace 
records from the subnet's DNS server but that's not a solution either.  
Trusted users need to be able to resolve those names.

BTW: Blackberries are the most efficient.  They set up a VPN with home 
base then it's wham bam thank you maam, they do their business and then 
they're done -- no fooling around.  They generate zero network garbage 
which might be why enterprises like them.

> It's not clear how you have the monitoring setup, but there are just a lot
> of "chatty" things out there that use their own methods. Try doing a ping on
> a broadcast address (192.168.1.255 usually) and see the results.

I use nmap but am not really interested in probing for open ports in 
these devices.  The few times I've tried they were pretty locked down.  
Anyone who enters my wireless subnet can't get by being seen by my all 
knowing gateway which all traffic must traverse.  It is funny how some 
devices get on my net and try to take over and do things their way like 
assigning their own IP and using their own DNS server.  They eventually 
give up and succumb to the BORG because ultimately, they really really 
really have to check up their facebook status.

> It's probably some neighbors phone periodically looking for wifi 
networks,
> trying to connect, fails and goes on it's merry way to somewhere else.

It's a business across the street that caters to drunks who get my free 
signal so I sometimes get lots of traffic.  I don't mind sharing my net 
connection since the phones don't really do that much.  I don't want 
people doing stuff to get me in trouble -- like downloading music or 
movies or god forbid child porn that would get tracked to me.  I try and 
keep all traffic logged in case something bad happens.  And I'd know if 
someone's doing something funny reading through the logs.  I do scan 
them for any interesting behaviours.  So far it has all been innocuous 
-- email and lots and lots of facebook.  Sometimes I find interesting 
sites on the web by looking at the host part of their http requests 
seeing the various sites people surf.

My main purpose for this setup is to research the methods these various 
devices use.