2

We have a pair of HP 2910al-24G switches that are used internally at one of our locations. They are both updated with the most recent firmware and software and are operating fine.

During a routine inspection of our firewall logs, we discovered that both of these switches appeared to be originating a series of ICMP packets to a consistent set of addresses. No other traffic to/from that address can be seen.

The log entries are as follows:

2016-03-19 08:32:45 crit    ICMP ping id=0! From 10.1.1.53 to 18.213.146.12, proto 1 (zone Trust, int bgroup0). Occurred 1 times.
2016-03-19 08:32:15 crit    ICMP ping id=0! From 10.1.1.52 to 18.213.177.108, proto 1 (zone Trust, int bgroup0). Occurred 1 times.

Does anyone have any idea of what these packets are?

Here is the config file from one of the switches:

show config


Startup configuration:


; J9145A Configuration Editor; Created on release #W.15.14.0007
; Ver #05:18.63.ff.35.05:b1
hostname "sw13"
module 1 type j9145a
module 2 type j9008a
module 3 type j9008a
timesync sntp
sntp unicast
sntp server priority 1 191.168.1.30
no telnet-server
time daylight-time-rule continental-us-and-canada
time timezone -480
web-management ssl
ip authorized-managers 191.168.1.93 255.255.255.255 access manager
ip authorized-managers 191.168.1.90 255.255.255.255 access manager
ip authorized-managers 191.168.1.92 255.255.255.255 access manager
ip authorized-managers 191.168.1.21 255.255.255.255 access manager
ip authorized-managers 191.168.1.51 255.255.255.255 access manager
ip authorized-managers 191.168.1.58 255.255.255.255 access manager
ip authorized-managers 191.168.1.104 255.255.255.255 access manager
ip authorized-managers 191.168.1.30 255.255.255.255 access manager
ip authorized-managers 191.168.1.29 255.255.255.255 access manager
ip default-gateway 191.168.1.1
ip ssh filetransfer
interface 1
   name "xy-sw1"
   exit
interface 2
   name "xy-sw2"
   exit
interface 3
   name "xy-sw3"
   exit
interface 4
   name "xy-sw4"
   exit
interface 5
   name "xy-lin14"
   exit
interface 6
   name "xy-esxi1-nic6"
   exit
interface 7
   name "xy-esxi1-nic7"
   exit
interface 8
   name "xy-esxi3-nic7"
   exit
interface 9
   name "xy-esxi3-nic6"
   exit
interface 10
   name "xy-sw12"
   exit
interface 13
   name "xy-esxi2-nic6"
   exit
interface 14
   name "xy-esxi2-nic7"
   exit
interface 15
   name "xy-win3"
   exit
interface 19
   name "Office"
   exit
interface 20
   name "Office"
   exit
interface 21
   name "Mgt Port xy-ids1"
   exit
interface 23
   name "xy-sw14"
   exit
snmp-server community "supersecret..." unrestricted
vlan 1
   name "DEFAULT_VLAN"
   untagged 1-24,A1-A2,B1-B2
   ip address 191.168.1.52 255.255.252.0
   exit
spanning-tree
spanning-tree priority 1
no tftp client
no tftp server
no autorun
no dhcp config-file-update
password manager
password operator


xy-sw13# 
7
  • 1
    According to ARIN 18.0.0.0/8 is a net range assigned to the Massachusetts Institute of Technology (MIT). Anyway in order to check why the switches are communicating with those addresses, could you please post the configuration of the switches? – Daniel Yuste Aroca Mar 19 '16 at 16:58
  • 2
    That switch doesn't have the 10.1.1.53 source address from the ping. Where is that address in your network? Could some user on a PC be pinging MIT? Why do you think its a switch? – Ron Maupin Mar 19 '16 at 23:39
  • Our IT manager insisted that I sanitize the 10.1 addresses so they were all changed to 192.168 - my apologies for not clearly stating that. The addresses are definitely our pair of HP 2910 switches that live at 10.1.1.52 and 10.1.1.53. We've double-checked the config and verified their IPs so there is no question there. – Eugene Mar 20 '16 at 17:24
  • Sanitizing addresses is for hiding public addresses, not private addresses like 10.0.0.0/8 addresses. Just about every large company in the world uses that range, and it doesn't give anything away. It would be my guess that someone logged into the switches was testing something by pinging the outside addresses from the switches. It's pretty harmless unless you find other traffic from the switches to those addresses. – Ron Maupin Mar 22 '16 at 22:45
  • Totally understood on the 10.0.0.0/8 addresses - not my decision. The puzzling thing about the ICMP packets is that they are repetitive over the last several weeks. There are only three of us with access to the switches and none of us have been pinging that address. It does seem to be harmless yet it is a puzzle we'd like to resolve. – Eugene Mar 22 '16 at 23:56
1

Both IP's are today registered to Amazon, so I guess it's something Aruba Cloud related hosted on AWS. They probably got some unused IP-segment from MIT and there was a delay in the ARIN records getting updated (whois.arin.net shows them registered to Amazon in April '17).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.