Possible corruption in the Allstar node lookup directory

[WD5M]

I’ve found an odd set of entries in the Allstar node lookup directory. The only reason I noticed, is that I help run a small 44-net VPN service for hams in Texas. Most are using Allstar. While reviewing VPN logs and joining with IP addresses in the Allstar node directory, I noticed one of the VPN clients IP address was listed as the registered IP address for three Allstar nodes. While multiple nodes behind one IP is not unusual, two of the nodes were out of state. In fact, one is in Canada. Those two nodes are not actually connected to our VPN system, however the Allstar node lookup directory says they are registered with the same VPN IP address.

This was occurring around Tue Sep 30 18:18:20 CDT 2025, in case the Allstar directory changes.

Node 630270 is the node that should be listed under our VPN IP address. The other two, nodes 526551 and 571572 should NOT be associated with our VPN IP address.

I ran a few queries using asl-node-lookup and the results are pasted below. I’m guessing these nodes are connected to the same large network, like the east coast reflector, and perhaps the large number of nodes has found a bug in the directory somewhere. I thought I’d report this here in case someone wants to look into it.

asl-node-lookup 526551

SRV (_iax._udp.526551.nodes.allstarlink.org)
10 10 4588 526551.nodes.allstarlink.org.

A (526551.nodes.allstarlink.org)
44.76.21.183

TXT (526551.nodes.allstarlink.org)
NN=526551
RT=2025-09-30 23:09:02
RB=0
IP=44.76.21.183
PIP=0
PT=4588
RH=aws-east1a-register1

RPT LOOKUP (526551)
radio@44.76.21.183:4588/526551,44.76.21.183
radio@44.76.21.183:4588/526551,44.76.21.183
radio@44.76.21.183:4588/526551,44.76.21.183
radio@44.76.21.183:4588/526551,44.76.21.183
radio@44.76.21.183:4588/526551,44.76.21.183
radio@44.76.21.183:4588/526551,44.76.21.183
radio@44.76.21.183:4588/526551,44.76.21.183
radio@44.76.21.183:4588/526551,44.76.21.183
radio@44.76.21.183:4588/526551,44.76.21.183
radio@44.76.21.183:4588/526551,44.76.21.183
radio@44.76.21.183:4588/526551,44.76.21.183
radio@44.76.21.183:4588/526551,44.76.21.183
radio@44.76.21.183:4588/526551,44.76.21.183
radio@44.76.21.183:4588/526551,44.76.21.183
radio@44.76.21.183:4588/526551,44.76.21.183
radio@44.76.21.183:4588/526551,44.76.21.183
radio@44.76.21.183:4588/526551,44.76.21.183
radio@44.76.21.183:4588/526551,44.76.21.183

asl-node-lookup 571572

SRV (_iax._udp.571572.nodes.allstarlink.org)
10 10 4571 571572.nodes.allstarlink.org.

A (571572.nodes.allstarlink.org)
44.76.21.183

TXT (571572.nodes.allstarlink.org)
NN=571572
RT=2025-09-30 23:14:24
RB=0
IP=44.76.21.183
PIP=0
PT=4571
RH=aws-east1a-register1

RPT LOOKUP (571572)
radio@44.76.21.183:4571/571572,44.76.21.183
radio@44.76.21.183:4571/571572,44.76.21.183
radio@44.76.21.183:4571/571572,44.76.21.183
radio@44.76.21.183:4571/571572,44.76.21.183
radio@44.76.21.183:4571/571572,44.76.21.183
radio@44.76.21.183:4571/571572,44.76.21.183
radio@44.76.21.183:4571/571572,44.76.21.183
radio@44.76.21.183:4571/571572,44.76.21.183
radio@44.76.21.183:4571/571572,44.76.21.183
radio@44.76.21.183:4571/571572,44.76.21.183
radio@44.76.21.183:4571/571572,44.76.21.183
radio@44.76.21.183:4571/571572,44.76.21.183
radio@44.76.21.183:4571/571572,44.76.21.183
radio@44.76.21.183:4571/571572,44.76.21.183
radio@44.76.21.183:4571/571572,44.76.21.183
radio@44.76.21.183:4571/571572,44.76.21.183
radio@44.76.21.183:4571/571572,44.76.21.183
radio@44.76.21.183:4571/571572,44.76.21.183

asl-node-lookup 630270

SRV (_iax._udp.630270.nodes.allstarlink.org)
10 10 4569 630270.nodes.allstarlink.org.

A (630270.nodes.allstarlink.org)
44.76.21.183

TXT (630270.nodes.allstarlink.org)
NN=630270
RT=2025-09-30 23:14:23
RB=0
IP=44.76.21.183
PIP=0
PT=4569
RH=aws-east1a-register0

RPT LOOKUP (630270)
radio@44.76.21.183:4569/630270,44.76.21.183
radio@44.76.21.183:4569/630270,44.76.21.183
radio@44.76.21.183:4569/630270,44.76.21.183
radio@44.76.21.183:4569/630270,44.76.21.183
radio@44.76.21.183:4569/630270,44.76.21.183
radio@44.76.21.183:4569/630270,44.76.21.183
radio@44.76.21.183:4569/630270,44.76.21.183
radio@44.76.21.183:4569/630270,44.76.21.183
radio@44.76.21.183:4569/630270,44.76.21.183
radio@44.76.21.183:4569/630270,44.76.21.183
radio@44.76.21.183:4569/630270,44.76.21.183
radio@44.76.21.183:4569/630270,44.76.21.183
radio@44.76.21.183:4569/630270,44.76.21.183
radio@44.76.21.183:4569/630270,44.76.21.183
radio@44.76.21.183:4569/630270,44.76.21.183
radio@44.76.21.183:4569/630270,44.76.21.183
radio@44.76.21.183:4569/630270,44.76.21.183
radio@44.76.21.183:4569/630270,44.76.21.183

David, WD5M

[N8PC]

@WD5M

630270

According to Allstar Link the 2 nodes are at the following addresses

526551 VE7IOX
DELL 3040 RADIOLESS Pitt Meadows, BC
Method: DNS Actual: DNS Data: radio@72.200.80.210:4588/526551

571572 NR9V
AllScan.info San Diego, CA
Method: DNS Actual: DNS Data: radio@44.76.21.183:4571/571572

You might get a hold of NR9V DAVID GLEASON and ask him about it. Sounds like you have an issue with 44 net not Allstar link.

[N8EI]

Currently the ASL Registration Database is seeing two hosts registering from 44.72.21.183: 571572 and 630270. Node 526551 changed IPs earlier today (16:41Z) and we don't record IP address history.

However, there's nothing amiss from this that I can see. We only register the IP address the node sends, those IPs are active, and haven't recently changed. There's no technical reason this wouldn't work. I'm not sure I understand your concern?

[WD5M]

My concern was that the ASL node lookup database was returning the wrong IP address (44.72.21.183), for a period of time, on nodes 571572 and 526551. Those nodes do not have access to our VPN server, or that IP address. Only node 630270 (KD5COD) has the Wireguard VPN configuration and keys to use that VPN IP address. Only his node was connected to our VPN, to use that IP address. Wireguard does not support multiple simultaneous connections from the same client configuration and keys.

I have no explanation how the other nodes appeared in the ASL node lookup with the same IP address. This may be a rare issue, I’m sure there are higher priority issues with ASL.

David, WD5M

[N8EI]

Looking at the logs, 571572 was registering from 44.72.721.183 up until 2025-10-01 12:33:38 UTC. It was, most definitely, originating from that IP address. Coincidentally, 630270 went offline at precisely the same time. So most likely 670270 either has a configuration for 571572 on it or the underlying host of 670270 is routing/NATing traffic from elsewhere.

[WD5M]

Your post caused me to reach out to some folks who helped the 630270 node owner set up the VPN client for his system. Seems that node was built by a 3rd party, and somehow other node registrations were left in the ASL conf files when it was shipped. Those lines have now been removed, and ASL restarted. Neither the node owner or the VPN setup helpers knew this before tonight. The 3rd party node builder should be notified of this build error soon.

Thanks for helping me figure this out. Sometimes mistakes are made, with the best of intensions.

73,
David, WD5M