0

Here is the situation:
In my company we only use static IP addresses, the address of the router interface on which every machine is connected is 192.168.0.1/16.
Our router support the DPI (Deep Packet Inspection) feature and shows us the ip addresses of all machines connected as well as their traffic. What is confusing me is i have found ip addresses starting by 81.x.x.x and 116.x.x.x on our LAN.

How in the world is this possible?? Since the address of the interface LAN is 192.168.0.1/16, i should only see ip addresses looking like this 192.168.x.x, shouldn't i?

The first thing i have noted is those weird ip addresses have a few Kbytes traffic. That's why i have tried to capture packets with Wireshark on every active interface of the router (to gather any information about them). And filtering the display with those addresses, i have found no packets matching them.
Moreover a geolocalisation (using this webtool) of one of the ip address indicates it comes from China (we are located in Africa). Could have our network been hacked? And if so, how could i identify explicitly the hacking and prevent it from happening again?

11
  • You do mean 192.168.0.1/16, with an 8, don't you?
    – Law29
    Jul 27 '16 at 9:26
  • Does your router show you the MAC addresses associated with the anomalous IPs?
    – Law29
    Jul 27 '16 at 9:27
  • @Law29. You are right. My mistake, i meant 192.168.0.0/16 Jul 27 '16 at 9:34
  • @law29. The DPI feature doesn't show the MAC address therefore i took a glance at the arp tables of the router but i can't find those weird ip addresses. Jul 27 '16 at 10:23
  • 1
    What kind of router /firewall do you have?
    – Ron Trunk
    Jul 27 '16 at 11:34
2

The best practice is to drop and log any outgoing packets that do not have a valid source address (192.168.0.0/16 in your case). Depending on your equipment, for that log to contain the MAC you may need to put it on your internal interface or turn on verbose logging or something else (see Ron Trunk's comment asking you for router/firewall make and model)

If you get hits, then you have a MAC, and you can look for that MAC on your switches.

1
  • Actually since each and every ip address is manually created so that its bandwidth can be set, there is already a firewall rule allowing only outgoing traffic for those static ip addresses we have created. However i am going to check if we can log outgoing traffic not corresponding to a valid ip Jul 27 '16 at 14:29

Not the answer you're looking for? Browse other questions tagged or ask your own question.