search

zerotier / ZeroTierOne

A Smart Ethernet Switch for Earth
https://zerotier.com
Other
14.65k stars 1.71k forks source link

Strange packets from public network interface to private networks #562

Closed misuzu closed 7 years ago

misuzu commented 7 years ago

Today i received abuse email from Hetzner (replaced src_ip to 2.2.222.22):

> ##########################################################################
> #               Netscan detected from host      2.2.222.22               #
> ##########################################################################
>
> time                protocol src_ip src_port          dest_ip dest_port
> ---------------------------------------------------------------------------
> Thu Aug 10 14:00:15 2017 UDP      2.2.222.22 9993  =>   192.168.0.253 64768
> Thu Aug 10 13:59:55 2017 UDP      2.2.222.22 59032 =>   10.128.218.22 50117
> Thu Aug 10 14:00:20 2017 UDP      2.2.222.22 9993  =>    10.115.227.1 39620
> Thu Aug 10 14:00:00 2017 UDP      2.2.222.22 59032 =>   100.72.60.226 46282
> Thu Aug 10 14:00:15 2017 UDP      2.2.222.22 9993  =>  100.72.238.239 57002
> Thu Aug 10 14:00:20 2017 UDP      2.2.222.22 9993  =>     10.72.49.90 53222
> Thu Aug 10 14:00:15 2017 UDP      2.2.222.22 59032 =>     10.19.20.33 64378
> Thu Aug 10 13:59:56 2017 UDP      2.2.222.22 9993  =>    10.168.3.230 38871
> Thu Aug 10 13:59:59 2017 UDP      2.2.222.22 59032 =>     10.32.88.13 35011
> Thu Aug 10 14:00:20 2017 UDP      2.2.222.22 9993  =>      10.101.0.6 23167
> Thu Aug 10 13:59:59 2017 UDP      2.2.222.22 9993  =>      10.0.0.143 9993
> Thu Aug 10 13:59:36 2017 UDP      2.2.222.22 59032 =>     10.0.10.229 9993
> Thu Aug 10 14:00:00 2017 UDP      2.2.222.22 9993  =>     10.0.10.243 9993
> Thu Aug 10 14:00:15 2017 UDP      2.2.222.22 9993  =>     10.0.10.246 9993
> Thu Aug 10 13:59:32 2017 UDP      2.2.222.22 9993  =>     10.0.10.247 9993
> Thu Aug 10 14:00:15 2017 UDP      2.2.222.22 9993  =>    10.10.70.124 9993
> Thu Aug 10 13:59:25 2017 UDP      2.2.222.22 59032 =>      172.17.0.1 9993
> Thu Aug 10 13:59:36 2017 UDP      2.2.222.22 9993  =>      172.17.0.1 9993
> Thu Aug 10 13:59:56 2017 UDP      2.2.222.22 59647 =>      172.17.0.1 9993
> Thu Aug 10 14:00:12 2017 UDP      2.2.222.22 9993  =>     192.168.0.9 9993
> Thu Aug 10 14:00:20 2017 UDP      2.2.222.22 9993  =>    192.168.0.12 9993
> Thu Aug 10 14:00:20 2017 UDP      2.2.222.22 59032 =>    192.168.0.16 9993
> Thu Aug 10 13:59:34 2017 UDP      2.2.222.22 9993  =>    192.168.0.68 9993
> Thu Aug 10 14:00:15 2017 UDP      2.2.222.22 59032 =>    192.168.0.71 9993
> Thu Aug 10 14:00:20 2017 UDP      2.2.222.22 9993  =>    192.168.0.74 9993
> Thu Aug 10 14:00:20 2017 UDP      2.2.222.22 59032 =>    192.168.0.92 9993
> Thu Aug 10 14:00:20 2017 UDP      2.2.222.22 9993  =>   192.168.0.100 9993
> Thu Aug 10 14:00:15 2017 UDP      2.2.222.22 9993  =>   192.168.0.102 9993
> Thu Aug 10 13:59:55 2017 UDP      2.2.222.22 9993  =>   192.168.0.103 9993
> Thu Aug 10 14:00:20 2017 UDP      2.2.222.22 59032 =>   192.168.0.103 9993
> Thu Aug 10 14:00:10 2017 UDP      2.2.222.22 9993  =>   192.168.0.105 9993
> Thu Aug 10 14:00:20 2017 UDP      2.2.222.22 59032 =>   192.168.0.106 9993
> Thu Aug 10 14:00:15 2017 UDP      2.2.222.22 9993  =>   192.168.0.108 9993
> Thu Aug 10 14:00:18 2017 UDP      2.2.222.22 59032 =>   192.168.0.111 9993
> Thu Aug 10 13:59:55 2017 UDP      2.2.222.22 59032 =>   192.168.0.112 9993
> Thu Aug 10 14:00:20 2017 UDP      2.2.222.22 9993  =>   192.168.0.112 9993
> Thu Aug 10 14:00:20 2017 UDP      2.2.222.22 59032 =>   192.168.0.114 9993
> Thu Aug 10 14:00:15 2017 UDP      2.2.222.22 59032 =>   192.168.0.123 9993
> Thu Aug 10 14:00:15 2017 UDP      2.2.222.22 59032 =>   192.168.0.127 9993
> Thu Aug 10 14:00:15 2017 UDP      2.2.222.22 59032 =>   192.168.0.136 9993
> Thu Aug 10 14:00:00 2017 UDP      2.2.222.22 59032 =>     192.168.1.6 9993
> Thu Aug 10 13:59:32 2017 UDP      2.2.222.22 59032 =>    192.168.1.11 9993
> Thu Aug 10 13:59:55 2017 UDP      2.2.222.22 59032 =>    192.168.1.11 9993
> Thu Aug 10 13:59:55 2017 UDP      2.2.222.22 59032 =>    192.168.1.15 9993
> Thu Aug 10 13:59:58 2017 UDP      2.2.222.22 59032 =>    192.168.1.15 9993
> Thu Aug 10 14:00:15 2017 UDP      2.2.222.22 59032 =>    192.168.1.15 9993
> Thu Aug 10 14:00:20 2017 UDP      2.2.222.22 9993  =>    192.168.1.15 9993
> Thu Aug 10 14:00:20 2017 UDP      2.2.222.22 59032 =>    192.168.1.17 9993
> Thu Aug 10 14:00:15 2017 UDP      2.2.222.22 59032 =>    192.168.1.19 9993
> Thu Aug 10 14:00:15 2017 UDP      2.2.222.22 59032 =>    192.168.1.20 9993
> Thu Aug 10 14:00:20 2017 UDP      2.2.222.22 9993  =>    192.168.1.32 9993
> Thu Aug 10 13:59:54 2017 UDP      2.2.222.22 9993  =>    192.168.1.36 9993
> Thu Aug 10 14:00:20 2017 UDP      2.2.222.22 59032 =>    192.168.1.37 9993
> Thu Aug 10 14:00:15 2017 UDP      2.2.222.22 9993  =>    192.168.1.38 9993
> Thu Aug 10 14:00:15 2017 UDP      2.2.222.22 59032 =>    192.168.1.40 9993
> Thu Aug 10 14:00:15 2017 UDP      2.2.222.22 59032 =>    192.168.1.40 9993
> Thu Aug 10 14:00:20 2017 UDP      2.2.222.22 59032 =>    192.168.1.41 9993
> Thu Aug 10 13:59:56 2017 UDP      2.2.222.22 9993  =>    192.168.1.42 9993
> Thu Aug 10 14:00:15 2017 UDP      2.2.222.22 59032 =>    192.168.1.48 9993
> Thu Aug 10 14:00:20 2017 UDP      2.2.222.22 9993  =>    192.168.1.49 9993
> Thu Aug 10 14:00:19 2017 UDP      2.2.222.22 59032 =>    192.168.1.52 9993
> Thu Aug 10 13:59:34 2017 UDP      2.2.222.22 59032 =>    192.168.1.58 9993
> Thu Aug 10 14:00:20 2017 UDP      2.2.222.22 59032 =>    192.168.1.76 9993
> Thu Aug 10 14:00:20 2017 UDP      2.2.222.22 9993  =>    192.168.1.79 9993
> Thu Aug 10 14:00:20 2017 UDP      2.2.222.22 59032 =>    192.168.1.79 9993
> Thu Aug 10 14:00:15 2017 UDP      2.2.222.22 9993  =>    192.168.1.93 9993
> Thu Aug 10 14:00:15 2017 UDP      2.2.222.22 59032 =>    192.168.1.95 9993
> Thu Aug 10 14:00:00 2017 UDP      2.2.222.22 9993  =>   192.168.1.101 9993
> Thu Aug 10 14:00:19 2017 UDP      2.2.222.22 9993  =>   192.168.1.107 9993
> Thu Aug 10 14:00:20 2017 UDP      2.2.222.22 59032 =>   192.168.1.109 9993
> Thu Aug 10 14:00:15 2017 UDP      2.2.222.22 9993  =>   192.168.1.112 9993
> Thu Aug 10 14:00:15 2017 UDP      2.2.222.22 59032 =>   192.168.1.113 9993
> Thu Aug 10 14:00:20 2017 UDP      2.2.222.22 9993  =>   192.168.1.114 9993
> Thu Aug 10 14:00:00 2017 UDP      2.2.222.22 51894 =>   192.168.1.118 9993
> Thu Aug 10 14:00:15 2017 UDP      2.2.222.22 9993  =>   192.168.1.119 9993
> Thu Aug 10 13:59:55 2017 UDP      2.2.222.22 9993  =>   192.168.1.121 9993
> Thu Aug 10 14:00:15 2017 UDP      2.2.222.22 9993  =>   192.168.1.131 9993
> Thu Aug 10 14:00:15 2017 UDP      2.2.222.22 59032 =>   192.168.1.136 9993
> Thu Aug 10 14:00:20 2017 UDP      2.2.222.22 9993  =>   192.168.1.136 9993
> Thu Aug 10 14:00:19 2017 UDP      2.2.222.22 59032 =>   192.168.1.154 9993
> Thu Aug 10 14:00:00 2017 UDP      2.2.222.22 59032 =>   192.168.1.159 9993
> Thu Aug 10 13:59:55 2017 UDP      2.2.222.22 9993  =>   192.168.1.160 9993
> Thu Aug 10 14:00:15 2017 UDP      2.2.222.22 9993  =>   192.168.1.161 9993
> Thu Aug 10 13:59:25 2017 UDP      2.2.222.22 9993  =>   192.168.1.165 9993
> Thu Aug 10 13:59:36 2017 UDP      2.2.222.22 39073 =>   192.168.1.165 9993
> Thu Aug 10 13:59:56 2017 UDP      2.2.222.22 59647 =>   192.168.1.165 9993
> Thu Aug 10 14:00:20 2017 UDP      2.2.222.22 59032 =>   192.168.1.166 9993
> Thu Aug 10 14:00:20 2017 UDP      2.2.222.22 9993  =>   192.168.1.196 9993
> Thu Aug 10 14:00:19 2017 UDP      2.2.222.22 9993  =>   192.168.1.203 9993
> Thu Aug 10 14:00:20 2017 UDP      2.2.222.22 9993  =>   192.168.1.204 9993
> Thu Aug 10 13:59:55 2017 UDP      2.2.222.22 9993  =>   192.168.1.213 9993
> Thu Aug 10 14:00:15 2017 UDP      2.2.222.22 59032 =>   192.168.1.216 9993
> Thu Aug 10 13:59:55 2017 UDP      2.2.222.22 59032 =>   192.168.1.220 9993
> Thu Aug 10 14:00:20 2017 UDP      2.2.222.22 9993  =>   192.168.1.225 9993
> Thu Aug 10 14:00:15 2017 UDP      2.2.222.22 9993  =>   192.168.1.229 9993
> Thu Aug 10 14:00:20 2017 UDP      2.2.222.22 59032 =>   192.168.1.244 9993
> Thu Aug 10 14:00:20 2017 UDP      2.2.222.22 9993  =>   192.168.1.251 9993
> Thu Aug 10 14:00:15 2017 UDP      2.2.222.22 9993  =>    192.168.4.43 9993
> Thu Aug 10 13:59:37 2017 UDP      2.2.222.22 9993  =>  192.168.10.169 9993
> Thu Aug 10 14:00:20 2017 UDP      2.2.222.22 9993  =>   192.168.51.22 9993
> Thu Aug 10 13:59:39 2017 UDP      2.2.222.22 59032 =>   192.168.51.25 9993
> Thu Aug 10 14:00:20 2017 UDP      2.2.222.22 59032 =>   192.168.51.26 9993
> Thu Aug 10 14:00:20 2017 UDP      2.2.222.22 9993  =>   192.168.51.29 9993
> Thu Aug 10 14:00:20 2017 UDP      2.2.222.22 9993  =>  192.168.86.202 9993
> Thu Aug 10 13:59:45 2017 UDP      2.2.222.22 9993  =>  192.168.86.208 9993
> Thu Aug 10 14:00:20 2017 UDP      2.2.222.22 59032 =>   192.168.88.14 9993
> Thu Aug 10 13:59:55 2017 UDP      2.2.222.22 9993  =>   192.168.88.15 9993
> Thu Aug 10 14:00:20 2017 UDP      2.2.222.22 59032 =>   192.168.88.15 9993
> Thu Aug 10 14:00:20 2017 UDP      2.2.222.22 9993  =>   192.168.88.21 9993
> Thu Aug 10 14:00:00 2017 UDP      2.2.222.22 9993  =>   192.168.88.24 9993
> Thu Aug 10 14:00:20 2017 UDP      2.2.222.22 59032 =>   192.168.88.25 9993
> Thu Aug 10 14:00:15 2017 UDP      2.2.222.22 59032 =>   192.168.88.30 9993
> Thu Aug 10 14:00:20 2017 UDP      2.2.222.22 59032 =>   192.168.88.31 9993
> Thu Aug 10 14:00:15 2017 UDP      2.2.222.22 9993  =>   192.168.88.36 9993
> Thu Aug 10 14:00:20 2017 UDP      2.2.222.22 59032 =>   192.168.88.47 9993
> Thu Aug 10 14:00:20 2017 UDP      2.2.222.22 59032 =>  192.168.88.112 9993
> Thu Aug 10 13:59:59 2017 UDP      2.2.222.22 9993  =>  192.168.88.124 9993
> Thu Aug 10 14:00:20 2017 UDP      2.2.222.22 9993  =>  192.168.88.156 9993
> Thu Aug 10 13:59:59 2017 UDP      2.2.222.22 59032 =>  192.168.88.223 9993
> Thu Aug 10 14:00:20 2017 UDP      2.2.222.22 59032 =>  192.168.88.227 9993
> Thu Aug 10 14:00:00 2017 UDP      2.2.222.22 59032 =>  192.168.88.251 9993
> Thu Aug 10 13:59:33 2017 UDP      2.2.222.22 9993  =>  192.168.88.254 9993
> Thu Aug 10 14:00:15 2017 UDP      2.2.222.22 9993  =>   192.168.100.4 9993
> Thu Aug 10 13:59:40 2017 UDP      2.2.222.22 9993  =>  192.168.100.17 9993
>

I that even right? I don't have such networks on my server.

adamierymenko commented 7 years ago

I'm not sure about the question.

ZeroTIer communicates with several things other than just other peers-- root servers, controllers, etc. It could be those.

zielmicha commented 7 years ago

Hetzner has a broken portscan detector (it shouldn't fire for private IP addresses). It has the same issue with IPFS. The best solution is to blackhole private addresses (e.g. iptables -A OUTPUT -o eth0 -d 192.168.0.0/16 -j DROP) using iptables.

adamierymenko commented 7 years ago

Hrm. So not our problem. Would be good to complain to them.

misuzu commented 7 years ago

@adamierymenko but root servers and controllers have public addresses, not private. So there should not be any requests to private addresses in the first place.