The Boston Diaries

The ongoing saga of a programmer who doesn't live in Boston, nor does he even like Boston, but yet named his weblog/journal “The Boston Diaries.”

Go figure.

Monday, October 30, 2006

Alien packets from outer space

I finally got monnet, my simplistic network monitor/dumping program, working under Linux kernels higher than 2.2. I wrote it a few years ago, both as an educational experience, and as a tool to see what activity existed on the network at work. I like it better than tcpdump or ethereal because it shows the traffic in real time with a concise summary:

S:02608CD87517 D:0014BF4DECE5  ARP         A:request ETH:IPv4 10.0.0.1        10.0.0.160     
S:0014BF4DECE5 D:02608CD87517  ARP         A:reply   ETH:IPv4 10.0.0.160      10.0.0.1       
S:02608CD87517 D:000D935D6D86  ARP         A:request ETH:IPv4 10.0.0.1        10.0.0.13      
S:000D935D6D86 D:02608CD87517  ARP         A:reply   ETH:IPv4 10.0.0.13       10.0.0.1       
S:0040332E103C D:02608CD87517  IPv4        S:10.0.0.3        D:10.0.0.1         UDP            S:NTP        D:NTP        62
S:02608CD87517 D:0040332E103C  IPv4        S:10.0.0.1        D:10.0.0.3         UDP            S:NTP        D:NTP        62
S:0014BF4DECE5 D:02608CD87517  IPv4        S:10.0.0.160      D:69.59.240.102    UDP            S:(10000)    D:(10000)    
S:02608CD87517 D:0014BF4DECE5  IPv4        S:69.59.240.102   D:10.0.0.160       UDP            S:(10000)    D:(10000)    
S:0040332E103C D:000D935D6D86  ARP         A:request ETH:IPv4 10.0.0.3        10.0.0.13      
S:000D935D6D86 D:0040332E103C  ARP         A:reply   ETH:IPv4 10.0.0.13       10.0.0.3       
S:000D935D6D86 D:0040332E103C  IPv4        S:10.0.0.13       D:10.0.0.3         TCP      AP    S:(52643)    D:SSH        58
S:0040332E103C D:000D935D6D86  IPv4        S:10.0.0.3        D:10.0.0.13        TCP      A     S:SSH        D:(52643)    10
S:000D935D6D86 D:0040332E103C  IPv4        S:10.0.0.13       D:10.0.0.3         TCP      AP    S:(52643)    D:SSH        58

That's the output from my home network for a few seconds of activity. I find it interesting to see the traffic that floats across the network, and I've already found some interesting stuff at work—like the Cisco router one of our customers is running (he forgot to turn off the Cisco Discovery Protocol, and it's leaking out onto our network), or the ICMP router discovery packets (again, from said customer), IGMP packets (from yet a different customer with a talkative router), the Spanning Tree Protocol the various switches use to communicate, and then there's the weird stuff.

S:00E0B0641863 D:00E0B0641863  (9000) 60

And then there's:

S:00E0B0641862 D:AB0000020000  DNARC       63

I have this as the “DEC DNA Remote console,” but as far as I know, we have no DEC equipment anywhere on our network. And from the looks of it, both alien packets derive from the same (or similar) equipment, but the really odd thing about this (as if things weren't weird enough) is that I can't reconcile the locations I saw these two packets—different segments of our network (i.e. the network segment I saw the first wierd packet is physically disjointed from the network segment I saw the second weird packet).

I wonder …

Did I perhaps discover the mysterious Halloween Packets?

What was that noise?

It came from the wiring closet—

Excuse me while I go check it out.

Obligatory Picture

[It's the most wonderful time of the year!]

Obligatory Links

Obligatory Miscellaneous

You have my permission to link freely to any entry here. Go ahead, I won't bite. I promise.

The dates are the permanent links to that day's entries (or entry, if there is only one entry). The titles are the permanent links to that entry only. The format for the links are simple: Start with the base link for this site: http://boston.conman.org/, then add the date you are interested in, say 2000/08/01, so that would make the final URL:

http://boston.conman.org/2000/08/01

You can also specify the entire month by leaving off the day portion. You can even select an arbitrary portion of time.

You may also note subtle shading of the links and that's intentional: the “closer” the link is (relative to the page) the “brighter” it appears. It's an experiment in using color shading to denote the distance a link is from here. If you don't notice it, don't worry; it's not all that important.

It is assumed that every brand name, slogan, corporate name, symbol, design element, et cetera mentioned in these pages is a protected and/or trademarked entity, the sole property of its owner(s), and acknowledgement of this status is implied.

Copyright © 1999-2019 by Sean Conner. All Rights Reserved.