1

Quick context: Home network, performing some DPI on my perimeter router (Ubiquiti EdgeRouter Lite) that governs 2 internal subnets separating my traffic from a bunch of roommate devices. No IDS on the network yet, so I don't have many logs to investigate.

I noticed an IP outside of the private range via DPI dashboard. I have pretty strict firewall rules and haven't seen outside IPs before. The address responds to pings and has a few services up/filtered, but no whois information or nslookup can be found. Visiting this IP's HTTP server lands me at a page displaying "Monitoring Page - sorry-hostname-not-available.imrworldwide.com". From https://www.findip-address.com/ it appears to be a local business?

All-in-all I'm just a little confused. Should I be concerned about this? Is this just Ubiquiti being buggy and doing weird things? Regardless, I'm implementing an IDS and making a tin-foil hat tonight :)

Improve this question
5
  • What was the IP address?
    – gowenfawr
    Jan 5, 2017 at 20:56
  • IP: 138.108.50.100
    – user135403
    Jan 5, 2017 at 21:24
  • I actually think that you are seeing more accurate data than you are used to not less. The Ubiquiti tools are much more detailed than you would generally find on consumer devices in my experience. That can be good but, as you've discovered, it can also be confusing. Without seeing more data on the DNS requests I don't think it is possible to comment sensibly about what you actually saw.
    – Julian Knight
    Jan 6, 2017 at 15:26
  • I agree. Typically the management GUI only shows devices which it has handed an IP via DHCP, not IPs I'm connected to etc. So it was just bizarre to see it appear on the management dashboard. As for the DNS, this AP is receiving but not sending several hundred kB of DNS packets which is strange. I thought these should flow through the AP to the endpoint that requested it, unless it is trying to resolve some name itself for its mgmt server. Perhaps ubiquiti's GUI just needed to be restarted. I'll know more when it happens again.
    – user135403
    Jan 7, 2017 at 8:13
  • IP address seems to belong to ACNIELSEN-AS (ISP) Source: whatismyip.live/ip/138.108.50.100
    – David John
    May 28, 2020 at 16:14

1 Answer 1

Reset to default
1

The IP you provided is owned by A.C. Nielsen, which is most famous for providing television ratings based on sampling by recording devices. They've since branched out into many other forms of market research. The most likely reason you're seeing it is that some device on your network or some page you browsed to triggered activity data to be sent to them.

I would consider this activity innocuous - albeit, if you're the kind of person who is performing deep packet inspection on their segregated-from-the-roommates LAN, no activity is innocuous. But it's Marketing spying on you, not Government or Hackers.

Improve this answer

You must log in to answer this question.