Strange Traffic from Pfsense LOCAL to 184.108.40.206:22 ( SUSPICIOUS ) ?
I have found a lot of requests going from PfSense ITSELF ( WAN ) to this IP "220.127.116.11" on Port 22.
Has someone an idea about the reason ?
chpalmer last edited by
What is 192.168.22.100 on your network? Is this truly your firwall?
Yes, the origin is clearly my firewall : 192.168.22.100 is the IP of the WAN Interface of Pfsense.
I have found it out, due to the analyse of my traffic in "ntopng", where it fills up pages
I have found myself the beginning of a response :
I have managed out, that it's related with the package NTOPNG and the DNS-Server that is used in it :
when I change the DNS -Option from
the messages about a misbehaviour disappear.
The strange thing is that pfSense is configured to use localhost as DNS-Server and that unbound is configured on pfSense itself.
I will put a new post about the problem in the category traffic of the forum.
This post is deleted!