1

While inspecting some flow logs, I noticed some port 22 traffic destined to a few local servers (at 10.x.x.x) . What was surprising is that the traffic originated from a 169.254.x.x IP address. Is this normal?

IP addresses can be resolved to a hostname, but how do we identify APIPA devices that attempt to connect to certain services in a network?

1

It's not very common, but I've seen this occur before.

From a theoretical networking viewpoint, you can think of these addresses just as any other IP address range. So, if I were attempting to hunt down the source of this traffic, I'd start by asking "how did this traffic get to my router?".

One suggestion: look for an ARP table within the router. For example, in JunOS you would use:

show arp no-resolve

This could provide you with the MAC address for the device. From the MAC address, you can lookup the device manufacturer, which can provide more insight into which device has the IP address. Either way, note the MAC address.

Some key questions:

  1. Is there another router connected to the physical interface of your router?
  2. If yes, does that router have any interface addresses within the 169.254.0.0/16 subnet (unlikely, and this would be strange)? If so, repeat the previous step for this router.
  3. If no, then it's a matter of hunting the device from that physical interface.

Some hints to hunt down the device connected to the physical interface:

  • If it's a direct physical connection to that router then the hunt is over!
  • Are there any switches connected to that physical interface? If so, look up the MAC address table in the switch and try and find the corresponding interface that matches the MAC you found in the previous step.

There's no silver bullet for tracking down the device, but repeating the steps above should help. I'd bet it's a random Windows device connected to a switch somewhere.

  • That makes sense. I'll see what I can find. On a side note, can APIPA addresses talk to other standard RFC 1918 private IP addresses? – appleCIDR Apr 10 '18 at 17:39
  • It depends on routing. The addresses are in different subnets, and so your computer in an APIPA (say 169.254.1.2) trying to transmit to, e.g. 10.1.1.2, would need to transmit through the default gateway. If the route is configured to allow it, then yes it'll work. But otherwise the message would be lost in the gateway. You can think of these addresses just like any others, just that as humans we treat them a bit special by using them only in private ways. – theoneandonly2 Apr 10 '18 at 18:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.