topic Able to see other peoples traffic on Comcast in General Topics

Able to see other peoples traffic on Comcast

JasonPeterson — Tue, 03 Aug 2021 22:07:54 GMT

Is there anyone else that has Comcast Fiber circuits that is able to see other people's traffic on the public interface?

We have been POC'ing the DNS Security License on several FW's once we turned it on we are seeing a large amount of DNS Tunneling alerts coming into XDR. When we investigate they are coming from the Untrust network on the default intrazone rule.

After looking further into this it is on our sites that have Comcast Fiber circuits. When we look at our intrazone traffic from Untrust, we are seeing traffic that is either src or dst from another Comcast network that is not on our segment. When we filter down by interface this is only occurring on the comcast interface. We have multiple circuits at our sites and all the other circuits are showing the expected behavior where the Untrust intrazone traffic only has our IP's in the src/dst.

Re: Able to see other peoples traffic on Comcast

OtakarKlier — Tue, 03 Aug 2021 17:13:45 GMT

Hello,

That is normal when on a common subnet. Its just traffic that the PAN see's as it hits its interface.

Regards,

Re: Able to see other peoples traffic on Comcast

Remo — Tue, 03 Aug 2021 20:53:53 GMT

@OtakarKlier

Really? Seeing such traffic from other customers is normal? I mean the IPs in the screenshot are not only one small subnet. It also does not look like broadcast traffic for tcp syn packets where arp entries timed out and the firewall was even seeing app-id's and not only 'incomplete'.

Re: Able to see other peoples traffic on Comcast

jdelio — Tue, 03 Aug 2021 21:57:40 GMT

It is interesting to see the Untrust to Untrust with all of that traffic.

This is not the dropped traffic, which would probably be more. But it is hard to say why you are seeing that traffic.. again due to routing.. you are seeing traffic pass thru your Untrust interface.

Is that normal? hard to say.. It all really depends.. but it sounds like dynamic routes are not as clean as they need to be.

If you traceroute to those destination IP's, I wonder where they go.