3
I have a Linux server at home (OL 6.6, fwiw) running some internal services. I noticed this morning that it is responding to ARP requests for an address I see no record of.
The IP is not configured in any /etc/sysconfig/network-scripts
files, and does not show up in ip addr show
.
From my workstation:
macbook:~ elliott$ arping -c1 192.168.50.108
ARPING 192.168.50.108
60 bytes from 00:24:81:05:c0:cb (192.168.50.108): index=0 time=1.854 msec
--- 192.168.50.108 statistics ---
1 packets transmitted, 1 packets received, 0% unanswered (0 extra)
rtt min/avg/max/std-dev = 1.854/1.854/1.854/0.000 ms
macbook:~ elliott$
On the server:
[elliott@server ~]$ ifconfig | grep -i 00:24:81:05:C0:CB
br0 Link encap:Ethernet HWaddr 00:24:81:05:C0:CB
br0:1 Link encap:Ethernet HWaddr 00:24:81:05:C0:CB
eth0 Link encap:Ethernet HWaddr 00:24:81:05:C0:CB
[elliott@server ~]$
[elliott@server ~]$ ip addr | grep 192.168.50.108
[elliott@server ~]$
This IP is in the DHCP range on my router, fwiw, and does not respond to pings or any TCP requests in the normal port ranges (nmap -T4 -Pn 192.168.50.108
).
I've tried:
- Shutting down the server to confirm the ARP replies stop
- Shutting down services one by one and killing all unnecessary processes -- the IP does not stop responding until I shut down the computer (it is also one of the first IPs to come up when powered on)
- Changing the default gateway to point to a raspberry pi box and capture any network traffic with that IP -- I have not seen any
So my questions are a) how worried should I be? and b) what can/should I do to try to track this down?
Thanks for any help!
Isn't ARP proxying usually used to "cross" network segments, e.g. in a NAT/routed situation? In this case the ARP reply is for an IP on the same network the box's main IP is on. – ebarrere – 2016-01-25T16:32:03.373
I did have KVM running on here at one point, but none of the VMs are running anymore (
sudo virsh list
), and the box still replies even when all libvirt services are stopped -- is that normal? – ebarrere – 2016-01-25T16:33:57.120@ebarrere Question 1. Arp-proxy is used whenever you wish to have two distinct network segments within the same broadcast range. For instance, if your pc is acting as an AP and it is connected to a router via ethernet, and you want both the ethernet-connected and the wifi-connected segments to belong to the same broadcast address. Question 2: an incomplete uninstall might very well do that. Follow the suggestions I gave you in my reply. – MariusMatutiae – 2016-01-25T17:09:07.337
Thx @MariusMatutiae, unfortunately I haven't found much after following your suggestions. Proxy ARP doesn't seem to be enabled on any interfaces (
cat /proc/sys/net/ipv4/conf/*/proxy_arp
shows only 0s), no routes have been added, and no new interfaces. I did have a hypervisor running (libvirtd --daemon
), but I've stopped it and I still see the ARP replies. No VPNs or anything that I can see in process list or netstat. – ebarrere – 2016-01-25T18:00:56.243As for rootkits, it's a headless server & I don't have a monitor on it so it will be a little tricky to start it w/out networking, but I'll see what I can do. From what I understand though I shouldn't hold my breath expecting to actually find much -- the consensus seems to be that if you expect you've been hacked it's best to just rebuild..? – ebarrere – 2016-01-25T18:07:25.370
@ebarrere If you can connect to the headless server via ssh, you can run rkhunter and chkrootkit from the CLI. In your shoes, I would rebuild. – MariusMatutiae – 2016-01-25T18:20:53.303