<![CDATA[PfSense wan (em1) constantly pinging my modem. Anyone knows Why?]]>Hi,

I was looking at my suricata alerts and with in the last days.  It was not always like this pfSense Wan interface (em1) is pinging ISP modem internal interface.

from the suricata log

04/26/2016  22:03:56 2 ICMP Attempted Information Leak SOURCE.IP    8 DESTINATION.IP  0 1:2100469  GPL SCAN PING NMAP

If I do a tcpdump on the em1 interface

I see continuous pinging.

21:37:40.212064 IP (tos 0x0, ttl 64, id 55590, offset 0, flags [none], proto ICMP (1), length 28)
    SOURCE.IP  > DESTINATION.IP: ICMP echo request, id 18862, seq 1229, length 8
21:37:40.212478 IP (tos 0x0, ttl 64, id 9112, offset 0, flags [none], proto ICMP (1), length 28)
    DESTINATION.IP > SOURCE.IP: ICMP echo reply, id 18862, seq 1229, length 8

How can i track down and stop whatever is doing this.

]]>https://forum.netgate.com/topic/99018/pfsense-wan-em1-constantly-pinging-my-modem-anyone-knows-whyRSS for NodeThu, 16 Apr 2026 04:30:20 GMTWed, 27 Apr 2016 02:05:56 GMT60<![CDATA[Reply to PfSense wan (em1) constantly pinging my modem. Anyone knows Why? on Wed, 27 Apr 2016 03:08:31 GMT]]>Thanks!
I'll re-enable it for 1 time per second and disable that rule in suricata.

No i its not a fancy setup just connected to the ISP fiber router/switch/modem.

]]>https://forum.netgate.com/post/620068https://forum.netgate.com/post/620068Wed, 27 Apr 2016 03:08:31 GMT<![CDATA[Reply to PfSense wan (em1) constantly pinging my modem. Anyone knows Why? on Wed, 27 Apr 2016 03:03:37 GMT]]>That's always been done. Its interval is adjustable under System>Routing, edit the gateway. The default is 2 per second in 2.3 (with a 0 byte payload, so a trivially small amount of data), 1 per second in 2.2.x and earlier (at default payload size, so less bandwidth used in 2.3). If you aren't using multi-WAN (where you might need fast failover), then once a second or once every few seconds might be fine. You definitely don't want it set to hours or even minutes, it'll lose all its usefulness at that kind of interval.

No it won't DoS anything.

If your Suricata config is logging every ping, it's not exactly sane. It's pointless to have that, even without gateway monitoring it'll just log useless noise.

]]>https://forum.netgate.com/post/620066https://forum.netgate.com/post/620066Wed, 27 Apr 2016 03:03:37 GMT<![CDATA[Reply to PfSense wan (em1) constantly pinging my modem. Anyone knows Why? on Wed, 27 Apr 2016 02:59:51 GMT]]>Ahhh I see in advance features the default is set to 500ms.
Whats a useful setting to set it too.  Like once every 12 hours?

]]>https://forum.netgate.com/post/620065https://forum.netgate.com/post/620065Wed, 27 Apr 2016 02:59:51 GMT<![CDATA[Reply to PfSense wan (em1) constantly pinging my modem. Anyone knows Why? on Wed, 27 Apr 2016 02:57:06 GMT]]>Wow. That worked.
I disabled it altogether, "to consider" the isp modem/router up.

I have been oblivious to this and its the first time i am seeing such entries in suricata log.  A ping ever 5 seconds or 10 seconds I understand but continuous pinging like multipe times per second isnt that like performing a ddos on the isp modem?  Is it safe to have that enabled?
It just fills the suricata log with junk.
Is it a recent feature?

]]>https://forum.netgate.com/post/620064https://forum.netgate.com/post/620064Wed, 27 Apr 2016 02:57:06 GMT<![CDATA[Reply to PfSense wan (em1) constantly pinging my modem. Anyone knows Why? on Wed, 27 Apr 2016 02:31:48 GMT]]>It's most likely the gateway monitoring feature of pfSense. It doesn't usually ping modems, unless they're acting as routers (and would thus be a default gateway for pfSense). You can change the IP address pinged for monitoring purposes under System > Routing, then changing the Monitor IP for that gateway.

]]>https://forum.netgate.com/post/620061https://forum.netgate.com/post/620061Wed, 27 Apr 2016 02:31:48 GMT