Strange Traffic from Pfsense LOCAL to 31.203.7.115:22 ( SUSPICIOUS ) ?
-
Hi,
I have found a lot of requests going from PfSense ITSELF ( WAN ) to this IP "31.203.7.115" on Port 22.
Has someone an idea about the reason ?
Regards,
Michel -
@startrekfr said in Strange Traffic from Pfsense local to 31.203.7.115:22 ?:
31.203.7.115
What is 192.168.22.100 on your network? Is this truly your firwall?
-
Yes, the origin is clearly my firewall : 192.168.22.100 is the IP of the WAN Interface of Pfsense.
I have found it out, due to the analyse of my traffic in "ntopng", where it fills up pages
-
Hi,
I have found myself the beginning of a response :
I have managed out, that it's related with the package NTOPNG and the DNS-Server that is used in it :
when I change the DNS -Option from
to
the messages about a misbehaviour disappear.
The strange thing is that pfSense is configured to use localhost as DNS-Server and that unbound is configured on pfSense itself.
I will put a new post about the problem in the category traffic of the forum.
Regards,
Michel -
This post is deleted!
