ABE HTTP source IP

Discussions about the Application Boundaries Enforcer (ABE) module
Jasin Natael
Posts: 2
Joined: Sat Apr 19, 2014 6:43 pm

ABE HTTP source IP

Post by Jasin Natael » Sat Apr 19, 2014 6:50 pm

I recently discovered that public IP of my router had visited my web site. Investigating it lead me to ABE.

After reading about it I understand what is going on. There is still one thing I don't get.

Why source of ABE's HTTP packets is my routers public IP?
Since my router and computer are both behind same NAT and Noscipt/ABE runs on my browser shouldn't the source IP be local address of my PC?

GET / HTTP/1.1
Host: 84.251.x.x
User-Agent: Mozilla/5.0 (ABE, http://noscript.net/abe/wan)
...
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko

User avatar
Giorgio Maone
Site Admin
Posts: 8790
Joined: Wed Mar 18, 2009 11:22 pm
Location: Palermo - Italy
Contact:

Re: ABE HTTP source IP

Post by Giorgio Maone » Sat Apr 19, 2014 7:23 pm

Jasin Natael wrote:Why source of ABE's HTTP packets is my routers public IP?
Since my router and computer are both behind same NAT and Noscipt/ABE runs on my browser shouldn't the source IP be local address of my PC?

In facts, the log you provide as evidence doesn't even remotely suggest the source IP is your router's public one, but just that the HTTP resource being requested is the root of the website responding to your router's public IP, if any: if the request is successful, that's proof that the bug whic ABE's "WAN feature" is intended to work-around does affect your router, i.e. its administration interface is reachable on its public IP:
GET / HTTP/1.1
Host: 84.251.x.x
User-Agent: Mozilla/5.0 (ABE, http://noscript.net/abe/wan)
...
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:28.0) Gecko/20100101 Firefox/28.0

Jasin Natael
Posts: 2
Joined: Sat Apr 19, 2014 6:43 pm

Re: ABE HTTP source IP

Post by Jasin Natael » Sat Apr 19, 2014 8:59 pm

Quote on my first post just showed what made me look up ABE.

Source IP of that package as shown by Wireshark:
2836 4995.879226 Source: 84.251.x.x Destinaton:192.168.112.100 HTTP 220 GET / HTTP/1.1


84.251.x.x is the public address of my router.

So I'm still confused as to how the source IP can be my public, when the package comes from private network?
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:28.0) Gecko/20100101 Firefox/28.0

Post Reply