What is this? Should I be worried?

georgeberz · Nov 15, 2011, 5:46 PM

I looked at logs this morning and noticed hundreds of these all coming form 1 ip address something with icmp?

I dont understand, is this something to worry about, is it normal?

dotdash · Nov 15, 2011, 5:59 PM

Someone from Limelight Networks in Tempe, AZ is trying to ping you.
Watch out, those people from Arizona can be pretty unfriendly.
(I keed, I keed, fine citizens of AZ. Don't shoot me, I'm here legally)

georgeberz · Nov 15, 2011, 8:22 PM

So is this what a ping attach looks like? or a denial of service attack?

50+ times a second and over multiple days i've seen this

dotdash · Nov 15, 2011, 8:54 PM

I'd just add a rule on the WAN to drop everything from that IP and move it to be one of the first rules.

johnpoz · Nov 16, 2011, 4:01 AM

just because its icmp does not mean its a echo request, I would snag a few of those packets and take a better look to what it is.

I don't think you can grab icmp from the webui capture interface, so just go to the console and use tcpdump directly.

georgeberz · Nov 16, 2011, 3:52 PM

the firewall IS taking care of it right? and just letting me know via the log?

dotdash · Nov 16, 2011, 4:12 PM

Yeah, it's getting blocked.
A quick check with the all-knowing Google indicates that the traffic may be related to something called 'valve/steam'. It is some sort of mechanism those young steampunk kids use to play those online games. Try banning those under forty from your network and see if the traffic disappears.

Maxamoto · Dec 7, 2011, 10:27 PM

@dotdash:

Yeah, it's getting blocked.
A quick check with the all-knowing Google indicates that the traffic may be related to something called 'valve/steam'. It is some sort of mechanism those young steampunk kids use to play those online games. Try banning those under forty from your network and see if the traffic disappears.

Hey now. I'm over forty and still play games ;)