I have been getting weird network issues on my ADSL router the last few days, seemingly getting flooded.
My ISP-assigned IP is 105.x.x.x.
I have noted the following entries in ip_conntrack:
tcp 6 359405 ESTABLISHED src=10.196.65.25 dst=173.194.70.188 sport=36444 dport=5228 [UNREPLIED] src=173.194.70.188 dst=10.196.65.25 sport=5228 dport=36444 use=2
tcp 6 426547 ESTABLISHED src=197.71.78.221 dst=74.125.233.87 sport=33318 dport=443 [UNREPLIED] src=74.125.233.87 dst=197.71.78.221 sport=443 dport=33318 use=2
tcp 6 362658 ESTABLISHED src=41.5.152.197 dst=69.171.245.49 sport=58660 dport=443 [UNREPLIED] src=69.171.245.49 dst=41.5.152.197 sport=443 dport=58660 use=2
The destinations seems to point to Google and Facebook, and the sources are unreachable from me.
Why would this appear on my router?
Why would a private network IP appear there? (My local network is 192.168.1.0/24). Also a trace to 197.71.78.221 shows it going over some routers in the 10.0.0.0/8 range.
Is this due to wrongly configured routers on my ISP and/or their backbone?
Sorry if these questions are stupid :)
(I have forwarded the info to my ISP, but still awaiting a response).