3

I got some IPs like 192.168.0.* or 192.168.7.* accessing my website.

I host it in Rackspace.

How is that possible? IP spoofing? any clue?

Thanks!

1
  • 2
    Are you logging the X-Forwarded-For header?
    – 3molo
    Apr 18, 2011 at 9:34

4 Answers 4

3

Not sure about Rackspace but some hosting providers provide servers with 2 network cards, one public facing but also an internal one that is on their own internal network that they use for administering the system.

Would seem odd to see web traffic from that IP though if it were an internal network - unless they are monitoring for vulnerabilities or something similar?

If you run ipconfig (windows) or ifconfig (Linux) you will be able to see the list of network cards and their IP addresses and subnets which might give a clue

1

Do you offer internal IPs?

Yes. Each server comes with an internal IP address that is used to communicate between servers. The traffic that flows over this interface (eth1) on your server is unmetered and is not billed. This network is also referred to as ServiceNet. ServiceNet is an internal only, multi-tenant network connection within each Rackspace datacenter. ServiceNet IPs are not accessible from the public Internet and are local per datacenter.

(From Cloud Servers: FAQs | Knowledge Center | Rackspace Hosting)

It is possible that someone running a network scanner and/or a crawler that operates inside rackspace's network.

You can configure your server to listen only on addresses you need. This is usually called "bind address". Apache bind directive - for example.

Listening to all interfaces isn't insecure by itself, but can be dangerous since some web apps handle local network connections idfferently.


Please note that this only applies to "real" source ip address.

as @3molo noted in comments, X-Forwarded-For header can be easily spoofed to any value.

1
  • Didn't noticed that question was asked 3 years ago
    – Sanya_Zol
    Jan 27, 2015 at 7:59
0

Yes, it's either spoofed IPs or internal machines talking to you most likely.

Can you firewall them ?

0

Why you think this is unusual?

Lets ignore packets poofing for a moment - this wuold be a reson for me to change the hoster (the hoster is supposed to block internal IP addresses on it's external gateways). And also ignore internal packet spoofing - too unlikely.

Why you assume Rackspace does NOT use internal IP addresses for systems that are not supposed to be public? Like admin systems. For example one monitoring every web server responds properly ;)

This is most likely what happens here. You get a request either from within Rackspace (i.e. they also have people therek, and I guess those people also surf sometimes, could be totally valid) or within the rackspace infrastructure (automated system testing the server works and returns a valid return value according to TCP - top notch service if you ask me).

I would try getting the host name for that IP address within their network. Could be a clue what happens. Otherise a suppor ticket will help you find out what is hitting you there. It is their system, they will know.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .