So on my jnos machine, every minute without fail, I see the following broadcast on tun0:
Fri Jun 5 14:22:01 2015 - tun0 recv: IP: len 168 81.174.253.193->192.168.1.149 ihl 20 ttl 243 tos 160 prot IP IP: len 148 44.131.160.1->255.255.255.255 ihl 20 ttl 64 DF prot UDP UDP: len 128 5678->5678 Data 120 0000 ..<.....teqgate01....6.27....MikroTik....."".....ILXI-T3GZ....RB 0040 1200......................Ug.....ipip-ampr-24.85.103.226
Fri Jun 5 14:22:01 2015 - tun0 recv: IP: len 168 81.174.253.193->192.168.1.149 ihl 20 ttl 243 tos 160 prot IP IP: len 148 44.131.160.1->255.255.255.255 ihl 20 ttl 64 DF prot UDP UDP: len 128 5678->5678 Data 120 0000 ..<.....teqgate01....6.27....MikroTik....."".....ILXI-T3GZ....RB 0040 1200......................Ug.....ipip-ampr-24.85.103.226 (encap) 44.131.160.1->255.255.255.255 DF UDP 0000 ..<.....teqgate01....6.27....MikroTik....."".....ILXI-T3GZ....RB 0040 1200......................Ug.....ipip-ampr-24.85.103.226
Fri Jun 5 14:22:01 2015 - tun0 sent: IP: len 148 44.131.160.1->255.255.255.255 ihl 20 ttl 63 DF prot UDP UDP: len 128 5678->5678 Data 120 0000 ..<.....teqgate01....6.27....MikroTik....."".....ILXI-T3GZ....RB 0040 1200......................Ug.....ipip-ampr-24.85.103.226
Why is this happening? Anyone else seeing this stuff? Best, jerome - ve7ass Vancouver
This is Mikrotik's broadcast-based L2 neighbor discovery protocol:
http://wiki.mikrotik.com/wiki/Manual:IP/Neighbor_discovery
On 05 Jun 2015, at 11:33 PM, jerome schatten romers@shaw.ca wrote:
(Please trim inclusions from previous messages) _______________________________________________ So on my jnos machine, every minute without fail, I see the following broadcast on tun0:
Fri Jun 5 14:22:01 2015 - tun0 recv: IP: len 168 81.174.253.193->192.168.1.149 ihl 20 ttl 243 tos 160 prot IP IP: len 148 44.131.160.1->255.255.255.255 ihl 20 ttl 64 DF prot UDP UDP: len 128 5678->5678 Data 120 0000 ..<.....teqgate01....6.27....MikroTik....."".....ILXI-T3GZ....RB 0040 1200......................Ug.....ipip-ampr-24.85.103.226
Fri Jun 5 14:22:01 2015 - tun0 recv: IP: len 168 81.174.253.193->192.168.1.149 ihl 20 ttl 243 tos 160 prot IP IP: len 148 44.131.160.1->255.255.255.255 ihl 20 ttl 64 DF prot UDP UDP: len 128 5678->5678 Data 120 0000 ..<.....teqgate01....6.27....MikroTik....."".....ILXI-T3GZ....RB 0040 1200......................Ug.....ipip-ampr-24.85.103.226 (encap) 44.131.160.1->255.255.255.255 DF UDP 0000 ..<.....teqgate01....6.27....MikroTik....."".....ILXI-T3GZ....RB 0040 1200......................Ug.....ipip-ampr-24.85.103.226
Fri Jun 5 14:22:01 2015 - tun0 sent: IP: len 148 44.131.160.1->255.255.255.255 ihl 20 ttl 63 DF prot UDP UDP: len 128 5678->5678 Data 120 0000 ..<.....teqgate01....6.27....MikroTik....."".....ILXI-T3GZ....RB 0040 1200......................Ug.....ipip-ampr-24.85.103.226
Why is this happening? Anyone else seeing this stuff? Best, jerome - ve7ass Vancouver
Simeon: OK, that answers a 'what' question but begs the original question: Why is he/she doing this once per minute -- are we looking at a misconfigured system? If not, to what end this clutter? It only started several weeks ago. j
On 2015-06-05 14:49, Simeon Miteff wrote:
(Please trim inclusions from previous messages) _______________________________________________ This is Mikrotik's broadcast-based L2 neighbor discovery protocol:
http://wiki.mikrotik.com/wiki/Manual:IP/Neighbor_discovery
On 05 Jun 2015, at 11:33 PM, jerome schatten romers@shaw.ca wrote:
(Please trim inclusions from previous messages) _______________________________________________ So on my jnos machine, every minute without fail, I see the following broadcast on tun0:
Fri Jun 5 14:22:01 2015 - tun0 recv: IP: len 168 81.174.253.193->192.168.1.149 ihl 20 ttl 243 tos 160 prot IP IP: len 148 44.131.160.1->255.255.255.255 ihl 20 ttl 64 DF prot UDP UDP: len 128 5678->5678 Data 120 0000 ..<.....teqgate01....6.27....MikroTik....."".....ILXI-T3GZ....RB 0040 1200......................Ug.....ipip-ampr-24.85.103.226
Fri Jun 5 14:22:01 2015 - tun0 recv: IP: len 168 81.174.253.193->192.168.1.149 ihl 20 ttl 243 tos 160 prot IP IP: len 148 44.131.160.1->255.255.255.255 ihl 20 ttl 64 DF prot UDP UDP: len 128 5678->5678 Data 120 0000 ..<.....teqgate01....6.27....MikroTik....."".....ILXI-T3GZ....RB 0040 1200......................Ug.....ipip-ampr-24.85.103.226 (encap) 44.131.160.1->255.255.255.255 DF UDP 0000 ..<.....teqgate01....6.27....MikroTik....."".....ILXI-T3GZ....RB 0040 1200......................Ug.....ipip-ampr-24.85.103.226
Fri Jun 5 14:22:01 2015 - tun0 sent: IP: len 148 44.131.160.1->255.255.255.255 ihl 20 ttl 63 DF prot UDP UDP: len 128 5678->5678 Data 120 0000 ..<.....teqgate01....6.27....MikroTik....."".....ILXI-T3GZ....RB 0040 1200......................Ug.....ipip-ampr-24.85.103.226
Why is this happening? Anyone else seeing this stuff? Best, jerome - ve7ass Vancouver
44Net mailing list 44Net@hamradio.ucsd.edu http://hamradio.ucsd.edu/mailman/listinfo/44net
Yes, it's once again a misconfigured Mikrotik router, in this case in the UK on address 44.131.160.1. The owner/operator of that router, whoever it is, needs to turn off the neighbor discovery protocol on his outward-facing interface. - Brian
On Fri, Jun 05, 2015 at 04:41:15PM -0700, jerome schatten wrote:
(Please trim inclusions from previous messages) _______________________________________________ Simeon: OK, that answers a 'what' question but begs the original question: Why is he/she doing this once per minute -- are we looking at a misconfigured system? If not, to what end this clutter? It only started several weeks ago. j
On 2015-06-05 14:49, Simeon Miteff wrote:
(Please trim inclusions from previous messages) _______________________________________________ This is Mikrotik's broadcast-based L2 neighbor discovery protocol:
http://wiki.mikrotik.com/wiki/Manual:IP/Neighbor_discovery
On 05 Jun 2015, at 11:33 PM, jerome schatten romers@shaw.ca wrote:
(Please trim inclusions from previous messages) _______________________________________________ So on my jnos machine, every minute without fail, I see the following broadcast on tun0:
Fri Jun 5 14:22:01 2015 - tun0 recv: IP: len 168 81.174.253.193->192.168.1.149 ihl 20 ttl 243 tos 160 prot IP IP: len 148 44.131.160.1->255.255.255.255 ihl 20 ttl 64 DF prot UDP UDP: len 128 5678->5678 Data 120 0000 ..<.....teqgate01....6.27....MikroTik....."".....ILXI-T3GZ....RB 0040 1200......................Ug.....ipip-ampr-24.85.103.226
Fri Jun 5 14:22:01 2015 - tun0 recv: IP: len 168 81.174.253.193->192.168.1.149 ihl 20 ttl 243 tos 160 prot IP IP: len 148 44.131.160.1->255.255.255.255 ihl 20 ttl 64 DF prot UDP UDP: len 128 5678->5678 Data 120 0000 ..<.....teqgate01....6.27....MikroTik....."".....ILXI-T3GZ....RB 0040 1200......................Ug.....ipip-ampr-24.85.103.226 (encap) 44.131.160.1->255.255.255.255 DF UDP 0000 ..<.....teqgate01....6.27....MikroTik....."".....ILXI-T3GZ....RB 0040 1200......................Ug.....ipip-ampr-24.85.103.226
Fri Jun 5 14:22:01 2015 - tun0 sent: IP: len 148 44.131.160.1->255.255.255.255 ihl 20 ttl 63 DF prot UDP UDP: len 128 5678->5678 Data 120 0000 ..<.....teqgate01....6.27....MikroTik....."".....ILXI-T3GZ....RB 0040 1200......................Ug.....ipip-ampr-24.85.103.226
Why is this happening? Anyone else seeing this stuff? Best, jerome - ve7ass Vancouver
44Net mailing list 44Net@hamradio.ucsd.edu http://hamradio.ucsd.edu/mailman/listinfo/44net
44Net mailing list 44Net@hamradio.ucsd.edu http://hamradio.ucsd.edu/mailman/listinfo/44net
Ah-so, and tnx; I guess someone will alert him. j.
On 2015-06-05 16:57, Brian Kantor wrote:
(Please trim inclusions from previous messages) _______________________________________________ Yes, it's once again a misconfigured Mikrotik router, in this case in the UK on address 44.131.160.1. The owner/operator of that router, whoever it is, needs to turn off the neighbor discovery protocol on his outward-facing interface.
- Brian
On Fri, Jun 05, 2015 at 04:41:15PM -0700, jerome schatten wrote:
(Please trim inclusions from previous messages) _______________________________________________ Simeon: OK, that answers a 'what' question but begs the original question: Why is he/she doing this once per minute -- are we looking at a misconfigured system? If not, to what end this clutter? It only started several weeks ago. j
On 2015-06-05 14:49, Simeon Miteff wrote:
(Please trim inclusions from previous messages) _______________________________________________ This is Mikrotik's broadcast-based L2 neighbor discovery protocol:
http://wiki.mikrotik.com/wiki/Manual:IP/Neighbor_discovery
On 05 Jun 2015, at 11:33 PM, jerome schatten romers@shaw.ca wrote:
(Please trim inclusions from previous messages) _______________________________________________ So on my jnos machine, every minute without fail, I see the following broadcast on tun0:
Fri Jun 5 14:22:01 2015 - tun0 recv: IP: len 168 81.174.253.193->192.168.1.149 ihl 20 ttl 243 tos 160 prot IP IP: len 148 44.131.160.1->255.255.255.255 ihl 20 ttl 64 DF prot UDP UDP: len 128 5678->5678 Data 120 0000 ..<.....teqgate01....6.27....MikroTik....."".....ILXI-T3GZ....RB 0040 1200......................Ug.....ipip-ampr-24.85.103.226
Fri Jun 5 14:22:01 2015 - tun0 recv: IP: len 168 81.174.253.193->192.168.1.149 ihl 20 ttl 243 tos 160 prot IP IP: len 148 44.131.160.1->255.255.255.255 ihl 20 ttl 64 DF prot UDP UDP: len 128 5678->5678 Data 120 0000 ..<.....teqgate01....6.27....MikroTik....."".....ILXI-T3GZ....RB 0040 1200......................Ug.....ipip-ampr-24.85.103.226 (encap) 44.131.160.1->255.255.255.255 DF UDP 0000 ..<.....teqgate01....6.27....MikroTik....."".....ILXI-T3GZ....RB 0040 1200......................Ug.....ipip-ampr-24.85.103.226
Fri Jun 5 14:22:01 2015 - tun0 sent: IP: len 148 44.131.160.1->255.255.255.255 ihl 20 ttl 63 DF prot UDP UDP: len 128 5678->5678 Data 120 0000 ..<.....teqgate01....6.27....MikroTik....."".....ILXI-T3GZ....RB 0040 1200......................Ug.....ipip-ampr-24.85.103.226
Why is this happening? Anyone else seeing this stuff? Best, jerome - ve7ass Vancouver
44Net mailing list 44Net@hamradio.ucsd.edu http://hamradio.ucsd.edu/mailman/listinfo/44net
44Net mailing list 44Net@hamradio.ucsd.edu http://hamradio.ucsd.edu/mailman/listinfo/44net
44Net mailing list 44Net@hamradio.ucsd.edu http://hamradio.ucsd.edu/mailman/listinfo/44net
-
Brian Kantor -
jerome schatten -
Simeon Miteff