Network Pest
Posted: Tue Aug 06, 2019 5:25 pm
I rent a room in a house with nine tenants. We all share wireless internet provided by the landlord. I'm seeing these packets every few minutes from another user:
$sudo tcpdump -i wlan0 host 192.168.1.127
11:06:57.902903 IP 192.168.1.127.1900 > MyPi.33336: UDP, length 338
11:06:58.215979 IP 192.168.1.127.1900 >MyPi.33336: UDP, length 338
11:06:58.814692 IP 192.168.1.127.1900 > MyPi.33336: UDP, length 338
11:06:59.736929 IP 192.168.1.127.1900 > MyPi.33336: UDP, length 338
11:07:02.897106 ARP, Request who-has MyPi tell 192.168.1.127, length 28
11:07:02.897176 ARP, Reply MyPi is-at xx:xx:xx:xx:xx:xx (oui Unknown), length 28
11:08:58.025223 IP 192.168.1.127.1900 > MyPi.45977: UDP, length 338
11:09:00.161093 IP 192.168.1.127.1900 > MyPi.45977: UDP, length 338
11:09:03.029532 ARP, Request who-has MyPi tell 192.168.1.127, length 28
11:09:03.029607 ARP, Reply MyPi is-at xx:xx:xx:xx:xx:xx (oui Unknown), length 28
11:10:56.888098 IP 192.168.1.127.1900 > MyPi.38917: UDP, length 338
11:10:58.133849 IP 192.168.1.127.1900 > MyPi.38917: UDP, length 338
11:11:00.881968 IP 192.168.1.127.1900 > MyPi.38917: UDP, length 338
11:11:01.888145 ARP, Request who-has MyPi tell 192.168.1.127, length 28
11:11:01.888217 ARP, Reply MyPi is-at xx:xx:xx:xx:xx:xx (oui Unknown), length 28
^C
289 packets captured
289 packets received by filter
0 packets dropped by kernel
$
I added this to my iptables:
$sudo iptables -I INPUT -s 192.168.1.127 -j DROP
So, I should be somewhat protected. Should I be concerned about the UDP and ARP packets I'm seeing.
$sudo tcpdump -i wlan0 host 192.168.1.127
11:06:57.902903 IP 192.168.1.127.1900 > MyPi.33336: UDP, length 338
11:06:58.215979 IP 192.168.1.127.1900 >MyPi.33336: UDP, length 338
11:06:58.814692 IP 192.168.1.127.1900 > MyPi.33336: UDP, length 338
11:06:59.736929 IP 192.168.1.127.1900 > MyPi.33336: UDP, length 338
11:07:02.897106 ARP, Request who-has MyPi tell 192.168.1.127, length 28
11:07:02.897176 ARP, Reply MyPi is-at xx:xx:xx:xx:xx:xx (oui Unknown), length 28
11:08:58.025223 IP 192.168.1.127.1900 > MyPi.45977: UDP, length 338
11:09:00.161093 IP 192.168.1.127.1900 > MyPi.45977: UDP, length 338
11:09:03.029532 ARP, Request who-has MyPi tell 192.168.1.127, length 28
11:09:03.029607 ARP, Reply MyPi is-at xx:xx:xx:xx:xx:xx (oui Unknown), length 28
11:10:56.888098 IP 192.168.1.127.1900 > MyPi.38917: UDP, length 338
11:10:58.133849 IP 192.168.1.127.1900 > MyPi.38917: UDP, length 338
11:11:00.881968 IP 192.168.1.127.1900 > MyPi.38917: UDP, length 338
11:11:01.888145 ARP, Request who-has MyPi tell 192.168.1.127, length 28
11:11:01.888217 ARP, Reply MyPi is-at xx:xx:xx:xx:xx:xx (oui Unknown), length 28
^C
289 packets captured
289 packets received by filter
0 packets dropped by kernel
$
I added this to my iptables:
$sudo iptables -I INPUT -s 192.168.1.127 -j DROP
So, I should be somewhat protected. Should I be concerned about the UDP and ARP packets I'm seeing.