6

I recently started picking up some weird entries in my firewall log:

kernel: arplookup 26.XXX.XXX.XXX failed: host is not on local network

There are at least at dozen entries, all to different IP's within DISANET26.

I couldn't help but be curious as to what was going on so I fired up Wireshark and began capturing packets to try and find out where it was coming from.

Turns out it's my brand new HTC sensation with all but a handful of apps installed (standard google apps + other apps I've used in the past) - I don't even have it rooted yet.

Wireshark shows a Broadcast ARP packet coming from the sensation's mac address, but logs it as coming from the DoD IP in question. The target is the gateway (pfsense router).

I've found a similar discussion over at the tmobile forums with no official tmobile response: http://forums.t-mobile.com/t5/Help-General-Discussion/Hiport-connects-to-DoD/td-p/205863

I doubt I'll find someone at tmobile who will have a clue what I'm talking about but whether the DoD is involved or not there's no denying that the phone is trying to send these packets to them.

I won't sleep well until I know why.

Improve this question
2
  • I've heard of T-Mo doing this, yes. They're internal addresses only so don't worry about the DoD thinking you're trying to hack them or something. Just don't try to access that address manually -- use the external IP address (visit ipchicken.com or somewhere from your device browser to find it).
    – Matthew Read
    Jul 12, 2011 at 15:43
  • I had the same issue - t-mobile admitted assigning their ip but was not able to explain why
    – PawelTulin
    Jun 19, 2014 at 3:36

3 Answers 3

Reset to default
8

Some large ISPs/cell providers have been known to be assigning reserved IP addresses (i.e. IP address that does not belong to the private addresses) to devices in their network. Many organizations (government and universities) that participated in the early days of the Internet owned very large blocks of IP address that aren't being used, and their IP addresses are suspect to this sort of misuse.

The reason they did this is usually because they run out of supply for private IP addresses. This workaround is violating all kinds of standards, but it is generally safe as long as nobody in their network need to access a server using those reserved IP addresses, and since these IP addresses are unused by their owner anyway, nobody really cared to do anything about it.

btw, my superintendant told me to told you to not worry about the men in black suits in front of your residence, they're gardeners.

Improve this answer
3
  • 1
    Yup, that's what Hamachi did with 5.0.0.0/8; wonder how they're coping now that it's allocated and in use.
    – Piskvor left the building
    Jul 12, 2011 at 12:24
  • @Piskvor Hamachi changed to 25.0.0.0/8
    – pizzapants184
    Jun 4, 2018 at 10:09
  • @pizzapants184: I wouldn't call "we've been evicted? Let's squat somebody else's address space then" a viable business model (especially when that someone has fighter jets and warships), but that's obviously Hamachi's problem, haven't used it for ages now.
    – Piskvor left the building
    Jun 4, 2018 at 14:03
1

Thanks for your quick response Lie Ryan.

Just to update this topic a bit I called Tmobile and spoke with L3 support and indeed they're using 10.x.x.x but also 25.x.x.x and 26.x.x.x for handing out IP addresses - it depends on the device/feature in use.

The issue was that since the device was joined over wifi and had no connection to tmobile in theory it shouldn't need a tmobile IP address at all.

Well it turns out that it's indeed connection to tmobile due to the wifi calling being enabled.

Still doesn't explained that unmarked van outside the house....

Improve this answer
1

I was able to find my private IP on the GSM network interface (svnet0) and it corresponds with the IP I see in the ARP requests as soon as I turn WIFI on.

Improve this answer

You must log in to answer this question.