Constant IPv6 pings to my firewall

[taz420nj]

I'm not real up on IPv6, I don't use it (it's disabled on my LAN, including Teredo) but over the past day or so I've seen a near-constant flood of pings from a single IPv6 address to ff02::1.. Is this a persistent script kiddie whose scanner is stuck on me or what? My logs are usually filled with IPv4 port scans from the usual hacker havens (China, Russia, India, etc) but they usually scan a couple times and thats it. What is the significance of this ff02::1?

 

[DRDNA]

It is not as hacker it is a listener and is happening local not via the internet. Part of multicast.

 

[taz420nj]

It is not as hacker it is a listener and is happening local not via the internet. Part of multicast.

It's not local, it's being blocked by the firewall at the WAN interface. And as I said, nothing on my LAN uses IPv6, it's disabled in everything...

 

[DRDNA]

It's not local, it's being blocked by the firewall at the WAN interface. And as I said, nothing on my LAN uses IPv6, it's disabled in everything...

even disabled it will still have that listener.
Most firewalls will detect local as well so that doesn't matter.

 

[hat]

I don't know much about this stuff, but logic tells me it may be something else, or at least have some unusual underlying cause, since he said it didn't start happening until "a day or so" ago.

 

[taz420nj]

even disabled it will still have that listener.
Most firewalls will detect local as well so that doesn't matter.

Bro. It is NOT LOCAL. It is coming in from the WAN. REPEAT. NOT. LOCAL. See on the third column where it says "WAN"? That means it is an INBOUND request.

I don't know much about this stuff, but logic tells me it may be something else, or at least have some unusual underlying cause, since he said it didn't start happening until "a day or so" ago.

Thank you! I've been using pfSense for over 5 years, and I have NEVER seen a flood like this.

And it is still going....

 

[eidairaman1]

Check your services, run mbam, sbsad, sas.

If in question contact your isp for packet sniffers, or refresh your external ip address.

 

[Deleted member 50521]

NSA guy trying to check on your porn stash maybe.

 

[evernessince]

I'm not real up on IPv6, I don't use it (it's disabled on my LAN, including Teredo) but over the past day or so I've seen a near-constant flood of pings from a single IPv6 address to ff02::1.. Is this a persistent script kiddie whose scanner is stuck on me or what? My logs are usually filled with IPv4 port scans from the usual hacker havens (China, Russia, India, etc) but they usually scan a couple times and thats it. What is the significance of this ff02::1?

You can google that IPv6 address, it's a common multi-cast address for streaming content. Unlikely that it has anything to do with hackers.
https://en.wikipedia.org/wiki/IP_multicast

 

[Solaris17]

It's not local, it's being blocked by the firewall at the WAN interface. And as I said, nothing on my LAN uses IPv6, it's disabled in everything...

Be that as it may its local. My IPv6 is disabled and windows will still try to broadcast using that address.

I took the liberty of visually referencing the needed tables below. I'm sure you will be able to make quick work of it with your extensive networking knowledge.

Bro. It is NOT LOCAL. It is coming in from the WAN. REPEAT. NOT. LOCAL. See on the third column where it says "WAN"? That means it is an INBOUND request.

While it may be out of turn when networking people respond to a networking question and the "meta" answer is that you are wrong you would do well to be a little more polite and open minded about what you consider fact.

 

[eidairaman1]

Be that as it may its local. My IPv6 is disabled and windows will still try to broadcast using that address.

I took the liberty of visually referencing the needed tables below. I'm sure you will be able to make quick work of it with your extensive networking knowledge.

While it may be out of turn when networking people respond to a networking question and the "meta" answer is that you are wrong you would do well to be a little more polite and open minded about what you consider fact.

I wonder if a registry hack will kill it totally