Page 1 of 4 123 ... LastLast
Results 1 to 10 of 35

Thread: 0.0.0.0 traffic

  1. #1
    Master Untangler
    Join Date
    Jul 2018
    Posts
    103

    Default 0.0.0.0 traffic

    Hi all

    I lately (the last few days) have new network traffic (seen in Top-Hostnames-Usage) coming from 0.0.0.0
    I cannot identify this.

    Any idea what this could be?

  2. #2
    Master Untangler Sam Graf's Avatar
    Join Date
    Feb 2016
    Location
    Michigan
    Posts
    887

    Default

    Have you added a new host to your network? Are all the devices on your network holding a valid DHCP lease?

  3. #3
    Master Untangler
    Join Date
    Jul 2018
    Posts
    103

    Default

    No I have not added nothing new. It doesn't appear in the hosts lists also.
    All the devices in the device list and host lost have a valid IP either fixed or via DHCP.

  4. #4
    Master Untangler Sam Graf's Avatar
    Join Date
    Feb 2016
    Location
    Michigan
    Posts
    887

    Default

    What I'm wondering about is a device that has no public or private address at all. I'm guessing Untangle can't identify such a device as a host.

  5. #5
    Untangler jcoffin's Avatar
    Join Date
    Aug 2008
    Location
    Sunnyvale, CA
    Posts
    8,389

    Default

    Do you have Log blocked sessions in /admin/index.do#config/network/advanced checked?
    Attention: Support and help on the Untangle Forums is provided by
    volunteers and community members like yourself.
    If you need Untangle support please call or email support@untangle.com

  6. #6
    Master Untangler
    Join Date
    Jul 2018
    Posts
    103

    Default

    Quote Originally Posted by jcoffin View Post
    Do you have Log blocked sessions in /admin/index.do#config/network/advanced checked?
    yes I have.

  7. #7
    Master Untangler
    Join Date
    Jul 2018
    Posts
    103

    Default

    in the respective /admin/index.do#reports?cat=network&rep=blocked-sessions I can't find any reference to it.

  8. #8
    Master Untangler
    Join Date
    Jul 2018
    Posts
    103

    Default

    When I do a ping test in /admin/index.do#config/network/troubleshooting/ping I get

    Tue Jan 14 2020 10:52:16 GMT+0000 (Western European Standard Time) - Test Started
    PING 0.0.0.0 (127.0.0.1) 56(84) bytes of data.
    64 bytes from 127.0.0.1: icmp_seq=1 ttl=64 time=0.212 ms
    64 bytes from 127.0.0.1: icmp_seq=2 ttl=64 time=0.211 ms
    64 bytes from 127.0.0.1: icmp_seq=3 ttl=64 time=0.197 ms
    64 bytes from 127.0.0.1: icmp_seq=4 ttl=64 time=0.221 ms
    64 bytes from 127.0.0.1: icmp_seq=5 ttl=64 time=0.224 ms

    --- 0.0.0.0 ping statistics ---
    5 packets transmitted, 5 received, 0% packet loss, time 4126ms
    rtt min/avg/max/mdev = 0.197/0.213/0.224/0.009 ms
    Tue Jan 14 2020 10:52:21 GMT+0000 (Western European Standard Time) - Test Completed

    --------------------------------------------------------

  9. #9
    Master Untangler Sam Graf's Avatar
    Join Date
    Feb 2016
    Location
    Michigan
    Posts
    887

    Default

    Well, that's interesting. 127.0.0.1 is the Untangle device itself. I had always understood that 0.0.0.0 and 127.0.0.1 are not the same thing, But doing a little research, it seems that it can be the case when a server device has multiple interfaces, software can use 0.0.0.0 as a monitoring technique for things I don't clearly understand.

    So, in short, no doubt your device has multiple interfaces and so 0.0.0.0 is the Untangle device itself.

  10. #10
    Master Untangler
    Join Date
    Jul 2018
    Posts
    103

    Default

    Quote Originally Posted by Sam Graf View Post
    Well, that's interesting. 127.0.0.1 is the Untangle device itself. I had always understood that 0.0.0.0 and 127.0.0.1 are not the same thing, But doing a little research, it seems that it can be the case when a server device has multiple interfaces, software can use 0.0.0.0 as a monitoring technique for things I don't clearly understand.

    So, in short, no doubt your device has multiple interfaces and so 0.0.0.0 is the Untangle device itself.
    Yes 0.0.0.0 resolves to localhost and would be the device itself. It has 2 wired and one wifi interface.
    The strange thing is that the traffic is new. Starts in the morning and stops in the late afternoon and is continuous in between. Low bandwith but nevertheless.

Page 1 of 4 123 ... LastLast

Tags for this Thread

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  

SEO by vBSEO 3.6.0 PL2