Hacker News Reader

Comment by Kikawala | Hacker News Reader

Do you happen to have a mobile phone with AT&T and are near Fremont, CA?

Circling back, this discussion thread seems to be the most likely culprit. In my panicked state, I didn't even consider multicast traffic being the reason why I saw this traffic in tcpdump. I'm digging into this a bit more. I probably wasn't pwned, but I am still currently operating as if I were. I appreciate everyone's response here.

What does being near Fremont have to do with the issue?

To see if it was OP's phone and not something outside.

That doesn't answer the question. Why is Fremont, CA special?

Answered in another comment: https://news.ycombinator.com/item?id=33821403

How the hell did you guess the Fremont thing? This feels like magic

OP provided an IP in another post below.

https://ipinfo.io/107.122.31.71

Yes and yes.

See if the traffic goes away if you disconnect the phone from your wifi. It's most likely AT&T's wifi calling feature.

So interestingly, it looks like Unifi did classify the traffic as wifi calling, but it was doing a lot of traffic in the middle of the night when I was asleep. And the biggest question mark in my head is: how is this traffic looking like it's coming from my desktop?

And by looking it's coming from my desktop, I mean the tcpdump was run directly on my desktop and I saw the traffic there. So I assume it had to be routed through my desktop unless I am missing something.

You can run the below command to see which process or PID is talking over ipsec-nat-t

sudo lsof -n -i :4500

You are missing something. You are seeing BGP routing table updates on your network from an AT&T router. You have BGP running on your network somewhere.

I had run lsof on my desktop and I did not see any of the IP addresses in question. I did not check specifically for port 4500 though.

That's often true, but not always. For example, if your desktop is connected to an Ethernet hub, you would usually expect to see all traffic from any machine on the hub. (Ethernet switches are a different story.)

Wi-Fi can work the same way, though it sometimes requires an extra step to place your machine's network card into "promiscuous mode" in order to see traffic neither to or from your machine.

WiFi calling is multicast, I think, so your phone just basically broadcasts it to the network and every device will see it, though only your router will actually do anything with it.

There's examples of WiFi calling causing this type of issue, described as a packet storm. For example, here's a reddit post with similar symptoms you're describing. https://www.reddit.com/r/networking/comments/3g31mc/iphone_w...

This actually makes the most sense so far. I hadn't even considered the possibility of multicast. Let me see if I can dig in further.

300mbps for Wifi calling? I'd say more like video streaming/calling.

If a network loop is involved, it could be a small amount of traffic that is getting trapped in the loop. Would need to know way more about the network setup and config though, and I would've thought most cheap home switches would run some sort of spanning tree.

Reply on news.ycombinator.com