strange connection tries on 127.0.1.1

[Barbie]

In the dedicated Barbies Monsterhunt Tank Server a lot of strange connection tries are reported in the log, here some examples:

Code: Select all

NotifyAcceptingConnection: Server MyLevel accept
Open MyLevel Thu Dec  8 13:09:01 2022 127.0.1.1:58930
NotifyAcceptingConnection: Server MyLevel accept
Open MyLevel Thu Dec  8 13:10:01 2022 127.0.1.1:60256
Connection timed out after 120.000000 seconds (120.043953)
Close TcpipConnection7235 Thu Dec  8 13:10:55 2022
NotifyAcceptingConnection: Server MyLevel accept
Open MyLevel Thu Dec  8 13:11:01 2022 127.0.1.1:37330
Connection timed out after 120.000000 seconds (120.044418)
Close TcpipConnection7236 Thu Dec  8 13:11:01 2022
Connection timed out after 120.000000 seconds (120.014687)
Close TcpipConnection7237 Thu Dec  8 13:12:01 2022
NotifyAcceptingConnection: Server MyLevel accept
Open MyLevel Thu Dec  8 13:12:01 2022 127.0.1.1:52090
Connection timed out after 120.000000 seconds (120.044189)
Close TcpipConnection7238 Thu Dec  8 13:13:01 2022
NotifyAcceptingConnection: Server MyLevel accept
Open MyLevel Thu Dec  8 13:13:01 2022 127.0.1.1:51037
NotifyAcceptingConnection: Server MyLevel accept
Open MyLevel Thu Dec  8 13:14:01 2022 127.0.1.1:53110
Connection timed out after 120.000000 seconds (120.006798)
Close TcpipConnection7239 Thu Dec  8 13:14:01 2022
NotifyAcceptingConnection: Server MyLevel accept
Open MyLevel Thu Dec  8 13:15:01 2022 127.0.1.1:52679
Connection timed out after 120.000000 seconds (120.009308)
Close TcpipConnection7240 Thu Dec  8 13:15:02 2022
Connection timed out after 120.000000 seconds (120.016296)
Close TcpipConnection7241 Thu Dec  8 13:16:01 2022
NotifyAcceptingConnection: Server MyLevel accept
Open MyLevel Thu Dec  8 13:16:01 2022 127.0.1.1:59793
NotifyAcceptingConnection: Server MyLevel accept
Open MyLevel Thu Dec  8 13:17:01 2022 127.0.1.1:47261
Connection timed out after 120.000000 seconds (120.038239)

The IP address is always 127.0.1.1, but the port addresses look random.
Any hint what this can be?

[esnesi]

Interesting.
Something with a loopback.. https://www.lookip.net/ip/127.0.1.1
127.0.0.1 should be localhost as you probably know.

Not sure if this helps you further, but might may ring a bell.
Maybe a pihole/adblock configuration on a linux machine which queries locally and back, creating a loop ?
Just naming a random homebrew situation.

Loops usually arn't good in the network area.. atleast a loopback on a network switch isn't a good thing.
Always funny when this happened at several IT servicedesks with workplace management.
Not funny on the management side ofcourse.. seeing as all internal IP addresses will be taken, so none will be available to handle out to new clients.
(Nowadays mostly solved through ACL)