Weird IP in the session viewer....

[doudoufr]

what is going on with my untangle ? do i have to be worried ????

[Sam Graf]

If I had sessions on my Untangle interfaces using the private IP address space (in other words, not public IP addresses) I couldn't account for, I would be worried. Those addresses are coming from somewhere, those devices exist somewhere. If you don't have two DHCP servers on your network somehow (your ISP router and Untangle, for instance), then you can't account for those addresses. I would be worried.

[doudoufr]

i am worried but i don't know what to do, except turning all off....

[doudoufr]

well
i rebooted the untangle VM yesterday night at 11 PM
and now....no Strange IP or Phantom IP....

So maybe it is just a bug from the session viewer or Something ??
i don't know....
untangleOK.png

[cblaise]

No, the Untangle doesn't add random IP addresses to reports or monitors. All indications are that there is a machine at that address. It may not be pingable but you'll see it in the arp table.

The next time you see that address in the session viewer, go to /admin/index.do#config/network and select your Internal interface, in the lower right-hand side, you'll see a window with the arp table entries and you should see the MAC address associated with the IP address.

[doudoufr]

I did that, and...no there were NO MAC addresses associated with the IP. The IP was not there too !

the IP that were in the ARP table were legitimate ones (as shown in my screen captures), but no 192.168.1.7 or Strange things....

[dmorris]

Do you have any port forwards? If so, what are they?

So far I see absolutely nothing worrisome. Networks are chatty. If you run tcpdump you'll see tons of packets you don't understand. If that kind of thing alarms you the easiest solution is to not look at it.
If you want to understand all that chatter, just start googling, but you'll want to set aside your panic and go into learning mode. There are near infinite number of things to learn about in the networking...

[doudoufr]

what's panic me, is the Phantom IP.....or the subnet that does not exist on my network....
i have a port forward, but only in my isp routeur and for the openvpn. That's all. (1194 i think)

[Loudog2]

Could it be the VPN server your hiding behind? With the VPN off the server IP would not be there.

[doudoufr]

there was no vpn at that time.
OpenVpn in untangle use an IP in 192.168.0.XX


But...i think the stranges IP from external to external were my TV player from my ISP. When it's ON, all that stranges IP appears.

The only ones I can't explain now...are the IP 192.168.2.88 and the 192.168.1.7....

the IP 192.168.2.88 is still there....
ipen2.png

arptable.png