1

I'm using a wired internet connection. The ISP provides an ethernet cable, a static private IP, and a dynamic public IP. I bought a router and gave the router the static private IP.

I'm using wireshark and I'm seeing that I can view packets with source IP of other users in my network (other users of my ISP). The structure of the IP is same as mine ( 10.10.X.X )

According to my understanding of networking, all packets will be accepted till layer 2, and then discarded if the MAC address is not matching. Hence I should be seeing all packets if the wire was directly connected to my PC's interface. But, I'm behind a router and wireshark is monitoring the interface on my PC, not the router's interface. So the router should be dropping the packets before it can even reach my PC interface

How is this possible?

PS:

  • Download wireshark output here
  • My router is a very basic model. Model TL-WR841N from TP Link
  • Not using any custom firmware from DD-WRT
  • You gave us a capture, but forgot to mention which IP was on the system you were capturing from. Anyway, are you sure that you aren't just seeing standard broadcast traffic? Name announcements and so on? Computers frequently send out messages to the local network advertising various things like their name, and so on. – Zoredache Jan 22 '16 at 20:02
  • +Zoredache My static private IP is 10.10.40.5 – xavier666 Jan 22 '16 at 20:18
2

From what I can see from your dump, none of the traffic from these other 10.x addresses are leaving the local network, this looks to be destined for the 224.x.x.x range, which is multicast /broadcast traffic - indeed, other then traffic destined or sourced for 192.168.1.10, I do not see any traffic destined for the wider Internet from the part of your dump I looked at.

  • @xavier666, if you don't understand davidgo's reference to multicast traffic - see the Wikipedia multicast article. – moonpoint Jan 22 '16 at 20:21
  • +moonpoint I got it. I thought multicasting was only at IP level, not at MAC level. I saw the LLMNR protocol at wiki and got it. Thanks :) – xavier666 Jan 22 '16 at 20:23
  • @xavier666, multicast exists at both levels (see multicast addresses) – heavyd Jan 22 '16 at 20:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.