Ask / Submit
4

echo (port 7) to 192.168.1.1

asked 2014-02-11 11:00:02 +0200

cy8aer gravatar image

updated 2014-02-11 11:01:54 +0200

On my monthly ntop analysing I found my Jolla device talk echo (tcp port 7) to 192.168.1.1 (which does not exist in my net). Which job does this and is it necessary?

edit retag flag offensive close delete

Comments

1

Hi, to my knowledge 192.168.1.1 is the default address of your router in your network. (192.168..1.1 or 192.168.0.1 or 192.168.1.254 are all default router addresses). If you open your web browser on your PC and type in 192.168.1.1 you should be taken to your routers homepage/login/admin page. Sounds like your phone has detected or got connected to the router and pinged it for some info or ID, example;

> echo Hello world
Hello world

I would say it's a standard/routine when your phone is part of, or detects a local network. Sounds normal to me, perhaps someone with more network knowledge can chime in? :) Regards,

Edz ( 2014-02-11 13:40:00 +0200 )edit

Could this come from an Android app? Who is using "echo"? Haven't heard of this before. For connectivity tests ICMP echo requests are commonly used (ping). I did not know that port 7 is reserved for this ominous echo service. Very old and outdated, I guess. Curious to know what's behind this!

Stefanix ( 2014-02-11 13:58:12 +0200 )edit

As I said: I do not have a 192,168.1.0/24 there is some job which does this by default. And yes - it uses port 7 (as described as echo in /etc/services). The few android applications I use have well defined network definitions. I will watch this behavior for the next days

cy8aer ( 2014-02-11 15:05:04 +0200 )edit

This: http://192-168-1-1.net/ tells us that it is standard router (admin) address that something in your network is ping'ing (port7). Are you sure the packets are coming from your phone?

foss4ever ( 2014-02-11 16:10:05 +0200 )edit

What you are talking about is echo-request (ICMP 8). I am talking about tcp 7 (which describes some tcp service called echo in /etc/services). I have a flow tracker running on my gateway. 192.168.1.1 is not known in my network (192.168.x!=1.0/24) so it is routed to my default gateway. Then the flow tracker catches the packet and sends it to my ntop server. It's apples and pears... And (of course) ICMP is flow less so cannot be tracked by a flow tracker.

cy8aer ( 2014-02-11 23:22:37 +0200 )edit

1 Answer

Sort by » oldest newest most voted
2

answered 2015-09-04 21:05:49 +0200

Okw gravatar image

The echo protocol (RFC862) is used for measuring roundtrip times and stuff alike. Traditionally inetd has been responsible for implementing echo functionality, but iirc sfos doesn't have inetd. Anyhow, the protocol itself is quite obsolete and has been superseded by icmp echo.

edit flag offensive delete publish link more
Login/Signup to Answer

Question tools

Follow
4 followers

Stats

Asked: 2014-02-11 11:00:02 +0200

Seen: 1,473 times

Last updated: Nov 25 '16