1

Quick context: Home network, performing some DPI on my perimeter router (Ubiquiti EdgeRouter Lite) that governs 2 internal subnets separating my traffic from a bunch of roommate devices. No IDS on the network yet, so I don't have many logs to investigate.

I noticed an IP outside of the private range via DPI dashboard. I have pretty strict firewall rules and haven't seen outside IPs before. The address responds to pings and has a few services up/filtered, but no whois information or nslookup can be found. Visiting this IP's HTTP server lands me at a page displaying "Monitoring Page - sorry-hostname-not-available.imrworldwide.com". From https://www.findip-address.com/ it appears to be a local business? The IP address disappeared from my dashboard shortly after I looked around, which leads me back to thinking ubiquiti is just buggy. No additional mac addresses show up on my switch that all internal traffic flows through. As I was looking into this, I noticed the Ubiquiti AP on my less-trusted "roommate" network received 67kB from "DNS" (this is also something I've never seen before). Why would this AP be receiving DNS responses and transmitting 0kB?

All-in-all I'm just a little confused. Should I be concerned about this? Is this just Ubiquiti being buggy and doing weird things? Regardless, I'm implementing an IDS and making a tin-foil hat tonight :)

The IP itself is 138.108.50.100.

  • What was the IP address? – gowenfawr Jan 5 '17 at 20:56
  • IP: 138.108.50.100 – Tyler Almeida Jan 5 '17 at 21:24
  • I actually think that you are seeing more accurate data than you are used to not less. The Ubiquiti tools are much more detailed than you would generally find on consumer devices in my experience. That can be good but, as you've discovered, it can also be confusing. Without seeing more data on the DNS requests I don't think it is possible to comment sensibly about what you actually saw. – Julian Knight Jan 6 '17 at 15:26
  • I agree. Typically the management GUI only shows devices which it has handed an IP via DHCP, not IPs I'm connected to etc. So it was just bizarre to see it appear on the management dashboard. As for the DNS, this AP is receiving but not sending several hundred kB of DNS packets which is strange. I thought these should flow through the AP to the endpoint that requested it, unless it is trying to resolve some name itself for its mgmt server. Perhaps ubiquiti's GUI just needed to be restarted. I'll know more when it happens again. – Tyler Almeida Jan 7 '17 at 8:13
1

The IP you provided is owned by A.C. Nielsen, which is most famous for providing television ratings based on sampling by recording devices. They've since branched out into many other forms of market research. The most likely reason you're seeing it is that some device on your network or some page you browsed to triggered activity data to be sent to them.

I would consider this activity innocuous - albeit, if you're the kind of person who is performing deep packet inspection on their segregated-from-the-roommates LAN, no activity is innocuous. But it's Marketing spying on you, not Government or Hackers.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.