Hey Ronen,
This link might help you:
https://aacable.wordpress.com/2011/12/09/mikrotik-howto-block-winbox-discov…
if it does not help/work , contact me offlist and I can assist you further
73,
Ruben - ON3RVH
-----Original Message-----
From: 44Net [mailto:44net-bounces+on3rvh=on3rvh.be@hamradio.ucsd.edu] On Behalf Of R P
Sent: vrijdag 28 april 2017 8:50
To: AMPRNet working group <44net(a)hamradio.ucsd.edu>
Subject: Re: [44net] Gateway 77.138.34.39
(Please trim inclusions from previous messages)
_______________________________________________
I see that im again on the "news"
I saw this from the logs of Brian few days ago for the first time
Indeed I have a MikroTik router that handle my AMPR network but i couldn't guess
what is it or how to stop it
in the beginning i thought it is an answer to a kind of probing (and i have many of them
)
If someone can tell me what i need to do to stop it i will be thankful
if needed i may provide password to the web interface telnet ssh ot winbox interface
Regards
Ronen - 4Z4ZQ
http://www.ronen.org
Ronen Pinchooks (4Z4ZQ)
WebSite<http://www.ronen.org/> www.ronen.org ronen.org
(Ronen Pinchooks (4Z4ZQ) WebSite) is hosted by
domainavenue.com
________________________________
From: 44Net <44net-bounces+ronenp=hotmail.com(a)hamradio.ucsd.edu> on behalf of Ruben
ON3RVH <on3rvh(a)on3rvh.be>
Sent: Thursday, April 27, 2017 11:11 PM
To: AMPRNet working group
Subject: Re: [44net] Gateway 77.138.34.39
(Please trim inclusions from previous messages)
_______________________________________________
Marius,
There is, indeed, no reason to run this on the ampr-gw. It is however, unfortunately,
default to run it on all interfaces.
73,
Ruben - ON3RVH
-----Original Message-----
From: 44Net [mailto:44net-bounces+on3rvh=on3rvh.be@hamradio.ucsd.edu] On Behalf Of Marius
Petrescu
Sent: vrijdag 28 april 2017 7:35
To: AMPRNet working group <44net(a)hamradio.ucsd.edu>
Subject: Re: [44net] Gateway 77.138.34.39
(Please trim inclusions from previous messages)
_______________________________________________
There is really no reason to have this running on the ampr-gw tunnel interface.
I will add it to the setup instruction of the MT routers.
Tnx Brian and Ronen for pointing it out.
@Brian: Wouldn't it be wise to drop any broadcasts at the ampr gateway level (packets
with destination 255.255.255.255 and 44.255.255.255)?
Marius, YO2LOJ
On 2017-04-28 07:32, Ruben ON3RVH wrote:
(Please trim inclusions from previous messages)
_______________________________________________
That is the Mirkotik discovery protocol indeed. I struggled with this
too at first until I found that you can enable/disable it on select interfaces. By
default it sends and listens on all interfaces. I'll post a small tutorial on where to
find and disable it per interface when I arrive at work (unless someone beats me to it) I
also firewalled in&outbound that on all but my internal interfaces just to be extra
certain. I would recomend everyone doing so too unless you need it for some reason on an
external interface.
Like with Cisco's CDP or Juniper's LLDP, you normally don't need it on
external interfaces.
Ruben - ON3RVH
On 28 Apr 2017, at 02:23, Brian Kantor
<Brian(a)UCSD.Edu> wrote:
(Please trim inclusions from previous messages)
_______________________________________________
Once a minute, at 8 seconds past the minute, gateway 77.138.34.39
sends an encapped UDP packet to the amprgw router that has a zero
inner source address and an all-ones inner destination address. The
payload length is 94 bytes and the source and destination ports are both 5678.
The periodicity suggests that it's some process that runs every
minute (out of crontab?) and takes about 8 seconds to complete.
There is a list of things port 5678 may be used for at
http://www.speedguide.net/port.php?port=5678
This may be Mikrotik Neighbor Discovery protocol.
Here's a log record of one such packet:
Apr 27 17:02:08 <local0.info> amprgw ipipd[22702]: ISRC0: len 122, os
77.138.34.39, od 169.228.66.251, is 0.0.0.0, id 255.255.255.255, ttl
64, proto 17
And here's a tcpdump of one:
17:06:08.419945 IP (tos 0x0, ttl 242, id 36314, offset 0, flags [none], proto IPIP (4),
length 142)
77.138.34.39 > 169.228.66.251: IP (tos 0x0, ttl 64, id 0, offset 0, flags [none],
proto UDP (17), length 122)
0.0.0.0.5678 > 255.255.255.255.5678: UDP, length 94
The portal record shows that this gateway belongs to Ronen Pinchuk [4Z4ZQ].
Ronen, when you have a few spare minutes, could you look at your
gateway and see if you can stop this from happening?
- Brian
_________________________________________
44Net mailing list
44Net(a)hamradio.ucsd.edu
http://hamradio.ucsd.edu/mailman/listinfo/44net
_________________________________________
44Net mailing list
44Net(a)hamradio.ucsd.edu
http://hamradio.ucsd.edu/mailman/listinfo/44net
_________________________________________
44Net mailing list
44Net(a)hamradio.ucsd.edu
http://hamradio.ucsd.edu/mailman/listinfo/44net
_________________________________________
44Net mailing list
44Net(a)hamradio.ucsd.edu
http://hamradio.ucsd.edu/mailman/listinfo/44net