Guest Charles Posted July 8, 2013 Share Posted July 8, 2013 Mostly shows source and target as the same IP address. Also, detected ICMP flooding attack from my SonicWALL NSA 3500. Link to comment Share on other sites More sharing options...
Administrators Marcos 4,919 Posted July 8, 2013 Administrators Share Posted July 8, 2013 Please post a few records from your firewall log here. As for the ICMP flood attack, v7 should allow you to add the router's IP address to the exception list upon detection of the attack. Link to comment Share on other sites More sharing options...
Guest Charles Posted July 8, 2013 Share Posted July 8, 2013 7/8/2013 11:50:40 AM Packet blocked by active defense (IDS) 172.16.35.162 172.16.35.162 0 7/8/2013 11:50:39 AM Packet blocked by active defense (IDS) 172.16.35.162 172.16.35.162 0 7/8/2013 11:50:06 AM Packet blocked by active defense (IDS) 172.16.35.80 172.16.35.80 0 7/8/2013 11:44:04 AM Packet blocked by active defense (IDS) 172.16.35.18 172.16.35.18 0 7/8/2013 11:38:55 AM Packet blocked by active defense (IDS) 172.16.35.96 172.16.35.96 0 7/8/2013 11:38:36 AM Packet blocked by active defense (IDS) 172.16.35.204 172.16.35.204 0 7/8/2013 11:37:35 AM Packet blocked by active defense (IDS) 172.16.35.18 172.16.35.18 0 7/8/2013 11:37:16 AM Packet blocked by active defense (IDS) 172.16.35.103 172.16.35.103 0 7/8/2013 11:32:45 AM Packet blocked by active defense (IDS) 172.16.35.106 172.16.35.106 0 7/8/2013 11:32:44 AM Packet blocked by active defense (IDS) 172.16.35.106 172.16.35.106 0 7/8/2013 11:32:28 AM Packet blocked by active defense (IDS) 172.16.35.80 172.16.35.80 0 7/8/2013 11:28:09 AM Packet blocked by active defense (IDS) 172.16.35.103 172.16.35.103 0 7/8/2013 11:26:36 AM Packet blocked by active defense (IDS) 172.16.35.195 172.16.35.195 0 7/8/2013 11:26:35 AM Packet blocked by active defense (IDS) 172.16.35.195 172.16.35.195 0 7/8/2013 11:26:35 AM Packet blocked by active defense (IDS) 172.16.35.195 172.16.35.195 0 Link to comment Share on other sites More sharing options...
Administrators Marcos 4,919 Posted July 8, 2013 Administrators Share Posted July 8, 2013 If you go to Setup -> Network -> View temporary IP address blacklist, are there any IP addresses in the list? Link to comment Share on other sites More sharing options...
Recommended Posts