Inquiry About Tailscale netcheck Traffic to Reserved IP 203.0.113.1:12345 #15639

IamTaoChen · 2024-11-24T20:09:55Z

IamTaoChen
Nov 24, 2024

Hi,

While monitoring network traffic in a Coder workspace, I noticed UDP packets being sent to the reserved IP 203.0.113.1 on port 12345. The packet content references Tailscale’s netcheck functionality, specifically this link:

https://github.com/tailscale/tailscale/issues/188

Could you clarify the purpose of this traffic and whether it is necessary? Since 203.0.113.1 is a reserved IP, it seems unusual to use it in this context.

how to get

sudo tcpdump -i any udp and host 203.0.113.1 and port 12345 -vv -X

output

default:~$ sudo tcpdump -i any udp and host 203.0.113.1 and port 12345 -vv -X
tcpdump: listening on any, link-type LINUX_SLL (Linux cooked v1), capture size 262144 bytes
20:04:17.757510 IP (tos 0x0, ttl 64, id 13931, offset 0, flags [DF], proto UDP (17), length 101)
    Google.54424 > 203.0.113.1.12345: [bad udp cksum 0xe878 -> 0x3b39!] UDP, length 73
	0x0000:  4500 0065 366b 4000 4011 1c07 ac11 0003  E..e6k@.@.......
	0x0010:  cb00 7101 d498 3039 0051 e878 7461 696c  ..q...09.Q.xtail
	0x0020:  7363 616c 6520 6e65 7463 6865 636b 3b20  scale.netcheck;.
	0x0030:  7365 6520 6874 7470 733a 2f2f 6769 7468  see.https://gith
	0x0040:  7562 2e63 6f6d 2f74 6169 6c73 6361 6c65  ub.com/tailscale
	0x0050:  2f74 6169 6c73 6361 6c65 2f69 7373 7565  /tailscale/issue
	0x0060:  732f 3138 38                             s/188

Answered by ethanndickson

Nov 25, 2024

For reference, Coder depends on Tailscale's Go code for it's networking layer.

It looks like Tailscale uses this IP to handle a quirk with Apple's Airport Extreme

	// At least the Apple Airport Extreme doesn't allow hairpin
	// sends from a private socket until it's seen traffic from
	// that src IP:port to something else out on the internet.
	//
	// See https://github.com/tailscale/tailscale/issues/188#issuecomment-600728643
	//
	// And it seems that even sending to a likely-filtered RFC 5737
	// documentation-only IPv4 range is enough to set up the mapping.
	// So do that for now. In the future we might want to classify networks
	// that do and don't require this separately. But for now…

View full answer

ethanndickson · 2024-11-25T06:37:04Z

ethanndickson
Nov 25, 2024
Collaborator

For reference, Coder depends on Tailscale's Go code for it's networking layer.

It looks like Tailscale uses this IP to handle a quirk with Apple's Airport Extreme

	// At least the Apple Airport Extreme doesn't allow hairpin
	// sends from a private socket until it's seen traffic from
	// that src IP:port to something else out on the internet.
	//
	// See https://github.com/tailscale/tailscale/issues/188#issuecomment-600728643
	//
	// And it seems that even sending to a likely-filtered RFC 5737
	// documentation-only IPv4 range is enough to set up the mapping.
	// So do that for now. 
8000
In the future we might want to classify networks
	// that do and don't require this separately. But for now help it.
	const documentationIP = "203.0.113.1"
	rs.pc4Hair.WriteToUDPAddrPort(
		[]byte("tailscale netcheck; see https://github.com/tailscale/tailscale/issues/188"),
		netip.AddrPortFrom(netip.MustParseAddr(documentationIP), 12345))

Given this IP is globally reserved for documentation purposes, I assume it can be safely ignored.

You can read more about NAT traversal and hairpinning from Tailscale here:
https://tailscale.com/blog/how-nat-traversal-works
And then in the context of Coder:
https://coder.com/docs/admin/networking/stun

0 replies

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Inquiry About Tailscale netcheck Traffic to Reserved IP 203.0.113.1:12345 #15639

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Replies: 1 comment

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Select a reply

Uh oh!

Inquiry About Tailscale netcheck Traffic to Reserved IP 203.0.113.1:12345 #15639

Uh oh!

Uh oh!

IamTaoChen Nov 24, 2024

how to get

Replies: 1 comment

Uh oh!

Uh oh!

ethanndickson Nov 25, 2024 Collaborator

IamTaoChen
Nov 24, 2024

ethanndickson
Nov 25, 2024
Collaborator