1

Nat-Table

I was doing some checking on my home network activity and in the process discovered some external IP address in my NAT table under the Inside Local column. I checked the table a couple of times over the course of the morning and each time found different entries. Usually no more than 1 or 2 but listed under the Inside Local column as a static entry. Whois showed the IPs to be from different locations; Turkey, S. Africa, USA, Germany, Romania etc. I did netstat against the corresponding port and in once instance found that it was using using Service Host as below.

netstat check

Pid

I don't know if this is normal behavior or not and I have no reason to believe that there is anything suspicious going on but I thought I would just put it out there to allay my fears.

Thanks for any help/advice/info in advance.

Improve this question
15
  • Welcome to StackExchange. Your question is very difficult to answer, because it is enormously broad. There is no doubt that we might be witnessing a compromised system, but how can we infer that from the info you provided? First, what does it mean you found external IP addresses under the NAT table? NAT is used for local devices, how can they have external IPs? Then, it is impossible to know whether these IPs correspond to a break-in or to a legitimate service, the least you should do is to provide the IPs in question. Please rewrite your post to make it possible for anyone to help you.
    – MariusMatutiae
    Aug 3, 2016 at 16:43
  • Thanks Marius. I'll do that once i get home. Yes of course Nat is for internal IPs or rather it provides the means for internal devices to communicate with external devices and that is exactly why I am concerned.
    – Geabhrog
    Aug 3, 2016 at 17:16
  • 2
    This needs more information, such as the exact IP addresses in question. Your screenshot shows only a link-local IPv6 listener, so not sure how it can be related.
    – u1686_grawity
    Aug 4, 2016 at 4:31
  • I added a link to the nat-table excerpt at the top of the original question. I can't find the specific one related to yesterday's post, I may not have saved it. As you will see in this example there is a static external IP where the list of internal IPs should show. I just want to know if this is normal.
    – Geabhrog
    Aug 4, 2016 at 12:10
  • Before I get asked. I'm not in Germany. My provider is Vodafone in Ireland.
    – Geabhrog
    Aug 4, 2016 at 16:49

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .