Hacker News Reader

Comment by nickburns | Hacker News Reader

arpwatch running on an edge router of mine tells me that there's a host with a DoD-registered IP address connected to my (major US) ISP network segment, which I know for a fact contains both business and residential subscribers. I port scanned it when I first discovered it just to say 'hello', and I have little doubt that a dragnet surveillance apparatus lives on the other side of that firewall.

Governments have utilized clandestine wiretaps for as long as there have been wires. Bad guys and the children and all that. Not to mention, what an advantage that people think you're kooky when you talk openly about this stuff!

View on HN

The DoD also just does an incredible amount of stuff. It is entirely possible that there's just a satellite office for this or that nearby.

Long tentacles indeed.

This post makes no sense whatsoever, for a whole lot of reasons.

1. If this were some covertly installed device, would it have a government attributable IP address?

2. If it were being used for surveillance, why would it be visible at all, instead of being on the other side of a passive optical tap?

3. If it’s really on the same broadcast domain as you, and on some other IP subnet, how can you talk to it?

4. You can configure a device on a network to use any IP address. Why do you think that means it belongs to the government?

1. I can only assume the DoD has complete control over this IP address.

2. Not something we can answer. Why would it need to be invisible to function as network surveillance?

3. It is on the same broadcast domain, which is how my edge router is able to 'talk' to it.

4. See response to #1.

A long-forgotten machine on a DoD network sounds like the kind of host that could serve for idle scanning or any other technique using a forged source address and a predictable dummy host; I imagine that arpwatch takes a view of network security focused on classifying frames and less on connection behavior.

Reply on news.ycombinator.com