wasipwned

Not to my knowledge, but I will double checking to make sure. The odd part is the issue only started recently, but I haven't made any major changes to my network recently.

I can't explain this part yet. I was asleep when this happened, so I wasn't even using my phone. I may be wrong about 300Mbps being to the AT&T. public IP, as my router shows a much lower rate. That might have just been the total traffic I was seeing internally on my private network from multicast.

I can't fully explain this part yet, but I am currently expecting that I will see the issue again even with my desktop disconnected.

I am also probably wrong about it being 300Mbps to AT&T. It was probably 300Mbps of multicast traffic internally.

Out of curiosity, how do you know it's CGNAT? Is it just because all of AT&T's mobile traffic is through CGNAT?

False alarm. Really appreciate everyone helping me sanity check this. The randomized MAC is part of iOS' Wi-Fi privacy, and my phone is using Wi-Fi calling for AT&T. The randomized MAC and the fact that I thought I saw the traffic originating from my desktop (it wasn't, it was just multicast traffic) really threw me off.

Thanks for reminding me of this. This is looking less and less malicious at this point as `10.0.0.3` is my phone (using AT&T, which is where all the traffic was destined).

Yeah, I'm now realizing that this might be multicast traffic I'm seeing from another device, and I do use AT&T which is making me think this may not actually be malicious.

Circling back, this discussion thread seems to be the most likely culprit. In my panicked state, I didn't even consider multicast traffic being the reason why I saw this traffic in tcpdump. I'm digging into this a bit more. I probably wasn't pwned, but I am still currently operating as if I were. I appreciate everyone's response here.

Unfortunately, I did not save any packet captures, so I only saw that it was on the IPsec port.

This actually makes the most sense so far. I hadn't even considered the possibility of multicast. Let me see if I can dig in further.

Yeah, that was exactly what I was thinking as well. I do use KVM to run a few VMs, but they were the only VMs I could find, and they were both stopped the whole time.

I had run lsof on my desktop and I did not see any of the IP addresses in question. I did not check specifically for port 4500 though.

I'm using a UDM Pro, and I had just recently patched. The only container running on the router is unifi-os itself. I keep repeating myself because I want to make sure I can't be missing something, but tcpdump on my desktop is showing the traffic which is why I'm assuming that it's my desktop that is compromised.