OPNsense Forum

Archive => 16.1 Legacy Series => Topic started by: akm on March 24, 2016, 05:08:44 pm

Title: HIP (host identity protocol) packages every 2 minutes
Post by: akm on March 24, 2016, 05:08:44 pm
Good afternoon,

I do see a HIP package every 2 minutes in filter.log. I have googled a bit, but I still have some questions:

a) Those packages are blocked by the packet filter. Should this really be the standard case?
b) I only have one Wifi access point (FritzBox), so I think I really don't need HIP. How can I disable this and where? Is it possible to find the real source of those packages?
c) A log entry every 2 minutes is quite anoying. How can I disable this? It's not possible to select HIP as a protocol type in the firewall rule settings.

My basic network setup:

ISP Cable (Kabeldeutschland) <==> FritzBox 6390 (DECT, <==> [em1,] OPNsense (LAN DHCP, [em0] <==> FritzBox 7490 (, WLAN AP)
(The 6390 will be kicked out once the "Routerzwang" will end, hopefully in June 2016 :) )

filter.log snapshot:
root@OPNsense:/tmp # grep hip filter.log | tail
Mar 24 16:23:30 OPNsense filterlog: 3,16777216,,0,em0,match,block,in,4,0x0,,255,246,0,none,139,hip,72,,,datalength=52
Mar 24 16:25:30 OPNsense filterlog: 3,16777216,,0,em0,match,block,in,4,0x0,,255,247,0,none,139,hip,72,,,datalength=52
Mar 24 16:27:31 OPNsense filterlog: 3,16777216,,0,em0,match,block,in,4,0x0,,255,248,0,none,139,hip,72,,,datalength=52
Mar 24 16:29:30 OPNsense filterlog: 3,16777216,,0,em0,match,block,in,4,0x0,,255,249,0,none,139,hip,72,,,datalength=52
Mar 24 16:31:30 OPNsense filterlog: 3,16777216,,0,em0,match,block,in,4,0x0,,255,250,0,none,139,hip,72,,,datalength=52
Mar 24 16:33:31 OPNsense filterlog: 3,16777216,,0,em0,match,block,in,4,0x0,,255,251,0,none,139,hip,72,,,datalength=52
Mar 24 16:35:30 OPNsense filterlog: 3,16777216,,0,em0,match,block,in,4,0x0,,255,252,0,none,139,hip,72,,,datalength=52
Mar 24 16:37:31 OPNsense filterlog: 3,16777216,,0,em0,match,block,in,4,0x0,,255,253,0,none,139,hip,72,,,datalength=52
Mar 24 16:39:30 OPNsense filterlog: 3,16777216,,0,em0,match,block,in,4,0x0,,255,254,0,none,139,hip,72,,,datalength=52
Mar 24 16:41:30 OPNsense filterlog: 3,16777216,,0,em0,match,block,in,4,0x0,,255,255,0,none,139,hip,72,,,datalength=52

Any help is appreciated!

It seems to be related to my Android phone. I was not at home for 2 hours and I don't see any packages during this time frame.