Strange log entries?

antonius_block · May 7, 2006, 5:58 PM

Hi there,

Firstoff, wow, what a great piece of software. It provides most of the functionality the SonicWall enhanced OS does at work. I am running pfsense beta2 on a wrap board. This may be a silly question, but I am seeing blocked log entries that I don't quite understand:


Time  	         If        Source  	Destination  	Proto
May 7 12:43:09 	WAN 	212.84.104.189 	24.42.205.1 	ICMP
May 7 13:40:29 	WAN  	24.53.129.153  	192.168.1.123  	ICMP

The destination addresses do not exist on my network. Can anyone explain to a self-taught semi-newb?

Thanks much.

hoba · May 7, 2006, 6:24 PM

Looks like this traffic is send to you by your ISP. Maybe something's wrong at their end. Or maybe you have more public IPs than you know of? ;)

sullrich · May 7, 2006, 6:42 PM

Cable modem by chance?

antonius_block · May 7, 2006, 8:17 PM

Thanks for the replies. I guess it could be from the ISP, I don't really understand why though. I do know that I only have one public IP (dhcp from comcast :-). It's not my modem IP either (different subnet altogether).

The private address destination events are strange. If I had NAT setup for those addresses, then it would make sense, but I don't - they don't even exist. I am getting these hits kind of regularly (every hour or so, all ICMP) on both private and public addresses as the destination.

Everything is working great, these events are just strange to me…

hoba · May 7, 2006, 8:29 PM

Keep in mind that if this traffic is routed to you for what reason ever it takes away some of your bandwidth. So if this starts to become more you might have problems using all your bandwidth. However, this is not a pfSense issue but related to your ISP having something missconfigured.