5 ms·

So interestingly, it looks like Unifi did classify the traffic as wifi calling, but it was doing a lot of traffic in the middle of the night when I was asleep.

So interestingly, it looks like Unifi did classify the traffic as wifi calling, but it was doing a lot of traffic in the middle of the night when I was asleep. And the biggest question mark in my head is: how is this traffic looking like it's coming from my desktop?

wasipwned 4y ago
And by looking it's coming from my desktop, I mean the tcpdump was run directly on my desktop and I saw the traffic there. So I assume it had to be routed through my desktop unless I am missing something.
- Kikawala 4y ago
  You can run the below command to see which process or PID is talking over ipsec-nat-t sudo lsof -n -i :4500
- FollowingTheDao 4y ago
  You are missing something. You are seeing BGP routing table updates on your network from an AT&T router. You have BGP running on your network somewhere.
- wasipwned 4y ago
  I had run lsof on my desktop and I did not see any of the IP addresses in question. I did not check specifically for port 4500 though.
- valleyer 4y ago
  That's often true, but not always. For example, if your desktop is connected to an Ethernet hub, you would usually expect to see all traffic from any machine on the hub. (Ethernet switches are a different story.) Wi-Fi can work the same way, though it sometimes requires an extra step to place your machine's network card into "promiscuous mode" in order to see traffic neither to or from your machine.
veonik 4y ago
WiFi calling is multicast, I think, so your phone just basically broadcasts it to the network and every device will see it, though only your router will actually do anything with it. There's examples of WiFi calling causing this type of issue, described as a packet storm. For example, here's a reddit post with similar symptoms you're describing. https://www.reddit.com/r/networking/comments/3g31mc/iphone_wifi_calling_causes_broadcastmulitcast/ https://www.reddit.com/r/networking/comments/3g31mc/iphone_w...
- wasipwned 4y ago
  This actually makes the most sense so far. I hadn't even considered the possibility of multicast. Let me see if I can dig in further.

wasipwned 4y ago

And by looking it's coming from my desktop, I mean the tcpdump was run directly on my desktop and I saw the traffic there. So I assume it had to be routed through my desktop unless I am missing something.

Kikawala 4y ago
You can run the below command to see which process or PID is talking over ipsec-nat-t sudo lsof -n -i :4500
FollowingTheDao 4y ago
You are missing something. You are seeing BGP routing table updates on your network from an AT&T router. You have BGP running on your network somewhere.
wasipwned 4y ago
I had run lsof on my desktop and I did not see any of the IP addresses in question. I did not check specifically for port 4500 though.
valleyer 4y ago
That's often true, but not always. For example, if your desktop is connected to an Ethernet hub, you would usually expect to see all traffic from any machine on the hub. (Ethernet switches are a different story.) Wi-Fi can work the same way, though it sometimes requires an extra step to place your machine's network card into "promiscuous mode" in order to see traffic neither to or from your machine.

veonik 4y ago

WiFi calling is multicast, I think, so your phone just basically broadcasts it to the network and every device will see it, though only your router will actually do anything with it. There's examples of WiFi calling causing this type of issue, described as a packet storm. For example, here's a reddit post with similar symptoms you're describing. https://www.reddit.com/r/networking/comments/3g31mc/iphone_wifi_calling_causes_broadcastmulitcast/ https://www.reddit.com/r/networking/comments/3g31mc/iphone_w...

wasipwned 4y ago
This actually makes the most sense so far. I hadn't even considered the possibility of multicast. Let me see if I can dig in further.