by looking at iptables log, i can see hundreds of ICMP connections to my wifi router every time i connect my android phone on the wifi.
always at a random port.
:16662
:43999
:52484
:32994
:5737 (lowest)
etc
what is that?
Edit:
i'm now blocking everyting on AFWALL and seeing what it logs.
it logs the above connections as coming from:
AppID: -11
App name: (Kernel) - Linux kernel
any ideas what this is about?
Related
Hey guys,
I have been keeping my eyes out for the tun.ko module to come out in one of the kernels, and it finally did in the 1.76 GHz kernel. I had to reinstall VPN connections after flashing the kernel, and then VPN connections would tell me that my VPN was connected properly. However, I can't get data to pass through the VPN. No pings to the remote end, no RDP, nothing.
Anybody else get this working?
Thanks,
Seth
I thought I set up my VPN wrong >_> Well that explains it! Thanks! Same issue. I have however been able to see my phone in my router, though I can't do anything with it there in or out.
This sounds like the same issue I was having with openvpn (I assume that's what you're referring to since you're talking about the tun module). I'm running Das BAMF 1.3.2, and tun is already built into the kernel. I'm having the same problem. The VPN connects, no errors at all, even ran it in the terminal so I could see all of OpenVPN's connection output. But data is not routed through the tunnel. WhatIsMyIP still reports my Verizon IP address.
Now, on two occasions I have had success. I was able to connect and disconnect my VPN all I wanted and everything worked. However this only lasted for the current phone 'life cycle', ie it failed again after the next reboot. I can't find a pattern or anything, it seems that it will randomly work after a reboot, but not that often... 1 out of 10 maybe? I didn't waste my time trying to nail down a ghost.
I think I solved the OpenVPN problem. There's an option in OpenVPN settings called 'Fix HTC Routes'. If you check it, you can get the link to view the issue tracker. Essentially it deletes a few routing tables after OpenVPN starts up. For some reason, it doesn't seem to work on the Thunderbolt. Perhaps that option is using a deprecated script command (ip ru del route)? Whatever the reason, the fix is simple. After connecting to OpenVPN, open a terminal and issue the following commands:
Code:
ip ru del table gprs
ip ru del table wifi
Ignore any errors you might get if the routing table doesn't exist. I don't think you need SU, and you can use GScript Lite to make the process easier on you.
I'll give this a shot with VPN Connections when I get a chance and report back. If anybody else has any success, please post here.
I have had better success, but it's not right yet for me. I am able to get some data to flow using RDP, Telnet, etc., but nothing actually works completely right.
When telnetting into routers, I am not able to actually authenticate. however, I CAN finally see the prompts.
When using RDP, it doesn't time out any more, but I don't get any video data back to my phone's screen. No login page, etc.
Those two commands also seem to time out eventually. I need to reenter them to get the data flowing again, it seems.
Anybody else have better results?
Seth
Well, without knowing which VPN you're using, I can't say. But it does seem to work with openvpn and the OpenVPN Settings market app (I have my own install of openvpn, so I don't use the related OpenVPN Installer app).
The routing tables gprs/wifi are automatically recreated when those connections are re-established. Meaning, if you are on VPN via wifi, and wifi disconnects/reconnects, then the wifi routing table is recreated. The same goes for gprs if you lose connection and it is reestablished. I don't know what the system might try to do using the built in VPN connections.
Sorry about that, the lack of info wasn't very helpful.
I'm trying to connect to my Cisco VPN. We are using group authentication as well as user authentication. The outside device is a 2811 router, and if there are any other specifics that might help, I'd be happy to provide it.
Thanks,
Seth
When I connect my s2 to my router via wifi, the router log gets spammed with this:
Code:
11/08/2011 19:11:20 sending ACK to 192.168.2.101
11/08/2011 19:10:51 sending ACK to 192.168.2.101
11/08/2011 19:10:22 sending ACK to 192.168.2.101
11/08/2011 19:09:53 sending ACK to 192.168.2.101
11/08/2011 19:09:23 sending ACK to 192.168.2.101
11/08/2011 19:08:54 sending ACK to 192.168.2.101
So every ~30s that happens? What is it? And is it right? I am on checkrom 2.0 and speedmod k2-16.
Why not googling anything about it before making a new thread?
quoting wikipedia
"Normally when a client attempts to start a TCP connection to a server, the client and server exchange a series of messages which normally runs like this:
The client requests a connection by sending a SYN (synchronize) message to the server.
The server acknowledges this request by sending SYN-ACK back to the client.
The client responds with an ACK, and the connection is established.
This is called the TCP three-way handshake, and is the foundation for every connection established using the TCP protocol."
tho that 30 seconds between might be weird, maybe its one of the crappy security options of the router, to protect form SYN flood.
Id say its rather ok,but im no expert in the matter, maybe weak signal so your s2 is reconnecting all the time, or your s2 is trying to do a SYN flood (which is a type of DoS attack ).
Thanks! The signal is very good! Only thing I observe is a high battery drain of the phone when connected to wifi (2% more per hour).
i belive that might be the case, as its sending stuff all the time, try maybe disabling flood protections on the router? or googling for " sending ACK" i belive some people noticed that on belkin machines or something, glad i could help
So, with my notebook as wifi client this does not happen. I also did a hard reset on phone, but the same thing, even with stock firmware
hmm... im running out of ideas tbh xD is your phone connecting to anything when those ack fly? your setting dissable wifi when screen off or not? does this happen when connected to charger only? actually i never seen my logs, maybe its normal
No nothing special it just happens all the time! Wifi is on all the time, policy is not set to screen off!
I don't know, perhaps I have to live with it !
my point is that if the phone is plugged to power then it doesnt go to deep sleep state anyways, so it doesnt matter, but if it does that ack sending when with screen off and not powered then it might be stopping it from deep sleep, wich is bad for the percentages check with cpu spy if it goes to deep sleep when not connected to power, if yes then something is wrong. Maybe also ask someone who knows your rom, i run stock rooted.
Edit: what about an app thats programmed to update crap very often via wifi only?
So I just bought my first brand new smartphone ever. My last 'smartphone' was pre-Blackberry, pre-iPhone, and bought used.
Now I've got the International variant of the Galaxy Nexus (because AT&T is being a whiny, monopolistic, non-competitive ***** and trying to release a version of it that isn't pentaband-HSPA+).
I'm currently on a phone plan that has *no data*. And that's fine. It saves me money. I may switch later, but until then, I'd like to stick to using Wi-Fi connections.
I'm under the vague understanding that a VPN will further secure my connection if I do use Wi-Fi. The Wi-Fi owner won't see what sites I'm accessing, etc, because all connections will be going directly to my VPN provider (home PC). Everything even might be additionally encrypted.
Is this correct?
Also, I've been trying to set up a VPN service on my Windows 7 machine at home. I've managed to use logcat to determine that *at first* my login name was incorrect. (Apparently the format is actually PCNAME\USERNAME; PASSWORD, rather than just USERNAME; PASSWORD.) Since discovering this, I no longer see MS-CHAP Authentication Failed errors showing up in the log. I've also confirmed that I'm getting through my router's firewall by turning the port off and on on various connection attempts, and when the port is NOT forwarded I get very simple 'Connection Refused' errors in the log.
However, with the port open and the username and password finally correct, I get something approaching the following:
---
Tunnel Established
Session Established
Using PPPoX
Using interface ppp0
Connect: ppp0 <--->
LCP terminated by peer (K|HM-0^@<M-Mt^@^^@^@^@)
Remote server hung up
---
(I can't escape the carets in that line, so each 'superscript' is actually a caret.)
I'm guessing it's the termination line there, but I don't know what it means.
Does anyone have any ideas?
Hi, guys, here's my problem.
My Galaxy S2 using my own WiFi is unable to retrieve some content from web. This content is:
apps icons in Android Market,
Picasa images,
Accuweather forecasts
and some others.
Other devices using the same WiFi has no problems with it. S2 switched to other ISP than my WiFI also has no problems with it.
While trying to narrow possible causes I've picked an example image, which is problematic to my S2+WiFI combination:
https://lh3.ggpht.com/NpoJbnyQbI1kEIlrWhP_t7lj9lN519RkPB3mxQS2z6pTFjh01R3ISeyYnj4AccBSsQ=w788 (an icon of an app from Adroid Maret, remove space from url).
It won't open on my phone using WiFi, so I checked host availability. I've run on my phone following command:
Code:
[email protected]:/ $ ping lh3.ggpht.com
ping: unknown host lh3.ggpht.com
But on my PC using the very same WiFi:
Code:
C:\Users\Grzegorz>ping lh3.ggpht.com
Badanie photos-ugc.l.google.com [173.194.70.132] z 32 bajtami danych:
Odpowiedź z 173.194.70.132: bajtów=32 czas=27ms TTL=47
Odpowiedź z 173.194.70.132: bajtów=32 czas=25ms TTL=47
I'm stuck, what should I do now?
Have you any ad blockers or DNS stuff running ???
jje
Nope, it's clean Android 4.0.3.
Echo request for lh3.ggpht.com on your phone does not work. On your PC you get a response from 173.194.70.132. Just to make sure your problem is related to DNS (and not to some lower service): did you try to ping the IP address 173.194.70.132 from your phone? Do you get a response?
Yes, the host is reachable from phone using IP dot address, only name resolving does not work.
Ok, looks definitely like some DNS problem. As you already confirmed that your hosts file is fine the only thing I can imagine is your phone using some 'wrong' DNS server for address lookup.
To make (almost) sure you use a set of different DNS servers you could disconnect your phone from the wifi and enable a 3G data connection. Make absolutely sure you are not connected to your wifi. Now again run 'ping lh3.ggpht.com'; do you get a response?
Yes, that is the case.
Another weird thing is that phone on 3G resolves lh3.ggpht.com as 173.194.35.139, while PC on WiFi as 209.85.148.132. My 'hosts' file contains only localhost reference.
When I switch to WiFi while pinging that host, pings keep successful, unless I restart terminal session — after that I get 'unknown host' message.
Is there DNS configuration in Android somewhere?
OK, it seems I fixed it.
My WiFi works in a bigger subnet and hides all connected WiFi devices as as single computer.
I've installed on my Phone app called Set DNS from former Android Market, which allowed me to change both primary and secondary DNS. Initally both addresses were pointing to WiFi router itself which seems to work fine for my PC. I've changed it to DNSes of that bigger subnet I'm connected to. And it did the trick. Hopefully it won't mess settings for other WiFis I use to connect.
Thanks for showing me right direction!
I've observed an odd behavior from my V10 (H962). It appears to be attempting to send packets to the IPv4 address 192.190.109.178, with various source addresses (seems 21/8 is most common, but some from 30/8, 33/8 and 100/8 have also shown up).
This is rather odd behavior, normally very few processes would be allowed to send martian packets like that, but they're clearly showing up. If you've got a Linux router, running `sysctl -w net/ipv4/conf/all/log_martians=1` will cause it to log such packets.
Anyone else observed a V10 generating such packets, or am I the whacky one for having network monitoring on my home network that is set to alert me to these?
http://bgp.he.net/net/192.190.109.0/24 perhaps the modem chip manufacturer is taking anonymous data?
Sent from my LG-H962 using Tapatalk