Android Enthusiasts Stack Exchange is a question and answer site for enthusiasts and power users of the Android operating system. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I recently started picking up some weird entries in my firewall log:

kernel: arplookup 26.XXX.XXX.XXX failed: host is not on local network

There are at least at dozen entries, all to different IP's within DISANET26.

I couldn't help but be curious as to what was going on so I fired up Wireshark and began capturing packets to try and find out where it was coming from.

Turns out it's my brand new HTC sensation with all but a handful of apps installed (standard google apps + other apps I've used in the past) - I don't even have it rooted yet.

Wireshark shows a Broadcast ARP packet coming from the sensation's mac address, but logs it as coming from the DoD IP in question. The target is the gateway (pfsense router).

I've found a similar discussion over at the tmobile forums with no official tmobile response:

I doubt I'll find someone at tmobile who will have a clue what I'm talking about but whether the DoD is involved or not there's no denying that the phone is trying to send these packets to them.

I won't sleep well until I know why.

share|improve this question

migrated from Jul 12 '11 at 7:55

This question came from our site for system and network administrators.

@Luy: If you "associate" your ServerFault and Android accounts you should regain possession of this question. – Al E. Jul 12 '11 at 13:06
I've heard of T-Mo doing this, yes. They're internal addresses only so don't worry about the DoD thinking you're trying to hack them or something. Just don't try to access that address manually -- use the external IP address (visit or somewhere from your device browser to find it). – Matthew Read Jul 12 '11 at 15:43
I had the same issue - t-mobile admitted assigning their ip but was not able to explain why – PawelTulin Jun 19 '14 at 3:36

Some large ISPs/cell providers have been known to be assigning reserved IP addresses (i.e. IP address that does not belong to the private addresses) to devices in their network. Many organizations (government and universities) that participated in the early days of the Internet owned very large blocks of IP address that aren't being used, and their IP addresses are suspect to this sort of misuse.

The reason they did this is usually because they run out of supply for private IP addresses. This workaround is violating all kinds of standards, but it is generally safe as long as nobody in their network need to access a server using those reserved IP addresses, and since these IP addresses are unused by their owner anyway, nobody really cared to do anything about it.

btw, my superintendant told me to told you to not worry about the men in black suits in front of your residence, they're gardeners.

share|improve this answer
Yup, that's what Hamachi did with; wonder how they're coping now that it's allocated and in use. – Piskvor Jul 12 '11 at 12:24

Thanks for your quick response Lie Ryan.

Just to update this topic a bit I called Tmobile and spoke with L3 support and indeed they're using 10.x.x.x but also 25.x.x.x and 26.x.x.x for handing out IP addresses - it depends on the device/feature in use.

The issue was that since the device was joined over wifi and had no connection to tmobile in theory it shouldn't need a tmobile IP address at all.

Well it turns out that it's indeed connection to tmobile due to the wifi calling being enabled.

Still doesn't explained that unmarked van outside the house....

share|improve this answer

I was able to find my private IP on the GSM network interface (svnet0) and it corresponds with the IP I see in the ARP requests as soon as I turn WIFI on.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.