Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    TCP:RA/FA/FPA Flooding logs

    Scheduled Pinned Locked Moved Routing and Multi WAN
    17 Posts 6 Posters 9.0k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • C
      cdlane
      last edited by

      sorry, on the commute home.

      I think I'm reading it right… i.e.

      Nov 16 17:59:05 LAN 192.168.1.111:54254 132.245.226.50:443 TCP:RA

      1 Reply Last reply Reply Quote 0
      • KOMK
        KOM
        last edited by

        Definitely coming from LAN.  It's normal for a source to talk to a destination using a high ephemeral port (>1024).  No idea what's going on without more info, but I would not be alarmed.  Nothing nefarious seems to be happening.

        1 Reply Last reply Reply Quote 0
        • C
          cdlane
          last edited by

          I suppose it's being blocked so if it is nefarious t's doing no harm, but I would still like to understand. What "more info" can I get for you :-)

          1 Reply Last reply Reply Quote 0
          • KOMK
            KOM
            last edited by

            Since the traffic is coming from LAN, it shouldn't be blocked by anything unless you have added some blocking rules on LAN.  I'm positive its out-of-state packets.  Th eonly other thing to do, if you care, is to find out the application that is causing them.  Is the LAN device at .111 a WiFi unit?  They can be really funny when switching between WiFi and 4G, for example.

            1 Reply Last reply Reply Quote 0
            • C
              cdlane
              last edited by

              I block everything in and out, setting only rules to what I want. I have sat and watched (stared at) the logs for a week until I have caught (I think) everything out bound which is legitimate and ignored everything else i.e. port 843 Adobe policy server…not used so let it get blocked.

              I can account for just about everything apart from: -

              i) my DC/DNS/DHCP servers contacting unusual external servers on port 53. I only configure my DNS with 8.8.8.8, 8.8.4.4 as forwarders and allow traffic to same plus *.root-server.net and *.gtld-server.net, but I see (correctly) blocked traffic to 203.119.86.101:53, anysec.apnic.net (plus many others) for instance - still researching

              ii) This TCP/RA etc problem.

              .111 happens to be an iPhone so I can understand why this may happen but a lot of the other IP's are ordinary desktops.

              1 Reply Last reply Reply Quote 0
              • D
                doktornotor Banned
                last edited by

                This out-of-state traffic is absolutely normal with smartphones. (They behave like retards when switching b/w cellular and wifi.)

                1 Reply Last reply Reply Quote 0
                • C
                  cdlane
                  last edited by

                  Hmmm…I'll have to find a way of filtering it out otherwise it makes the logs as good as useless. I need to see out-of-the-ordinary stuff and don't fancy wading through reams of logs during my daily checks. Still doesn't explain why I get so many from ordinary desktops though...

                  1 Reply Last reply Reply Quote 0
                  • H
                    Harvy66
                    last edited by

                    @doktornotor:

                    This out-of-state traffic is absolutely normal with smartphones. (They behave like retards when switching b/w cellular and wifi.)

                    I second this. All of my android devices span the logs with this same crap. I disabled logging on my LAN because of it.

                    1 Reply Last reply Reply Quote 0
                    • KOMK
                      KOM
                      last edited by

                      Still doesn't explain why I get so many from ordinary desktops though…

                      If it's really bothering you, capture some traffic during these events and then look at the traces in Wireshark to see what's going on.

                      1 Reply Last reply Reply Quote 0
                      • kesawiK
                        kesawi
                        last edited by

                        I've also been getting quite a few from the LAN side as well in my logs:

                        block/1000000103	Nov 27 17:27:29	LAN 	Default deny rule IPv4 (1000000103)	10.0.0.161:33200	23.21.79.72:443		TCP:RA
block/1000000103	Nov 27 16:47:11	LAN 	Default deny rule IPv4 (1000000103)	10.0.0.225:63814	103.245.222.133:80	TCP:RA
block/1000000103	Nov 27 16:47:02	LAN 	Default deny rule IPv4 (1000000103)	10.0.0.225:63814	103.245.222.133:80	TCP:FA
block/1000000103	Nov 27 16:46:57	LAN 	Default deny rule IPv4 (1000000103)	10.0.0.225:63814	103.245.222.133:80	TCP:FA
block/1000000103	Nov 27 16:46:55	LAN 	Default deny rule IPv4 (1000000103)	10.0.0.225:63814	103.245.222.133:80	TCP:FA
block/1000000103	Nov 27 16:46:54	LAN 	Default deny rule IPv4 (1000000103)	10.0.0.225:63814	103.245.222.133:80	TCP:FA
block/1000000103	Nov 27 16:46:53	LAN 	Default deny rule IPv4 (1000000103)	10.0.0.225:63814	103.245.222.133:80	TCP:FA
block/1000000103	Nov 27 16:46:53	LAN 	Default deny rule IPv4 (1000000103)	10.0.0.225:63814	103.245.222.133:80	TCP:FA
block/1000000103	Nov 27 16:23:44	LAN 	Default deny rule IPv4 (1000000103)	10.0.0.21:52602		10.0.0.1:3128		TCP:RA
block/1000000103	Nov 27 16:23:43	LAN 	Default deny rule IPv4 (1000000103)	10.0.0.21:52578		10.0.0.1:3128		TCP:RA
block/1000000105	Nov 27 16:23:37	LAN 	Default deny rule IPv6 (1000000105)	[fe80::dddd:bbbb:3333:4444]:34857	[fd30:eeee:6666:9999::1]:3128	TCP:S
block/1000000105	Nov 27 16:23:36	LAN 	Default deny rule IPv6 (1000000105)	[fe80::dddd:bbbb:3333:4444]:34857	[fd30:eeee:6666:9999::1]:3128	TCP:S
block/1000000103	Nov 27 16:23:35	LAN 	Default deny rule IPv4 (1000000103)	10.0.0.21:52168		10.0.0.1:3128		TCP:RA
block/1000000103	Nov 27 16:23:35	LAN 	Default deny rule IPv4 (1000000103)	10.0.0.21:52168		10.0.0.1:3128		TCP:FA
block/1000000103	Nov 27 16:23:35	LAN 	Default deny rule IPv4 (1000000103)	10.0.0.21:52602		10.0.0.1:3128		TCP:FPA
block/1000000103	Nov 27 16:23:34	LAN 	Default deny rule IPv4 (1000000103)	10.0.0.21:52168		10.0.0.1:3128		TCP:A
block/1000000103	Nov 27 16:23:34	LAN 	Default deny rule IPv4 (1000000103)	10.0.0.21:52578		10.0.0.1:3128		TCP:FPA
block/1000000103	Nov 27 16:23:33	LAN 	Default deny rule IPv4 (1000000103)	10.0.0.21:52168		10.0.0.1:3128		TCP:A
block/1000000103	Nov 27 16:23:32	LAN 	Default deny rule IPv4 (1000000103)	10.0.0.21:52168		10.0.0.1:3128		TCP:A
block/1000000103	Nov 27 16:23:31	LAN 	Default deny rule IPv4 (1000000103)	10.0.0.21:52168		10.0.0.1:3128		TCP:A
block/1000000103	Nov 27 16:23:30	LAN 	Default deny rule IPv4 (1000000103)	10.0.0.21:52168		10.0.0.1:3128		TCP:A
block/1000000103	Nov 27 16:23:30	LAN 	Default deny rule IPv4 (1000000103)	10.0.0.21:52168		10.0.0.1:3128		TCP:FA
block/1000000103	Nov 27 16:23:30	LAN 	Default deny rule IPv4 (1000000103)	10.0.0.21:52602		10.0.0.1:3128		TCP:FPA
block/1000000103	Nov 27 16:23:29	LAN 	Default deny rule IPv4 (1000000103)	10.0.0.21:52578		10.0.0.1:3128		TCP:FPA
block/1000000103	Nov 27 16:23:29	LAN 	Default deny rule IPv4 (1000000103)	10.0.0.21:52168		10.0.0.1:3128		TCP:A
block/1000000103	Nov 27 16:23:28	LAN 	Default deny rule IPv4 (1000000103)	10.0.0.21:52168		10.0.0.1:3128		TCP:A
block/1000000103	Nov 27 16:23:27	LAN 	Default deny rule IPv4 (1000000103)	10.0.0.21:52168		10.0.0.1:3128		TCP:FA
block/1000000103	Nov 27 16:23:27	LAN 	Default deny rule IPv4 (1000000103)	10.0.0.21:52602		10.0.0.1:3128		TCP:FPA
block/1000000103	Nov 27 16:23:27	LAN 	Default deny rule IPv4 (1000000103)	10.0.0.21:52168		10.0.0.1:3128		TCP:A
block/1000000103	Nov 27 16:23:27	LAN 	Default deny rule IPv4 (1000000103)	10.0.0.21:52578		10.0.0.1:3128		TCP:FPA
block/1000000105	Nov 27 16:19:50	LAN 	Default deny rule IPv6 (1000000105)	[fe80::dddd:bbbb:3333:4444]:34828	[fd30:eeee:6666:9999::1]:3128	TCP:S
block/1000000105	Nov 27 16:19:35	LAN 	Default deny rule IPv6 (1000000105)	[fe80::dddd:bbbb:3333:4444]:34828	[fd30:eeee:6666:9999::1]:3128	TCP:S
block/1000000105	Nov 27 16:19:26	LAN 	Default deny rule IPv6 (1000000105)	[fe80::dddd:bbbb:3333:4444]:34828	[fd30:eeee:6666:9999::1]:3128	TCP:S
block/1000000105	Nov 27 16:19:22	LAN 	Default deny rule IPv6 (1000000105)	[fe80::dddd:bbbb:3333:4444]:34828	[fd30:eeee:6666:9999::1]:3128	TCP:S
block/1000000105	Nov 27 16:19:20	LAN 	Default deny rule IPv6 (1000000105)	[fe80::dddd:bbbb:3333:4444]:34828	[fd30:eeee:6666:9999::1]:3128	TCP:S
block/1000000105	Nov 27 16:19:19	LAN 	Default deny rule IPv6 (1000000105)	[fe80::dddd:bbbb:3333:4444]:34828	[fd30:eeee:6666:9999::1]:3128	TCP:S
block/1000000105	Nov 27 16:18:50	LAN 	Default deny rule IPv6 (1000000105)	[fe80::dddd:bbbb:3333:4444]:34807	[fd30:eeee:6666:9999::1]:3128	TCP:S
block/1000000105	Nov 27 16:18:34	LAN 	Default deny rule IPv6 (1000000105)	[fe80::dddd:bbbb:3333:4444]:34807	[fd30:eeee:6666:9999::1]:3128	TCP:S
block/1000000105	Nov 27 16:18:25	LAN 	Default deny rule IPv6 (1000000105)	[fe80::dddd:bbbb:3333:4444]:34807	[fd30:eeee:6666:9999::1]:3128	TCP:S
block/1000000105	Nov 27 16:18:21	LAN 	Default deny rule IPv6 (1000000105)	[fe80::dddd:bbbb:3333:4444]:34807	[fd30:eeee:6666:9999::1]:3128	TCP:S
block/1000000105	Nov 27 16:18:19	LAN 	Default deny rule IPv6 (1000000105)	[fe80::dddd:bbbb:3333:4444]:34807	[fd30:eeee:6666:9999::1]:3128	TCP:S
block/1000000105	Nov 27 16:18:18	LAN 	Default deny rule IPv6 (1000000105)	[fe80::dddd:bbbb:3333:4444]:34807	[fd30:eeee:6666:9999::1]:3128	TCP:S
block/1000000105	Nov 27 15:19:28	LAN 	Default deny rule IPv6 (1000000105)	[fe80::dddd:bbbb:3333:4444]:34477	[fd30:eeee:6666:9999::1]:3128	TCP:S
block/1000000105	Nov 27 15:19:24	LAN 	Default deny rule IPv6 (1000000105)	[fe80::dddd:bbbb:3333:4444]:34477	[fd30:eeee:6666:9999::1]:3128	TCP:S
block/1000000105	Nov 27 15:19:22	LAN 	Default deny rule IPv6 (1000000105)	[fe80::dddd:bbbb:3333:4444]:34477	[fd30:eeee:6666:9999::1]:3128	TCP:S
block/1000000105	Nov 27 15:19:21	LAN 	Default deny rule IPv6 (1000000105)	[fe80::dddd:bbbb:3333:4444]:34477	[fd30:eeee:6666:9999::1]:3128	TCP:S
block/1000000105	Nov 27 15:18:51	LAN 	Default deny rule IPv6 (1000000105)	[fe80::dddd:bbbb:3333:4444]:34453	[fd30:eeee:6666:9999::1]:3128	TCP:S
block/1000000105	Nov 27 15:18:35	LAN 	Default deny rule IPv6 (1000000105)	[fe80::dddd:bbbb:3333:4444]:34453	[fd30:eeee:6666:9999::1]:3128	TCP:S
block/1000000105	Nov 27 15:18:27	LAN 	Default deny rule IPv6 (1000000105)	[fe80::dddd:bbbb:3333:4444]:34453	[fd30:eeee:6666:9999::1]:3128	TCP:S
block/1000000105	Nov 27 15:18:23	LAN 	Default deny rule IPv6 (1000000105)	[fe80::dddd:bbbb:3333:4444]:34453	[fd30:eeee:6666:9999::1]:3128	TCP:S
block/1000000105	Nov 27 15:18:21	LAN 	Default deny rule IPv6 (1000000105)	[fe80::dddd:bbbb:3333:4444]:34453	[fd30:eeee:6666:9999::1]:3128	TCP:S
block/1000000105	Nov 27 15:18:20	LAN 	Default deny rule IPv6 (1000000105)	[fe80::dddd:bbbb:3333:4444]:34453	[fd30:eeee:6666:9999::1]:3128	TCP:S
block/1000000103	Nov 27 13:51:28	LAN 	Default deny rule IPv4 (1000000103)	10.0.0.161:33114	23.21.79.72:443		TCP:RA
block/1000000103	Nov 27 11:57:25	LAN 	Default deny rule IPv4 (1000000103)	10.0.0.161:33055	23.21.79.72:443		TCP:RA

                        A lot of the traffic appears to be coming from a Windows 8 laptop (10.0.0.21 & fe80::dddd:bbbb:3333:4444) to the squid3 proxy on my pfSense firewall.

                        Other traffic is from my Sonos system (10.0.0.161) and a Windows Server 2012 R2 VM (10.0.0.225) both of which a set to bypass the proxy.

                        I have the following firewall rules on the LAN interface which should allow this traffic:

                        IPv4 * 	LAN net 	* 	* 	* 	* 	none 	  	Default allow IPv4 LAN to any rule  	
IPv6 * 	LAN net 	* 	* 	* 	* 	none 	  	Default allow LAN IPv6 to any rule 
                        1 Reply Last reply Reply Quote 0
                        • johnpozJ
                          johnpoz LAYER 8 Global Moderator
                          last edited by

                          And what part do you not understand about OUT OF STATE traffic?

                          If you don't want to see it then turn off logging of default rule, create your own block rule that logs but only if SYN if no SYN then doesn't block or log but will fall through to the default and get blocked but not logged.

                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                          If you get confused: Listen to the Music Play
                          Please don't Chat/PM me for help, unless mod related
                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                          1 Reply Last reply Reply Quote 0
                          • First post
                            Last post
                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.