Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    What is this? Should I be worried?

    Scheduled Pinned Locked Moved Firewalling
    8 Posts 4 Posters 2.3k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • G Offline
      georgeberz
      last edited by

      I looked at logs this morning and noticed hundreds of these all coming form 1 ip address something with icmp?

      I dont understand, is this something to worry about, is it normal?

      firewall1.jpg
      firewall1.jpg_thumb

      1 Reply Last reply Reply Quote 0
      • dotdashD Offline
        dotdash
        last edited by

        Someone from Limelight Networks in Tempe, AZ is trying to ping you.
        Watch out, those people from Arizona can be pretty unfriendly.
        (I keed, I keed, fine citizens of AZ. Don't shoot me, I'm here legally)

        1 Reply Last reply Reply Quote 0
        • G Offline
          georgeberz
          last edited by

          So is this what a ping attach looks like? or a denial of service attack?

          50+ times a second and over multiple days i've seen this

          1 Reply Last reply Reply Quote 0
          • dotdashD Offline
            dotdash
            last edited by

            I'd just add a rule on the WAN to drop everything from that IP and move it to be one of the first rules.

            1 Reply Last reply Reply Quote 0
            • johnpozJ Online
              johnpoz LAYER 8 Global Moderator
              last edited by

              just because its icmp does not mean its a echo request, I would snag a few of those packets and take a better look to what it is.

              I don't think you can grab icmp from the webui capture interface, so just go to the console and use tcpdump directly.

              An intelligent man is sometimes forced to be drunk to spend time with his fools
              If you get confused: Listen to the Music Play
              Please don't Chat/PM me for help, unless mod related
              SG-4860 25.07.1 | Lab VMs 2.8, 25.07.1

              1 Reply Last reply Reply Quote 0
              • G Offline
                georgeberz
                last edited by

                the firewall IS taking care of it right? and just letting me know via the log?

                1 Reply Last reply Reply Quote 0
                • dotdashD Offline
                  dotdash
                  last edited by

                  Yeah, it's getting blocked.
                  A quick check with the all-knowing Google indicates that the traffic may be related to something called 'valve/steam'. It is some sort of mechanism those young steampunk kids use to play those online games. Try banning those under forty from your network and see if the traffic disappears.

                  1 Reply Last reply Reply Quote 0
                  • M Offline
                    Maxamoto
                    last edited by

                    @dotdash:

                    Yeah, it's getting blocked.
                    A quick check with the all-knowing Google indicates that the traffic may be related to something called 'valve/steam'. It is some sort of mechanism those young steampunk kids use to play those online games. Try banning those under forty from your network and see if the traffic disappears.

                    Hey now. I'm over forty and still play games ;)

                    1 Reply Last reply Reply Quote 0
                    • First post
                      Last post
                    Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.