Jami sending DNS requests to 58.249.126.8 in China?

Hi!

I’ve observed some strange behaviour and I’d like to understand this a little better.

Jami is sending malformed DNS requests to 58.249.126.8

inetnum: 58.249.0.0 - 58.249.127.255
netname: GuangZhou-unicom
descr: United-Communications-Network-Technology-Co-Ltd, GuangZhou
country: CN

The requests looks like this:

1 12:00:55.099048962 10.0.0.1 → 58.249.126.8 DNS 123 Unknown operation (12) 0x85a1[Malformed Packet]
2 12:00:55.419708993 58.249.126.8 → 10.0.0.1 DNS 349 Unknown operation (14) 0x84a1 Unknown (57636) [Malformed Packet]
3 12:01:05.029569645 10.0.0.1 → 58.249.126.8 DNS 123 Unknown operation (12) 0x85a1[Malformed Packet]
4 12:01:05.029587512 10.0.0.1 → 58.249.126.8 DNS 123 Unknown operation (12) 0x85a1[Malformed Packet]
5 12:01:05.306361767 58.249.126.8 → 10.0.0.1 DNS 349 Unknown operation (14) 0x84a1 Unknown (31057) [Malformed Packet]
6 12:01:06.147904164 10.0.0.1 → 58.249.126.8 DNS 123 Unknown operation (12) 0x85a1[Malformed Packet]
7 12:01:06.435244069 58.249.126.8 → 10.0.0.1 DNS 349 Unknown operation (14) 0x84a1 Unknown (57636) [Malformed Packet]

Anyone know what’s happening here?

Jami is on Rocky 9
jami-20250430.0-1.el9.x86_64

Regards,

P.

Hmm, what is your default DNS server address?

I can confirm that this IP doesn’t appear in my /etc/resolv.conf as a nameserver. All other applications use the NS hosts which are listed there. Only Jami is connecting to this IP address which I have not heard of before.

:rofl:It may be an OpenDHT node which listens on port 53. You can capture some packets and try deserializing them with a MessagePack library.

1 Like

Caveat: I’m not a developer :grinning_face:

I have done a dump of the packets but it isn’t plain text. The only recognisable strings I can see are:

  • target
  • q.find.t
  • token

Does this sound typical of a OpenDHT packet?

Thanks.

1 Like

Probably, I also found them in parsed_message.h of OpenDHT (Jami used this library).

Do you mind parsing those packets with the demo page of msgpack-lite ?

1 Like

If it’s a dht node then don’t worry too much about it

2 Likes

Good call on parsed_message.h . That’s convincing evidence for the DHT case. However I was unable to get the packets to deserialise using the msgpack demo. This implies one of two things:

  1. They’re not OpenDHT packets
  2. I didn’t do it right!

Mmmm.. :thinking:

My bad. :man_facepalming: I forgot to mention the demo isn’t friendly on decoding, it requires that you insert a space between bytes.


Sorry. :folded_hands:

Now I’m getting somewhere. The request (not reply) from my machine running Jami looks like this:

{
“a”: {
“id”: {
“type”: “Buffer”,
“data”: [
239,
… etc
“target”: {
“type”: “Buffer”,
“data”: [
187,
etc…
},
“q”: “find”,
“t”: 1234567890,
“y”: “q”,
“v”: “o2”
}

and something else that might be significant, the requests take place exactly every 10 minutes.

Is this OpenDHT?

Thanks.

Yes, and it’s a request to find node.

Thanks Rubus. Good to have that confirmation. I can rest easy now!

Thanks again for your help.