I know enough about computer networking to be dangerous, without actually being a real expert. For example, I know that IP v4 addresses that start with 10 are for internal use only and that no IP address on the public Internet will ever start with 10.

Knowing this, I set up an outbound firewall rule in my router (a Pepwave Surf SOHO) that both blocks and logs any attempt to communicate with a 10.something IP address. Do real experts do this? Dunno.

There are two other groups of IP v4 addresses that are reserved for internal use only and my router blocks and logs those too. This results in more logging than I care to research. I make a note of these oddball communication attempts and mentally file them away.

Back in October I blogged about Private IP addresses on the Public Internet which described one such incident. In that case, a Windows 7 computer was using UDP (as opposed to TCP) to phone home to port 55523. The computer had an internal IP address of 10.1.2.3 and it repeatedly tried to contact both 10.8.0.11 and 192.168.0.4. That blog also showed the firewall rules that are configured in my router.

The reason for this blog, is that the culprit this time was my own iPad, running the latest and greatest edition of iOS version 13.5.1.

As you can see below, in a span of 14 seconds, it made 25 attempts to contact IP address 10.0.0.146. On my LAN, the iPad was in an isolated VLAN and its IP address was 10.2.2.110. All the devices in its VLAN have an IP address that starts with 10.2.2.

There is no reason for it to communicate with any device whose IP address starts with 10.0.0. This was not a subnet used by any other VLAN on my LAN and, even if it was, the VLAN with the iPad does not allow inter-VLAN communication. Heck, it does not even allow devices in the VLAN to see each other.

Just like the Windows 7 computer I wrote about last time, my iPad used UDP to contact a very high numbered port, in this case 51625. Ports in this range have no pre-defined usage. The source port was always 62010. For real network experts, below are some other attributes of the outbound connection attempts.

LEN=140 TOS=0x00 PREC=0x00 TTL=63 LEN=120 MARK=0x2

Apple publishes information about the ports their software uses: TCP and UDP ports used by Apple software products and About macOS, iOS, and iTunes server host connections and iTunes background processes. Nothing there about port 51625.

So, what the heck is going on?

I can't tell if the source of the network connection is an app or the operating system itself. My router can function as a network sniffer and it can generate pcap files to feed into Wireshark. Still, I don't think this can identify if the bits came from the OS or an app.

Even then, are these outgoing transmissions on purpose or is it a bug? Dunno.