3

I'm having unexpected behavior using the telnet command on various linux (Linux Mint, Ubuntu server).

When trying to connect to a non-existent device, it succeed. I tested with 1.2.3.4 which is not a placeholder.

Telnet

$ telnet 1.2.3.4 9100
Trying 1.2.3.4...
Connected to 1.2.3.4.
Escape character is '^]'.
^]
telnet> Connection closed.

Ping

fails as expected, this is not the problem!

$ ping 1.2.3.4 -c 5
PING 1.2.3.4 (1.2.3.4) 56(84) bytes of data.

--- 1.2.3.4 ping statistics ---
5 packets transmitted, 0 received, 100% packet loss, time 4076ms

Traceroute (update)

$ sudo traceroute -T -p telnet 1.2.3.4
traceroute to 1.2.3.4 (1.2.3.4), 30 hops max, 60 byte packets
 1  1.2.3.4 (1.2.3.4)  2.693 ms  3.166 ms  3.178 ms

Route

$ route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         192.168.2.240   0.0.0.0         UG    600    0        0 wlp4s0
169.254.0.0     0.0.0.0         255.255.0.0     U     1000   0        0 br-427309471a28
172.17.0.0      0.0.0.0         255.255.0.0     U     0      0        0 docker0
172.18.0.0      0.0.0.0         255.255.0.0     U     0      0        0 br-427309471a28
192.168.2.0     0.0.0.0         255.255.255.0   U     600    0        0 wlp4s0

Even when stopping docker I still can reproduce:

$ route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         192.168.2.240   0.0.0.0         UG    600    0        0 wlp4s0
192.168.2.0     0.0.0.0         255.255.255.0   U     600    0        0 wlp4s0

Question

Here is a recording.

Why is telnet connecting on a device that doesn't exist?

7
  • 2
    Please traceroute to the address to try and see if there is a nearby middlebox i.e. a firewall doing something horribly confusing. Something like traceroute -T -p telnet 1.2.3.4, i.e. using the same TCP port as telnet does. (You can also try the mtr version of traceroute, it may return results faster).
    – sourcejedi
    Mar 15, 2017 at 12:43
  • Seems like icmp packets are being dropped. By a firewall rule
    – Katz
    Mar 15, 2017 at 17:48
  • @sourcejedi updated to add traceroute output + recording: asciinema.org/a/e16ndw5jm81yyzfswrieofu83 Mar 15, 2017 at 18:31
  • This indicates the behaviour is coming from your local network. Please post route -n as requested, to confirm that your computers are using the default route to reach 1.2.3.4. If so, hop 1 should represent an IP address which is handled directly on the router. Are the machines you tested on all connected to the same router? What model is the router?
    – sourcejedi
    Mar 16, 2017 at 7:59
  • 1
    Sounds very much like a transparent proxy on your network. Mar 16, 2017 at 10:57

0

You must log in to answer this question.

Browse other questions tagged .