Can one tell if the traffic shown below is from the ISP side or not?

[pasha-19]

Is traffic from the ISP side or my internal network side?  I believe from the ISP but when reporting it to them they did not "see" the traffic on their side.

You cannot view this attachment.

[BrandyWine]

It's exactly what it says. RCF1918 seen as src IP on WAN iface.
It's a local multicast, probably from the iface of the modem. ISP wont see it because they wont see that multicast upstream from your ISP modem.

What is the DFG of your firewall?

[nero355]

Is traffic from the ISP side or my internal network side?

100% From the WAN and not your LAN(s).

I believe from the ISP but when reporting it to them they did not "see" the traffic on their side.

That's weird because it looks like typical Multicast IPTV traffic :
- IGMP is mentioned = Multicast IPTV related.
- 10.x.x.x address = Typical subnet used for all IPTV Customers but the weird thing here is that it's usually not on the WAN VLAN but a seperate special IPTV VLAN instead so no idea how it got there ?!

Do you happen to know which subnet your Modem or ONT uses for webGUI/SSH access ?

[BrandyWine]

IIRC, 224.0.0.1 igmp is sourced locally, so the ISP modem creates it, thus the ISP does not see that igmp traversing their network to the modem.
Once you join a multicast group the 224.x.x.x stream will be brought up.

1) the ISP has multicast services
2) the ISP does not see that IGMP on their side, it's not being mux'd between your wan subnet and ISP (docsis, etc).

https://forum.opnsense.org/index.php?topic=50273.0

[pasha-19]

What is DFG of the firewall.   It has an Intel Intel(R) Core(TM) i3-8130U and is OPNsense Version OPNsense 26.1.11_10-amd64.

[BrandyWine]

What is DFG of the firewall

IP as seen in FW for "default gateway". Is it 10.198.32.1, and your FW WAN IP is 10.198.32.x ?