0

I am working on a site-to-site VPN from our main/hub (Untangle NG Firewall) site and a new co-lo/remote (Cisco ASA 5505) site. I'm having trouble bringing the tunnel up, so I'm copy/pasting the logs into Notepad++ and I find this IP that I do not recognize: 216.218.206.86 (from log) Jan 27 18:26:33 Untangle charon: 07[NET] sending packet: from 192.168.100.0[500] to 216.218.206.86[40383] (40 bytes)

GeoIP lookup (via MaxMind.com) lists it as https://shadowserver.org out of Fremont, CA. I have read up on what they do and apparently they are good guys in InfoSec (from their site):
"The Shadowserver Foundation is currently undertaking a project to search for publicly accessible devices that have services running that should not be exposed because they are trivial to exploit or abuse. The goal of this project is to identify hosts that have these types of services exposed and report them back to the network owners for remediation."

That's all well and fine I guess, but can anyone tell me: how did this IP get in my IPvpn log? Does Untangle willingly participate in recon with them? Seems shady they would do that and notify their paying customers, if so. Thank you.

Improve this question
5
  • is the log of activity on a public IP?
    – dandavis
    Jan 29, 2017 at 22:55
  • (If I'm understanding your question) Yes, the log is from the Untangle NG Firewall at our main/hub site, which has a static pub IP. Is that what you meant?
    – SamAndrew81
    Jan 29, 2017 at 23:47
  • ok, then they hit your IP just like anyone can; you're not special, they hit all of them.
    – dandavis
    Jan 30, 2017 at 5:59
  • Probably something along the lines of: they sent you a packet, you sent a packet back saying "I'm sorry, I don't understand that" or "Invalid authentication key" or something along those lines, and they moved onto the next address on their list. Probably as I don't know anything about the systems involved.
    – user253751
    Jan 30, 2017 at 6:16
  • @dandavis, Ok, but a 40 byte packet was sent from my hub site IAD (an Untangle NG Firewall) to their public IP: sending packet: from 192.168.100.0[500] to 216.218.206.86[40383] (40 bytes)
    – SamAndrew81
    Jan 30, 2017 at 15:17

1 Answer 1

Reset to default
1

I wouldn't trust too much in a website just because they state they are "the good guys". If I had an malicious server, I would definitely write the same thing. Can you track down which of your internal machines is generating the traffic? If yes, here's few suggestions:

  • Log into the machine and run a netstat query (netstat -ano), then you will be able to find which process is connecting to that IP in that port.
  • Ensure you have anti-virus installed on the machine, if necessary, update it and run a full scan.

If you're not able to determine the source of the traffic, you can capture the traffic on the firewall and use wireshark to analyse what kind of data is being transmitted.

Improve this answer
1
  • Thanks, Ricardo. Actually no endpoints or servers were involved here. Traffic was just between the two routers trying to establish the IPsec VPN. 192.168.100.1 is the Untangle NG Firewall at our hub site. Apparently it sent a 40 byte UDP packet on port 500 to the public IP in question. They must have requested it somehow, but what worries me is that our Untangle complied...
    – SamAndrew81
    Jan 30, 2017 at 15:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .