Child Item

Site Totals

61432 Questions Answered 270 Categories

Verizon Addresses keep pinging me

All:

Can one one tell me why accoring to Arin.net, these IP addresses are contantly pinging my router? and at least one of them seems to talk to one of the boxes on my net on a specific port.. Not sure what port 4772 and 4771 but Verizon is doning something!

Below is a small snipit of the Router log

[Service blocked: ICMP_echo_req] from source 74.86.197.160, Sunday, Jan 15,2012 23:20:06

[Service blocked: ICMP_echo_req] from source 130.81.184.38, Sunday, Jan 15,2012 23:18:37

[Service blocked: ICMP_echo_req] from source 74.86.197.160, Sunday, Jan 15,2012 23:18:09

[Service blocked: ICMP_echo_req] from source 130.81.184.38, Sunday, Jan 15,2012 23:16:18

[Service blocked: ICMP_echo_req] from source 74.86.197.160, Sunday, Jan 15,2012 23:16:02

[Service blocked: ICMP_echo_req] from source 130.81.184.38, Sunday, Jan 15,2012 23:14:24

[Service blocked: ICMP_echo_req] from source 130.81.184.38, Sunday, Jan 15,2012 23:13:22

[Service blocked: ICMP_echo_req] from source 130.81.184.38, Sunday, Jan 15,2012 23:11:34

[Service blocked: ICMP_echo_req] from source 130.81.184.38, Sunday, Jan 15,2012 23:10:24

[Service blocked: ICMP_echo_req] from source 130.81.184.38, Sunday, Jan 15,2012 23:09:15

[Service blocked: ICMP_echo_req] from source 130.81.184.38, Sunday, Jan 15,2012 23:08:34

[LAN access from remote] from 173.79.9.162:4772 to 192.168.1.20:443 Sunday, Jan 15,2012 23:08:25

[LAN access from remote] from 173.79.9.162:4771 to 192.168.1.20:80 Sunday, Jan 15,2012 23:08:20

74.86.197.160 = http://whois.arin.net/rest/net/NET-173-64-0-0-1/pft

Name	Verizon Online LLC
Handle	VRIS
Street	22001 Loudoun County Parkway

130.81.184.38 = http://whois.arin.net/rest/net/NET-130-81-0-0-1/pft

Name	Verizon Online LLC
Handle	VRIS
Street	22001 Loudoun County Parkway

173.79.9.162= http://whois.arin.net/rest/net/NET-173-64-0-0-1/pft

Name	Verizon Online LLC
Handle	VRIS
Street	22001 Loudoun County Parkway

CAN SOMEONE let me know!

Thanks

Gary

Comments

smith6612

Are you using a Dynamic IP or a Static IP? I wonder if perhaps these are requests coming in from perhaps a person who owned the IP at the past and maybe ran things like game servers.

Then again, a machine behind those IPs could also be a zombie, in which case it needs to be cleaned up/eliminated Robot LOL

MrsMark

Verizon is your ISP correct? Just making sure, I don't want to assume anything.

If Verizon is your ISP, this is normal. You make requests to Verizon when you use the internet. Verizon sends back a answer. Your firewall is letting you know about these request only because you haven't accepted Verizon as an allowed trusted zone. Once you told the program that you do not trust it, the program records it as a attack.

Ping is just a process that a servers/clients/device use to ensure that another sever/client/device is on the network and available to receive information.

UnnDunn

Which machine is at 192.168.1.20 on your network? If you have FiOS TV, it could be related to that.

weedeater1

That address is the headquarters of Verizon Business in Ashburn, VA.

MrsMark

I hope my answer help u understand.

henryga1

Not sure I am following you.. as your question about static or dynamic seems to be moot since I am getting what looks like an attack this on my routers verzon interface and all of those addressed are dynamic..

henryga1

thanks for the reply but....

Verizon is your ISP correct? Just making sure, I don't want to assume anything.

Yes I live in a condo so I have a FIOS MDU providing me Vdsl service.

this error is coming to me on the WAN interface of my router. I have no way to tell the router that Verizon is a trusted site and to be honest, I am not sure I understand your logic that since I still do not see a reason why I would get pinged by these two verizon owned IP addressed constantly even if I accepted it as a trusted site

Ping is just a process that a servers/clients/device use to ensure that another sever/client/device is on the network and available to receive information.

thanks for that information however there are many DoS attacks that originate with ICMP hence my concern not to mention mucltiple ICMP with large packet sizes and severily impare performance. there does not seem to be a reason why I am getting pinged by these network interaces. It is a Version IP so if it is a customer Verizon should be able to shut it down. If it is Verizon doing it I want someone to tell me why and for what reason

thanks

Hubrisnxs

If you have Verizon media manager, caller Id on tv, remote dvr, then those things work across the router and through the net.

MrsMark

HenryGa,

I apologize. I responded to your question without looking at all the info you provided. I assumed when u mentioned ports 4772 and 4771 that possible a program on your system requested access which may cause Verizon to send a ping. But 4772 and 4771 aren't ports and all. That is the IP address.

My question is, by any chance did your router reset or update itself on that date and time? This was not a DOS attack because it would have lasted longer then a few minutes. Also if u were being attacked it would have been from thousands of systems not just a couple.

Looks more like a Multicast was sent. If the router did reset a multicast would request info from the different clients (ping). Once the info has been vertified (authenicated) the Routing Table/NAT file would add the info and no more alerts would be recorded.

I think someone inquired about the type of address because they too may have had the idea that the Nat file was updating.

If you continue to see this issue, then yes I would be concerned. You also mentioned you have DSL which kinda thru me off because I assumed (bad bad me) that everyone in this area have a FIOS connection.

Anti-Phish1

@MrsMark wrote:
But 4772 and 4771 aren't ports and all. That is the IP address.
That's incorrect. 4771 and 4772 are indeed port numbers and not IP addresses. They are the originating port on the remote host.
@MrsMark wrote:
You also mentioned you have DSL which kinda thru me off because I assumed (bad bad me) that everyone in this area have a FIOS connection.
In some MDUs (apartments, condos, etc), VZ uses VDSL to deliver the internet portion of FIOS over existing wiring where it is not practical to run fiber to each unit. The OP does indeed have FIOS.

Anti-Phish1

@henryga wrote:
[Service blocked: ICMP_echo_req] from source 74.86.197.160, Sunday, Jan 15,2012 23:20:06
[Service blocked: ICMP_echo_req] from source 130.81.184.38, Sunday, Jan 15,2012 23:18:37
[Service blocked: ICMP_echo_req] from source 74.86.197.160, Sunday, Jan 15,2012 23:18:09
[Service blocked: ICMP_echo_req] from source 130.81.184.38, Sunday, Jan 15,2012 23:16:18
[Service blocked: ICMP_echo_req] from source 74.86.197.160, Sunday, Jan 15,2012 23:16:02
[Service blocked: ICMP_echo_req] from source 130.81.184.38, Sunday, Jan 15,2012 23:14:24
[Service blocked: ICMP_echo_req] from source 130.81.184.38, Sunday, Jan 15,2012 23:13:22
[Service blocked: ICMP_echo_req] from source 130.81.184.38, Sunday, Jan 15,2012 23:11:34
[Service blocked: ICMP_echo_req] from source 130.81.184.38, Sunday, Jan 15,2012 23:10:24
[Service blocked: ICMP_echo_req] from source 130.81.184.38, Sunday, Jan 15,2012 23:09:15
[Service blocked: ICMP_echo_req] from source 130.81.184.38, Sunday, Jan 15,2012 23:08:34
[LAN access from remote] from 173.79.9.162:4772 to 192.168.1.20:443 Sunday, Jan 15,2012 23:08:25
[LAN access from remote] from 173.79.9.162:4771 to 192.168.1.20:80 Sunday, Jan 15,2012 23:08:20
I can't tell you why VZ is pinging you, however, the "service blocked" is because you have response to ICMP ECHO (ping) disabled in your router.
What is on 192.168.1.20 in your network?.
Both the LAN access entries are attempts to access a web server at 192.168.1.20.
Have you changed the LAN IP addresses of the VZ router or STBs? The router is normally on 192.168.1.1 and the STBs are normally assigned LAN addresses starting at 192.168.1.100.
Pings on your external IP address are nothing to worry about especially if you have ICMP response disabled.
Note that is not difficult to forge the source IP address in an ICMP ping, so those pings may not even be from VZ.

Child Item