Bogon traffic from LAN to 192.0.0.2

Security
1

I maintain two different IPFires. On each, I have a single LAN device (one a laptop, one an iPhone) that have attempted connections to 192.0.0.2. It seems like an unusually specific IP. I was curious if anyone was aware of any software that uses this IP. Basically, I am wondering why these devices are attempting to reach out to 192.0.0.2. Any ideas?

3

" Examples of router and modem brands that might use 192.0.0.2 in their configuration include Cisco Linksys, Netgear, TP-Link, ASUS, D-Link, Netcomm, Zyxel, Edimax, Belkin, Thomson, and hundreds more."

1 Like
4

I am familiar with what Bogon traffic is and that 192.0.0.2 is a reserved address. I’m trying to understand why a device that is set to DHCP and using a completely different IP range is reaching out specifically to 192.0.0.2. Does Microsoft use this IP when sharing LAN bandwidths for Windows Updates? Could some other software be doing something similar?

5

Still seeing this periodically on two different IPFires I maintain.

BOGONS
BOGONS750Ă—812 96.2 KB

I found a hint through Google that perhaps it is related to mobile carrier proxy services. It does seem that only mobile devices are attempting this connection to 192.0.0.2.

6

Is your supplier using Dual Stack Lite connection to do IPv4 in IPv6

According to RFC6333 the IP 192.0.0.2 is used for that purpose

https://www.rfc-editor.org/rfc/rfc6333

and see section 5.7 for details about that IP’s usage.

2 Likes
7

I think you’re onto something. What I don’t understand is why even make the attempt to connect to that address when on Wifi? It seems like something that would be used when the phone is using the provider’s network.

8

Maybe the code in the mobile phone is not done well enough to know when it should try that and when not.

Unfortunately, the more I see about what mobile phones do (all types) the less impressed I am about the coding quality that has been used.

Then with Android, on top of what they might do with the code the phone supplier, such as Samsung in my case, go and modify the Android code to do things Samsung wants it to do, so all Android’s of the same version are not the same Android OS. Some capabilities are removed or limited.

3 Likes