Strange Local DNS issues involving Comcast, not Comcast user

Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Broadcom SoC based Hardware
Author Message
hendrik.witbooi
DD-WRT Novice


Joined: 24 Sep 2013
Posts: 26

PostPosted: Sun Aug 17, 2014 19:45    Post subject: Strange Local DNS issues involving Comcast, not Comcast user Reply with quote
Hi,

I've recently re-flashed my router as chronicled in this thread.

http://www.dd-wrt.com/phpBB2/viewtopic.php?p=906211

Got everything back working as they should be, then I notice this;

I have a network with 3 desktops (2 x Win7 x64, 1 x Win7 x32) connected via ethernet and 1 laptop (Win7 x64) connected most of the time via wireless, along with 3 x Wireless IP Cameras using a Linksys WRT54GS.

I have a desktop statistics program running and noticed very high volume download traffic on one PC (Over .5GB before the computer finished booting, and it's not that slow! and it just continues).

I opened the resource monitor via task manager to see who was hogging the bandwidth and saw it was the "System" process, not too helpful.

But in the connections field I noticed a bunch of connections;

c-XX-XX-XX-XX.hsd1.in.comcast.net - Where XX's are Octets of the IP addresses of my locally connected PC's.

(I am not a Comcast customer. I am in Europe, Ireland specifically, we don't even have Comcast here. I have never installed ANY of their software etc...)

However, after finding that I could view the IP cameras on the network using this Comcast alter-ego, I knew it must be a router problem.

I found;

tvnserver - TightVNC's Server process.
Acronis Sync Manager - I disabled this service.
And the System Process. And a few others...

All referring to other systems on the network in this manner.

The IP addresses and Hostnames work as they should, but I can also pull up my webserver locally via this alter-ego. I can also ping them and it resolves with the actual IP.

So on my local network I can use, IP, Hostname, or Comcast alter-ego...

Any idea why my computers are referring to themselves in this manner??
Sponsor
ddaniel51
DD-WRT User


Joined: 19 Feb 2013
Posts: 128

PostPosted: Sun Aug 17, 2014 21:12    Post subject: Reply with quote
Sounds like your system has been hijacked via Malware or virus.

Good luck
hendrik.witbooi
DD-WRT Novice


Joined: 24 Sep 2013
Posts: 26

PostPosted: Sun Aug 17, 2014 21:29    Post subject: Reply with quote
ddaniel51 wrote:
Sounds like your system has been hijacked via Malware or virus.

Good luck


Which system? All of them?

What about the IP Cameras?

The large amount of data transfer was just what caused me to discover this issue, it isn't something I'm overly concerned with, there are lots of things that could cause the traffic.

These DNS issues (more like anomalies) have just sprung up since switching firmware/configuring new firmware.

Also the anomalous DNS entries/hostnames are all internal. I've checked from a remote network and all are unreachable, so it is just internal traffic (given an odd name).

Have also scanned each system with MalwareBytes and Avast! 2 days ago as part of my weekly scan to keep out the nasties. Nothing flagged except my own nasties Smile
hendrik.witbooi
DD-WRT Novice


Joined: 24 Sep 2013
Posts: 26

PostPosted: Sun Aug 17, 2014 22:04    Post subject: Reply with quote
Thanks for your response, but I don't think malware etc is to blame here;

1. I just borrowed a friends laptop, connected it to my network for the first time, same issue.

2. If every device on my network is discoverable/pingable etc from every other device on the network by taking it's IP Address from the format XX.XX.XX.XX and transposing it into c-XX-XX-XX-XX.hsd1.in.comcast.net

That seems like a router/DNS issue to me.

The problem can be seen on any system on the network.

Update: Just had to print something, printer has a static lease. Just after I clicked print I could see the Epson program connect to the Wireless Printer using this format. Was printing from a different PC so it's safe to say it is definitely a Router issue
Display posts from previous:    Page 1 of 1
Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Broadcom SoC based Hardware All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum