Tracking down a MAC and IP address, originating from Hassio?

Configuration
1

Newbie here: I have an external IP address pinging my mosquitto broker integrated with Home Assistant in a Raspberry PI.

When I check the origin, it points toward ‘hassio’ but the MAC address is not recognised anywhere. What can I do next to identify and remedy the constant pinging of my mosquitto broker?

hassio
hassio1150×88 21.1 KB

2

172.30 is within the 172.16.x.x/16 private address space (meaning it’s internal) its probably the vlan used for your container installation between your various containers or addons. Look there

3

Are you using HAOS? You can type

ip addr|less

and get all of your addresses. The mac address is probably something made up by docker.

EDIT In fact it is the same as mine :slight_smile:

➜  ~ arp 172.30.32.2
Address                  HWtype  HWaddress           Flags Mask            Iface
hassio                   ether   02:42:ac:1e:20:02   C                     hassio
1 Like
4

It kinda has to keep in touch with the broker :slight_smile:

1 Like
5

I get spammed by that ip, but look at the bottom, that ip is not on my lan, and the port is not open to the internet.

Screenshot_20220913-224723
Screenshot_20220913-2247232400×1080 270 KB

6

That last ip address is certainly not from your LAN

nick@media:~$ nslookup 64.225.14.92
Server:         127.0.0.1
Address:        127.0.0.1#53

Non-authoritative answer:
92.14.225.64.in-addr.arpa       name = monitoring.internet-measurement.com.
1 Like
7

Agreed. Whatever it is, it’s also managed to get it’s IP logged on a couple honeypot sites… Which means…

…if that is not your intended routing, you need to verify your router’s port forwarding and UPnP settings to see about any holes punched in sending 1883 inbound to your HA box.

Something allowed that blank user login attempt in.

8

Back to the internal address, you can find out for sure which container it comes from with docker network

➜  ~ docker network ls
NETWORK ID     NAME      DRIVER    SCOPE
a200b79c6ace   bridge    bridge    local
363cd2cd3d39   hassio    bridge    local
d7db0cca0ad2   host      host      local
295c24907a73   none      null      local

OK so I have 4 networks, lets start by looking at the most obvious suspect

docker network inspect hassio

oops that’s a bit long, lets try

➜  ~ docker network inspect hassio|grep 172.30.32.2 -B4 -A1
            "b91a231485ed5b3511a3f8feb3fff44b4f778073065fa6da8db0b0e68ad3676e": {
                "Name": "hassio_supervisor",
                "EndpointID": "873893c0d8670d76052f7d5d8d6cab942206fb9b59c549d9784e36f542c801b9",
                "MacAddress": "02:42:ac:1e:20:02",
                "IPv4Address": "172.30.32.2/23",
                "IPv6Address": ""

As can be seen, that address is from the supervisor container :slight_smile: (on my system anyway.)

9

Thank you all for the troubleshooting. Here is a lengthier explanation that hassio pings the mosquitto broker. @frenck spells out “That is the supervisor checking if the add-on is still responding as part of a health check. This is expected, not a bug and actually good.”

10

I would still be very worried about the connection from 64.225.14.92

PS if you want to pm me your external ip address I will check it for you. You need to trust me though (needless to say).

2 Likes
11

I’ll vouch for Nickrout, his intentions are good 🥹

3 Likes
12

Something is very wrong with my iptables.

Screenshot_20220914-072711
Screenshot_20220914-0727111080×2400 300 KB

Thanks for the offer.

13

No problem, and thanks for introducing me to that nice tool :slight_smile:

Look out for upnp on you router/modem/whatever. Although most people think of upnp as a media technology, the protocol extends to allowing, on request, ports to be opened to the outside on a router. Maybe this happened here. @NathanCu mentioned this in post 7, but I thought it needed a little explanation. See (for example) here What is UPnP and why is it Dangerous?

14

no, it’s not UPnP, it’s worse than that: Help with iptables - HA hosted on baremetal Debian 11 homebrew router -- exposed ports

Thanks again.