3

I saw this when monitoring the network the other day and haven't been able to figure out with certainty what it was for.

The application was the host process. It was inbound UDP traffic, the external IP address was 34.170.99.197 (possibly a Google CDN?), and the local port was 5355. And the remote port was 51641.

I haven't seen this connection since, but it looked suspicious to me. But I may just not realize that it's commonly used / its purpose.

What is the explanation?

2
  • 2
    It is NOT a local loopback address, but it is reserved, and doesn’t exist outside of your network
    – Ramhound
    Dec 10, 2023 at 21:27
  • 12
    Your question text does not mention anything about 0.1.0.3. Where did you see it? How does it related to the traffic in question?
    – Daniel B
    Dec 11, 2023 at 10:33

2 Answers 2

18

Port 5355 is used by LLMNR, Link Local Multicast Name Resolution.

Responders listen on port 5355, IPv4 and IPv6, and the IPv6 version listens on

IPv6 - FF02:0:0:0:0:0:1:3 (this notation can be abbreviated as FF02::1:3), MAC address 33-33-00-01-00-03

according to the spec.

It seems to me like your 0.1.0.3 is some part of the MAC address, not an IP address. Or, as @FredericVds mentions in a comment, your network monitor decided to show IPv6 addresses in a single-byte-with-dots format, which would turn the :1:3 into .0.1.0.3.

2
  • 5
    FF02::0.1.0.3 is AFAIK a valid way of writing that IPv6 address. That notation is often used when mapping IPv4 addresses onto an IPv6 network as part of some transition mechanism, but I think it's a valid format in general. OP's network monitoring tool might think it's appropriate to display the address that way for some reason. Dec 11, 2023 at 10:49
  • @FrederikVds good catch, edited in! Dec 11, 2023 at 12:54
9

If you saw a connection between an external address 34.170.99.197 and any internal address, then that address by definition cannot be a loopback address. This is because loopback addresses are internal to the host, and must be part of the subnet 127.0.0.0/8 - see RFC 5735:

"addresses within the entire 127.0.0.0/8 block do not legitimately appear on any network anywhere"

Address 0.1.0.3 might be partially defined in RFC 1122, but the RFC states specifically in section 3.2.1.3(b) that,

"It MUST NOT be sent, except as a source address as part of an initialization procedure by which the host learns its full IP address."

So it cannot be part of a conversation with an external host and should not even be routable across the wider Internet.

2
  • 2
    indeed, no destination address may start with 0. it can only be used (as far as I'm aware) as a source address when sending a broadcast asking for the address of a DHCP server. en.wikipedia.org/wiki/… Dec 11, 2023 at 1:06
  • @FrankThomas yes, that's defined in the RFC 1122 that I referenced Dec 11, 2023 at 1:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .