ConoHa事変 その3（2021/10/10）

日が明けましたが、特にサポート窓口からの回答はありません。特に対策もされていないようです。
あれからOpenBSDのarpテーブルもチェックしていたのですが、例の不審なノードがずっとエントリされ続けています。arpスプーフィングに関与する処理の関係でarpキャッシュに登録・更新されるようですが、例のノードがexpire期限MAXの20mからピクリともしません。（他のノードは19m35sのように減っていく）

まさかと思ってarpをtcpdumpでキャプチャーしてみたら、さらに愕然。例のNGノードがものすごい勢いでarp解決要求をしているではありませんか。

11:45:35.065653 arp who-has 192.168.11.143 tell 192.168.10.NG
11:45:35.071090 arp who-has 192.168.10.40 tell 192.168.10.NG
11:45:35.211355 arp who-has 192.168.10.79 tell 192.168.10.NG
11:45:35.291349 arp who-has 192.168.11.130 tell 192.168.10.NG
11:45:35.317422 arp who-has 192.168.10.63 tell 192.168.10.NG
11:45:35.343413 arp who-has 192.168.10.17 tell 192.168.10.NG
11:45:35.343486 arp who-has 192.168.11.68 tell 192.168.10.NG
11:45:35.519375 arp who-has 192.168.11.139 tell 192.168.10.NG
11:45:35.674988 arp who-has 192.168.11.4 tell 192.168.10.NG
11:45:35.827170 arp who-has 192.168.10.42 tell 192.168.10.NG
11:45:35.945968 arp who-has 192.168.11.189 tell 192.168.10.NG
11:45:36.073275 arp who-has 192.168.10.40 tell 192.168.10.NG
11:45:36.293482 arp who-has 192.168.11.130 tell 192.168.10.NG
11:45:36.345550 arp who-has 192.168.11.68 tell 192.168.10.NG
11:45:36.673354 arp who-has 192.168.11.4 tell 192.168.10.NG
11:45:36.767629 arp who-has 192.168.10.37 tell 192.168.10.NG
11:45:36.829674 arp who-has 192.168.10.42 tell 192.168.10.NG
11:45:36.904370 arp who-has 192.168.10.11 tell 192.168.10.NG
11:45:36.947479 arp who-has 192.168.11.189 tell 192.168.10.NG
11:45:37.075382 arp who-has 192.168.10.40 tell 192.168.10.NG
11:45:37.295357 arp who-has 192.168.11.130 tell 192.168.10.NG
11:45:37.409821 arp who-has 192.168.11.154 tell 192.168.10.NG
11:45:37.675464 arp who-has 192.168.11.4 tell 192.168.10.NG
11:45:37.769429 arp who-has 192.168.10.37 tell 192.168.10.NG
11:45:37.811238 arp who-has 192.168.11.158 tell 192.168.10.NG
11:45:37.832530 arp who-has 192.168.10.42 tell 192.168.10.NG
11:45:37.899239 arp who-has 192.168.11.169 tell 192.168.10.NG
11:45:37.905320 arp who-has 192.168.10.11 tell 192.168.10.NG
11:45:37.947784 arp who-has 192.168.11.139 tell 192.168.10.NG
11:45:37.949427 arp who-has 192.168.11.189 tell 192.168.10.NG
11:45:37.967070 arp who-has 192.168.11.104 tell 192.168.10.NG
11:45:38.133821 arp who-has 192.168.11.207 tell 192.168.10.NG
11:45:38.185216 arp who-has 192.168.10.201 tell 192.168.10.NG
11:45:38.394103 arp who-has 192.168.11.143 tell 192.168.10.NG
11:45:38.411375 arp who-has 192.168.11.154 tell 192.168.10.NG
11:45:38.471231 arp who-has 192.168.11.163 tell 192.168.10.NG
11:45:38.771430 arp who-has 192.168.10.37 tell 192.168.10.NG
11:45:38.813372 arp who-has 192.168.11.158 tell 192.168.10.NG
11:45:38.901384 arp who-has 192.168.11.169 tell 192.168.10.NG
11:45:38.907474 arp who-has 192.168.10.11 tell 192.168.10.NG
11:45:38.949436 arp who-has 192.168.11.139 tell 192.168.10.NG
11:45:38.969476 arp who-has 192.168.11.104 tell 192.168.10.NG
11:45:39.135290 arp who-has 192.168.11.207 tell 192.168.10.NG
11:45:39.185348 arp who-has 192.168.10.201 tell 192.168.10.NG
11:45:39.188572 arp who-has 192.168.10.79 tell 192.168.10.NG
11:45:39.208985 arp who-has 192.168.10.7 tell 192.168.10.NG
11:45:39.323667 arp who-has 192.168.11.10 tell 192.168.10.NG
11:45:39.395289 arp who-has 192.168.11.143 tell 192.168.10.NG
11:45:39.413292 arp who-has 192.168.11.154 tell 192.168.10.NG
11:45:39.473392 arp who-has 192.168.11.163 tell 192.168.10.NG
11:45:39.639904 arp who-has 192.168.10.82 tell 192.168.10.NG
11:45:39.690973 arp who-has 192.168.10.104 tell 192.168.10.NG
11:45:39.815516 arp who-has 192.168.11.158 tell 192.168.10.NG
11:45:39.903631 arp who-has 192.168.11.169 tell 192.168.10.NG
11:45:39.945685 arp who-has 192.168.10.135 tell 192.168.10.NG
11:45:39.951509 arp who-has 192.168.11.139 tell 192.168.10.NG
11:45:39.971336 arp who-has 192.168.11.104 tell 192.168.10.NG
11:45:40.137426 arp who-has 192.168.11.207 tell 192.168.10.NG
11:45:40.187404 arp who-has 192.168.10.201 tell 192.168.10.NG
11:45:40.189350 arp who-has 192.168.10.79 tell 192.168.10.NG
11:45:40.209450 arp who-has 192.168.10.7 tell 192.168.10.NG
11:45:40.325393 arp who-has 192.168.11.10 tell 192.168.10.NG
11:45:40.397355 arp who-has 192.168.11.143 tell 192.168.10.NG
11:45:40.475406 arp who-has 192.168.11.163 tell 192.168.10.NG
11:45:40.641370 arp who-has 192.168.10.82 tell 192.168.10.NG
11:45:40.693271 arp who-has 192.168.10.104 tell 192.168.10.NG
11:45:40.837139 arp who-has 192.168.10.87 tell 192.168.10.NG
11:45:40.895048 arp who-has 192.168.11.146 tell 192.168.10.NG
11:45:40.947382 arp who-has 192.168.10.135 tell 192.168.10.NG
11:45:41.118551 arp who-has 192.168.11.139 tell 192.168.10.NG
11:45:41.191354 arp who-has 192.168.10.79 tell 192.168.10.NG
11:45:41.211352 arp who-has 192.168.10.7 tell 192.168.10.NG
11:45:41.328005 arp who-has 192.168.11.10 tell 192.168.10.NG
11:45:41.643453 arp who-has 192.168.10.82 tell 192.168.10.NG
11:45:41.695420 arp who-has 192.168.10.104 tell 192.168.10.NG
11:45:41.837417 arp who-has 192.168.10.87 tell 192.168.10.NG
11:45:41.897403 arp who-has 192.168.11.146 tell 192.168.10.NG
11:45:41.928330 arp who-has 192.168.11.98 tell 192.168.10.NG
11:45:41.949341 arp who-has 192.168.10.135 tell 192.168.10.NG
11:45:42.121358 arp who-has 192.168.11.139 tell 192.168.10.NG
11:45:42.135620 arp who-has 192.168.10.201 tell 192.168.10.NG
11:45:42.328318 arp who-has 192.168.11.194 tell 192.168.10.NG
11:45:42.839377 arp who-has 192.168.10.87 tell 192.168.10.NG
11:45:42.899469 arp who-has 192.168.11.146 tell 192.168.10.NG
11:45:42.929439 arp who-has 192.168.11.98 tell 192.168.10.NG
11:45:43.123396 arp who-has 192.168.11.139 tell 192.168.10.NG
11:45:43.137419 arp who-has 192.168.10.201 tell 192.168.10.NG
11:45:43.329414 arp who-has 192.168.11.194 tell 192.168.10.NG
11:45:43.931473 arp who-has 192.168.11.98 tell 192.168.10.NG
11:45:44.139427 arp who-has 192.168.10.201 tell 192.168.10.NG
11:45:44.331400 arp who-has 192.168.11.194 tell 192.168.10.NG
11:45:44.641186 arp who-has 192.168.10.7 tell 192.168.10.NG
11:45:45.120768 arp who-has 192.168.10.79 tell 192.168.10.NG
11:45:45.353762 arp who-has 192.168.10.226 tell 192.168.10.NG
11:45:45.595204 arp who-has 192.168.10.37 tell 192.168.10.NG
11:45:45.641412 arp who-has 192.168.10.7 tell 192.168.10.NG
11:45:45.904634 arp who-has 192.168.11.142 tell 192.168.10.NG
11:45:46.038754 arp who-has 192.168.11.159 tell 192.168.10.NG
11:45:46.121291 arp who-has 192.168.10.79 tell 192.168.10.NG
11:45:46.155036 arp who-has 192.168.11.139 tell 192.168.10.NG
11:45:46.232495 arp who-has 192.168.11.71 tell 192.168.10.NG
11:45:46.355412 arp who-has 192.168.10.226 tell 192.168.10.NG
11:45:46.484745 arp who-has 192.168.10.82 tell 192.168.10.NG
11:45:46.501675 arp who-has 192.168.11.116 tell 192.168.10.NG
11:45:46.597376 arp who-has 192.168.10.37 tell 192.168.10.NG
11:45:46.643497 arp who-has 192.168.10.7 tell 192.168.10.NG
11:45:46.686895 arp who-has 192.168.11.11 tell 192.168.10.NG
11:45:46.807001 arp who-has 192.168.11.143 tell 192.168.10.NG
11:45:46.880435 arp who-has 192.168.10.201 tell 192.168.10.NG
11:45:46.904610 arp who-has 192.168.10.11 tell 192.168.10.NG
11:45:46.905330 arp who-has 192.168.11.142 tell 192.168.10.NG
11:45:46.974927 arp who-has 192.168.10.171 tell 192.168.10.NG
11:45:47.041392 arp who-has 192.168.11.159 tell 192.168.10.NG
11:45:47.073387 arp who-has 192.168.11.5 tell 192.168.10.NG
11:45:47.123432 arp who-has 192.168.10.79 tell 192.168.10.NG
11:45:47.157584 arp who-has 192.168.11.139 tell 192.168.10.NG
11:45:47.230973 arp who-has 192.168.11.154 tell 192.168.10.NG
11:45:47.233551 arp who-has 192.168.11.71 tell 192.168.10.NG
11:45:47.245727 arp who-has 192.168.11.230 tell 192.168.10.NG
11:45:47.349977 arp who-has 192.168.11.63 tell 192.168.10.NG
11:45:47.357348 arp who-has 192.168.10.226 tell 192.168.10.NG
11:45:47.485395 arp who-has 192.168.10.82 tell 192.168.10.NG
11:45:47.503549 arp who-has 192.168.11.116 tell 192.168.10.NG
11:45:47.599349 arp who-has 192.168.10.37 tell 192.168.10.NG
11:45:47.689336 arp who-has 192.168.11.11 tell 192.168.10.NG
11:45:47.710574 arp who-has 192.168.11.99 tell 192.168.10.NG
11:45:47.809315 arp who-has 192.168.11.143 tell 192.168.10.NG
11:45:47.881497 arp who-has 192.168.10.201 tell 192.168.10.NG
11:45:47.905384 arp who-has 192.168.10.11 tell 192.168.10.NG
11:45:47.907314 arp who-has 192.168.11.142 tell 192.168.10.NG
11:45:47.907315 arp who-has 192.168.11.169 tell 192.168.10.NG
11:45:47.977342 arp who-has 192.168.10.171 tell 192.168.10.NG
11:45:48.025151 arp who-has 192.168.11.4 tell 192.168.10.NG
11:45:48.043339 arp who-has 192.168.11.159 tell 192.168.10.NG
11:45:48.073357 arp who-has 192.168.11.5 tell 192.168.10.NG
11:45:48.159312 arp who-has 192.168.11.139 tell 192.168.10.NG
11:45:48.176023 arp who-has 192.168.10.42 tell 192.168.10.NG
11:45:48.211728 arp who-has 192.168.10.87 tell 192.168.10.NG
11:45:48.233346 arp who-has 192.168.11.154 tell 192.168.10.NG
11:45:48.235631 arp who-has 192.168.11.71 tell 192.168.10.NG
11:45:48.247429 arp who-has 192.168.11.230 tell 192.168.10.NG
11:45:48.351308 arp who-has 192.168.11.63 tell 192.168.10.NG
11:45:48.487422 arp who-has 192.168.10.82 tell 192.168.10.NG
11:45:48.488666 arp who-has 192.168.10.135 tell 192.168.10.NG
11:45:48.505329 arp who-has 192.168.11.116 tell 192.168.10.NG
11:45:48.691385 arp who-has 192.168.11.11 tell 192.168.10.NG
11:45:48.711352 arp who-has 192.168.11.99 tell 192.168.10.NG
11:45:48.744164 arp who-has 192.168.11.189 tell 192.168.10.NG
11:45:48.801855 arp who-has 192.168.11.68 tell 192.168.10.NG
11:45:48.811507 arp who-has 192.168.11.143 tell 192.168.10.NG
11:45:48.883362 arp who-has 192.168.10.201 tell 192.168.10.NG
11:45:48.907545 arp who-has 192.168.10.11 tell 192.168.10.NG
11:45:48.909351 arp who-has 192.168.11.169 tell 192.168.10.NG
11:45:48.979440 arp who-has 192.168.10.171 tell 192.168.10.NG
11:45:49.025346 arp who-has 192.168.11.4 tell 192.168.10.NG
11:45:49.075316 arp who-has 192.168.11.5 tell 192.168.10.NG
11:45:49.163868 arp who-has 192.168.11.139 tell 192.168.10.NG
11:45:49.177372 arp who-has 192.168.10.42 tell 192.168.10.NG
11:45:49.213402 arp who-has 192.168.10.87 tell 192.168.10.NG
11:45:49.235447 arp who-has 192.168.11.154 tell 192.168.10.NG
11:45:49.245477 arp who-has 192.168.11.45 tell 192.168.10.NG
11:45:49.249417 arp who-has 192.168.11.230 tell 192.168.10.NG
11:45:49.250544 arp who-has 192.168.10.28 tell 192.168.10.NG
11:45:49.327903 arp who-has 192.168.10.196 tell 192.168.10.NG
11:45:49.353389 arp who-has 192.168.11.63 tell 192.168.10.NG
11:45:49.434210 arp who-has 192.168.11.158 tell 192.168.10.NG
11:45:49.452714 arp who-has 192.168.10.127 tell 192.168.10.NG
11:45:49.489522 arp who-has 192.168.10.135 tell 192.168.10.NG
11:45:49.713373 arp who-has 192.168.11.99 tell 192.168.10.NG
11:45:49.745344 arp who-has 192.168.11.189 tell 192.168.10.NG
11:45:49.803415 arp who-has 192.168.11.68 tell 192.168.10.NG
11:45:49.853559 arp who-has 192.168.10.60 tell 192.168.10.NG
11:45:49.911428 arp who-has 192.168.11.169 tell 192.168.10.NG
11:45:49.922511 arp who-has 192.168.10.201 tell 192.168.10.NG
11:45:50.027405 arp who-has 192.168.11.4 tell 192.168.10.NG
11:45:50.033135 arp who-has 192.168.10.58 tell 192.168.10.NG
11:45:50.165427 arp who-has 192.168.11.139 tell 192.168.10.NG
11:45:50.179400 arp who-has 192.168.10.42 tell 192.168.10.NG
11:45:50.215427 arp who-has 192.168.10.87 tell 192.168.10.NG
11:45:50.237637 arp who-has 192.168.10.6 tell 192.168.10.NG
11:45:50.240565 arp who-has 192.168.11.209 tell 192.168.10.NG
11:45:50.245412 arp who-has 192.168.11.45 tell 192.168.10.NG
11:45:50.253325 arp who-has 192.168.10.28 tell 192.168.10.NG
11:45:50.329441 arp who-has 192.168.10.196 tell 192.168.10.NG
11:45:50.435349 arp who-has 192.168.11.158 tell 192.168.10.NG
11:45:50.453355 arp who-has 192.168.10.127 tell 192.168.10.NG
11:45:50.491372 arp who-has 192.168.10.135 tell 192.168.10.NG
11:45:50.747474 arp who-has 192.168.11.189 tell 192.168.10.NG
11:45:50.795637 arp who-has 192.168.10.63 tell 192.168.10.NG
11:45:50.805383 arp who-has 192.168.11.68 tell 192.168.10.NG
11:45:50.853438 arp who-has 192.168.10.60 tell 192.168.10.NG
11:45:50.874183 arp who-has 192.168.10.40 tell 192.168.10.NG
11:45:50.925411 arp who-has 192.168.10.201 tell 192.168.10.NG
11:45:51.033663 arp who-has 192.168.10.58 tell 192.168.10.NG
11:45:51.167382 arp who-has 192.168.11.139 tell 192.168.10.NG
11:45:51.239368 arp who-has 192.168.10.6 tell 192.168.10.NG
11:45:51.241395 arp who-has 192.168.11.209 tell 192.168.10.NG
11:45:51.247365 arp who-has 192.168.11.45 tell 192.168.10.NG
11:45:51.255423 arp who-has 192.168.10.28 tell 192.168.10.NG
11:45:51.331376 arp who-has 192.168.10.196 tell 192.168.10.NG
11:45:51.335699 arp who-has 192.168.11.35 tell 192.168.10.NG
11:45:51.437466 arp who-has 192.168.11.158 tell 192.168.10.NG
11:45:51.455626 arp who-has 192.168.10.127 tell 192.168.10.NG
11:45:51.524309 arp who-has 192.168.10.82 tell 192.168.10.NG
11:45:51.656073 arp who-has 192.168.11.143 tell 192.168.10.NG
11:45:51.797390 arp who-has 192.168.10.63 tell 192.168.10.NG
11:45:51.855420 arp who-has 192.168.10.60 tell 192.168.10.NG
11:45:51.875479 arp who-has 192.168.10.40 tell 192.168.10.NG
11:45:51.927372 arp who-has 192.168.10.201 tell 192.168.10.NG
11:45:52.035976 arp who-has 192.168.10.58 tell 192.168.10.NG
11:45:52.241427 arp who-has 192.168.10.6 tell 192.168.10.NG
11:45:52.244431 arp who-has 192.168.11.209 tell 192.168.10.NG
11:45:52.337380 arp who-has 192.168.11.35 tell 192.168.10.NG
11:45:52.375848 arp who-has 192.168.11.104 tell 192.168.10.NG
11:45:52.525310 arp who-has 192.168.10.82 tell 192.168.10.NG
11:45:52.657349 arp who-has 192.168.11.143 tell 192.168.10.NG
11:45:52.666610 arp who-has 192.168.11.237 tell 192.168.10.NG
11:45:52.799318 arp who-has 192.168.10.63 tell 192.168.10.NG
11:45:52.877377 arp who-has 192.168.10.40 tell 192.168.10.NG
11:45:52.902561 arp who-has 192.168.10.233 tell 192.168.10.NG
11:45:53.175155 arp who-has 192.168.11.139 tell 192.168.10.NG
11:45:53.330722 arp who-has 192.168.10.6 tell 192.168.10.NG
11:45:53.339428 arp who-has 192.168.11.35 tell 192.168.10.NG
11:45:53.377373 arp who-has 192.168.11.104 tell 192.168.10.NG
11:45:53.527404 arp who-has 192.168.10.82 tell 192.168.10.NG
11:45:53.556875 arp who-has 192.168.10.58 tell 192.168.10.NG
11:45:53.574757 arp who-has 192.168.11.142 tell 192.168.10.NG
11:45:53.659466 arp who-has 192.168.11.143 tell 192.168.10.NG
11:45:53.669319 arp who-has 192.168.11.237 tell 192.168.10.NG
11:45:53.903376 arp who-has 192.168.10.233 tell 192.168.10.NG
11:45:53.961369 arp who-has 192.168.11.154 tell 192.168.10.NG
11:45:54.177347 arp who-has 192.168.11.139 tell 192.168.10.NG
11:45:54.184023 arp who-has 192.168.10.79 tell 192.168.10.NG
11:45:54.262654 arp who-has 192.168.10.232 tell 192.168.10.NG
11:45:54.333431 arp who-has 192.168.10.6 tell 192.168.10.NG
11:45:54.379489 arp who-has 192.168.11.104 tell 192.168.10.NG
11:45:54.517740 arp who-has 192.168.10.31 tell 192.168.10.NG
11:45:54.550625 arp who-has 192.168.11.4 tell 192.168.10.NG
11:45:54.557423 arp who-has 192.168.10.58 tell 192.168.10.NG
11:45:54.577394 arp who-has 192.168.11.142 tell 192.168.10.NG
11:45:54.671599 arp who-has 192.168.11.237 tell 192.168.10.NG
11:45:54.767411 arp who-has 192.168.10.201 tell 192.168.10.NG
11:45:54.905412 arp who-has 192.168.10.233 tell 192.168.10.NG
11:45:54.961375 arp who-has 192.168.11.154 tell 192.168.10.NG
11:45:55.179432 arp who-has 192.168.11.139 tell 192.168.10.NG
11:45:55.186729 arp who-has 192.168.10.79 tell 192.168.10.NG
11:45:55.265479 arp who-has 192.168.10.232 tell 192.168.10.NG
11:45:55.336230 arp who-has 192.168.10.6 tell 192.168.10.NG
11:45:55.381952 arp who-has 192.168.11.98 tell 192.168.10.NG
11:45:55.519436 arp who-has 192.168.10.31 tell 192.168.10.NG
11:45:55.551381 arp who-has 192.168.11.4 tell 192.168.10.NG
11:45:55.559435 arp who-has 192.168.10.58 tell 192.168.10.NG
11:45:55.581374 arp who-has 192.168.11.142 tell 192.168.10.NG
11:45:55.653643 arp who-has 192.168.10.116 tell 192.168.10.NG
11:45:55.769347 arp who-has 192.168.10.201 tell 192.168.10.NG
11:45:55.963384 arp who-has 192.168.11.154 tell 192.168.10.NG

これは仮に悪意がなくともやばい領域なので、サポート窓口に2回目の通報を決行。1回目の通報に対応してくれている気配もなかったので、今回は強めの口調です。

これでも対応してくれないようだったら、ConoHaやめて他に移った方が良さそうですね。


その4へ続く。

タグ：conoha