Jami sending DNS requests to 58.249.126.8 in China?

Hi!

I’ve observed some strange behaviour and I’d like to understand this a little better.

Jami is sending malformed DNS requests to 58.249.126.8

inetnum: 58.249.0.0 - 58.249.127.255
netname: GuangZhou-unicom
descr: United-Communications-Network-Technology-Co-Ltd, GuangZhou
country: CN

The requests looks like this:

1 12:00:55.099048962 10.0.0.1 → 58.249.126.8 DNS 123 Unknown operation (12) 0x85a1[Malformed Packet]
2 12:00:55.419708993 58.249.126.8 → 10.0.0.1 DNS 349 Unknown operation (14) 0x84a1 Unknown (57636) [Malformed Packet]
3 12:01:05.029569645 10.0.0.1 → 58.249.126.8 DNS 123 Unknown operation (12) 0x85a1[Malformed Packet]
4 12:01:05.029587512 10.0.0.1 → 58.249.126.8 DNS 123 Unknown operation (12) 0x85a1[Malformed Packet]
5 12:01:05.306361767 58.249.126.8 → 10.0.0.1 DNS 349 Unknown operation (14) 0x84a1 Unknown (31057) [Malformed Packet]
6 12:01:06.147904164 10.0.0.1 → 58.249.126.8 DNS 123 Unknown operation (12) 0x85a1[Malformed Packet]
7 12:01:06.435244069 58.249.126.8 → 10.0.0.1 DNS 349 Unknown operation (14) 0x84a1 Unknown (57636) [Malformed Packet]

Anyone know what’s happening here?

Jami is on Rocky 9
jami-20250430.0-1.el9.x86_64

Regards,

P.

Hmm, what is your default DNS server address?

I can confirm that this IP doesn’t appear in my /etc/resolv.conf as a nameserver. All other applications use the NS hosts which are listed there. Only Jami is connecting to this IP address which I have not heard of before.

:rofl:It may be an OpenDHT node which listens on port 53. You can capture some packets and try deserializing them with a MessagePack library.

1 Like

Caveat: I’m not a developer :grinning_face:

I have done a dump of the packets but it isn’t plain text. The only recognisable strings I can see are:

  • target
  • q.find.t
  • token

Does this sound typical of a OpenDHT packet?

Thanks.

1 Like

Probably, I also found them in parsed_message.h of OpenDHT (Jami used this library).

Do you mind parsing those packets with the demo page of msgpack-lite ?

1 Like

If it’s a dht node then don’t worry too much about it

2 Likes

Good call on parsed_message.h . That’s convincing evidence for the DHT case. However I was unable to get the packets to deserialise using the msgpack demo. This implies one of two things:

  1. They’re not OpenDHT packets
  2. I didn’t do it right!

Mmmm.. :thinking: