In my firewall logs I recently see frequent connection attempts from a 10.0.0.0/8 network. This network is used by VirtualBox, but I can exclude that these packets come from those. No physical machine is intended to use this net.
I guess that the source is a linux machine 2 hops from the firewall, which could e.g. be anything in WiFi. Since I known some Android devices have trouble with DHCP, I suspect that they cause the issue. But knowing is better than guessing! Beyond that I'd not expect the AP to route 10.0.0.0/8 - but it wouldn't be the first time these boxes do something I do not expect.
Yes, I could try to hunt it down when I happen to see such access and following the traffic by tcpdump, arp, ... but
is there a linux tool to monitor network traffic and trace it back to the origin - probably returning the route as a list of MAC / IP?
