OPNsense
  • Home
  • Help
  • Search
  • Login
  • Register

  • OPNsense Forum »
  • Archive »
  • 18.1 Legacy Series »
  • What's generating this traffic?
« previous next »
  • Print
Pages: [1]

Author Topic: What's generating this traffic?  (Read 3017 times)

elektroinside

  • Hero Member
  • *****
  • Posts: 574
  • Karma: 51
    • View Profile
What's generating this traffic?
« on: February 19, 2018, 07:40:42 pm »
I don't even use these subnets.
Does anybody else have these or it is just one of my LAN clients?
These events are generated because of custom block rules (Firehol Level 1), and there are a few of them, 1-2/sec.

Basically, on my WAN interface (RDS in the snapshot), something is constantly trying to send data to an unknown 192.168.1.1 on port 3394. I don't have either of them (192.168.1.0/24 or services listening on 3394). Is there something hardcoded in OPNsense?
Logged
OPNsense v18 | HW: Gigabyte Z370N-WIFI, i3-8100, 8GB RAM, 60GB SSD, | Controllers: 82575GB-quad, 82574, I221, I219-V | PPPoE: RDS Romania | Down: 980Mbit/s | Up: 500Mbit/s

Team Rebellion Member

bartjsmit

  • Hero Member
  • *****
  • Posts: 1604
  • Karma: 167
    • View Profile
Re: What's generating this traffic?
« Reply #1 on: February 19, 2018, 07:43:08 pm »
Perhaps it is on the subnet of your ISP modem? Many still offer a web interface even in bridged mode.

Bart...
Logged

hutiucip

  • Sr. Member
  • ****
  • Posts: 284
  • Karma: 50
    • View Profile
Re: What's generating this traffic?
« Reply #2 on: February 19, 2018, 07:56:34 pm »
Quote from: bartjsmit on February 19, 2018, 07:43:08 pm
Perhaps it is on the subnet of your ISP modem? Many still offer a web interface even in bridged mode.

Bart...

Might be... Right last time when I have spoken with my ISP (same ISP, RDS) they explained that they use SNMP for logs/ management of their devices. (We were arguing about something, and the argument brought the remote management matter.)
Logged

elektroinside

  • Hero Member
  • *****
  • Posts: 574
  • Karma: 51
    • View Profile
Re: What's generating this traffic?
« Reply #3 on: February 19, 2018, 08:06:49 pm »
But that would mean that piece of s**t GPON has its own internal IP (which, btw, I cannot access at all if in bridge mode, or I don't know how). And if so, what the heck is it doing in my LAN ???
Logged
OPNsense v18 | HW: Gigabyte Z370N-WIFI, i3-8100, 8GB RAM, 60GB SSD, | Controllers: 82575GB-quad, 82574, I221, I219-V | PPPoE: RDS Romania | Down: 980Mbit/s | Up: 500Mbit/s

Team Rebellion Member

3kj2w

  • Newbie
  • *
  • Posts: 26
  • Karma: 4
    • View Profile
Re: What's generating this traffic?
« Reply #4 on: February 20, 2018, 01:23:26 pm »
Try to log on wan interface if you see traffic from other IPs in the same class as your WAN IP.
If you see such traffic then your provider have other customers with unsecured/bad configured network, on the same improper configured switch ( or it is just a dumb switch).
The good thing for you it is that maybe you can hide your traffic using other customers IP on that switch, the bad thing is that others can do the same using your IP.
Logged

marjohn56

  • Hero Member
  • *****
  • Posts: 1677
  • Karma: 171
    • View Profile
Re: What's generating this traffic?
« Reply #5 on: February 20, 2018, 03:23:54 pm »
Quote from: bartjsmit on February 19, 2018, 07:43:08 pm
Perhaps it is on the subnet of your ISP modem? Many still offer a web interface even in bridged mode.

Bart...

Mine does, I use it to get the dsl stats and upload them to a monitoring system. It means I can login and change the modem settings if I need to. It's not ISP supplied though. :)
Logged
OPNsense 21.7 - Qotom Q355G4 - ISP - Community Fibre 1Gbps.

Team Rebellion Member - If we've helped you remember to applaud

  • Print
Pages: [1]
« previous next »
  • OPNsense Forum »
  • Archive »
  • 18.1 Legacy Series »
  • What's generating this traffic?
 

OPNsense is an OSS project © Deciso B.V. 2015 - 2023 All rights reserved
  • SMF 2.0.19 | SMF © 2021, Simple Machines
    Privacy Policy
    | XHTML | RSS | WAP2