OPNsense Forum

Archive => 18.1 Legacy Series => Topic started by: elektroinside on February 19, 2018, 07:40:42 pm

Title: What's generating this traffic?
Post by: elektroinside on February 19, 2018, 07:40:42 pm
I don't even use these subnets.
Does anybody else have these or it is just one of my LAN clients?
These events are generated because of custom block rules (Firehol Level 1), and there are a few of them, 1-2/sec.

Basically, on my WAN interface (RDS in the snapshot), something is constantly trying to send data to an unknown 192.168.1.1 on port 3394. I don't have either of them (192.168.1.0/24 or services listening on 3394). Is there something hardcoded in OPNsense?
Title: Re: What's generating this traffic?
Post by: bartjsmit on February 19, 2018, 07:43:08 pm
Perhaps it is on the subnet of your ISP modem? Many still offer a web interface even in bridged mode.

Bart...
Title: Re: What's generating this traffic?
Post by: hutiucip on February 19, 2018, 07:56:34 pm
Perhaps it is on the subnet of your ISP modem? Many still offer a web interface even in bridged mode.

Bart...

Might be... Right last time when I have spoken with my ISP (same ISP, RDS) they explained that they use SNMP for logs/ management of their devices. (We were arguing about something, and the argument brought the remote management matter.)
Title: Re: What's generating this traffic?
Post by: elektroinside on February 19, 2018, 08:06:49 pm
But that would mean that piece of s**t GPON has its own internal IP (which, btw, I cannot access at all if in bridge mode, or I don't know how). And if so, what the heck is it doing in my LAN ???
Title: Re: What's generating this traffic?
Post by: 3kj2w on February 20, 2018, 01:23:26 pm
Try to log on wan interface if you see traffic from other IPs in the same class as your WAN IP.
If you see such traffic then your provider have other customers with unsecured/bad configured network, on the same improper configured switch ( or it is just a dumb switch).
The good thing for you it is that maybe you can hide your traffic using other customers IP on that switch, the bad thing is that others can do the same using your IP.
Title: Re: What's generating this traffic?
Post by: marjohn56 on February 20, 2018, 03:23:54 pm
Perhaps it is on the subnet of your ISP modem? Many still offer a web interface even in bridged mode.

Bart...

Mine does, I use it to get the dsl stats and upload them to a monitoring system. It means I can login and change the modem settings if I need to. It's not ISP supplied though. :)