2

I was fiddling with my router's uPnP settings and found this:

enter image description here

Why is an external IP address showing here?

I also did a reverse IP search and to my surprise the IP 25.54.27.39 showed "UK Ministry of Defence". I am not in the UK military or on a military base.

Is something malicious going on here? I have already disabled uPnP.

Improve this question
13
  • Where you in a private chat with someone in the UK or the UK military?
    – schroeder ♦
    Commented Jun 20, 2020 at 8:34
  • No I wasn't in a private Whatsapp chat or call with anyone from UK or UK military, I was on a Whatsapp conference call with some people based out of India
    – Bushara
    Commented Jun 20, 2020 at 8:38
  • Why will an External IP address show in the first place? Shouldn't it show only the local IP addresses?
    – Bushara
    Commented Jun 20, 2020 at 8:41
  • The "application Description" column: where does that info come from?
    – Marcus Müller
    Commented Jun 20, 2020 at 9:18
  • @MarcusMüller it usually populates during whatsapp calls
    – Bushara
    Commented Jun 20, 2020 at 9:44

1 Answer 1

Reset to default
1

When available, WhatsApp uses uPnP for dynamic port forwarding and external IP address discovery to establish peer-to-peer VoIP session. The external IP address you are seeing is the public IP address of someone with whom you are on call via WhatsApp. If it is not you, then someone in your family is making a VoIP. uPnP settings only shows active uPnP connections.

uPnP is the NAT traversal protocol which opens a temporary port for inbound traffic and forwards it to the uPnP client (like WhatsApp and BitTorrent client). NAT by default blocks any inbound traffic to whom you didn't send the request first. A uPnP client makes a request to uPnP listener which is your wifi router to punch a hole in NAT which allows anyone to reach out to the uPnP client. This allows the caller to send you session data without getting blocked by NAT.

Another purpose of uPnP is to let apps using peer-to-peer protocol to discover your external IP address in order to advertise how others can reach out to you without getting blocked by NAT. In VoIP, this advertising is called signalling. Signalling is not a part of uPnP.

Another method that WhatsApp uses for NAT traversal is STUN protocol which achieves the same purpose but that won't show up in your router logs.

You should ask your WhatsApp contact why he/she is using the internet of UK Ministry of Defense. They could be under surveillance.

You can read some more details in this answer: Found an application (Whatsapp) initiating UPnP requests, is it something that I should worry about?

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .