Business Community > Controllers > Router detected Large Ping attack and dropped 7 packets.
< Controllers

Router detected Large Ping attack and dropped 7 packets.

This thread has been locked for further replies. You can start a new thread to share your ideas or ask questions.
123...

Router detected Large Ping attack and dropped 7 packets.

This thread has been locked for further replies. You can start a new thread to share your ideas or ask questions.
Router detected Large Ping attack and dropped 7 packets.
Router detected Large Ping attack and dropped 7 packets.
2021-07-09 13:24:24 - last edited 2022-08-11 11:47:02
Tags: #Highlighted Thread #Detected Large Ping Attack
Model: ER7206 (TL-ER7206)  
Hardware Version: V1
Firmware Version: 1.01

Hello everyone.

 

I have a new network infrastructure running a few days now in a new office under construction.

There I have 3 omada devices (Router, POE Switch and EAP) and a wired security system.

 

Today i added a Win10 laptop for a video conference and i have more than 10 alerts at omada's log like this one: "Router detected Large Ping attack and dropped 7 packets."  

 

The same happened about 1 week before when added the security system in the network, but after it stopped. No other PC or other network device was connected to the network.

 

So is this normal, every time i add a new network device, or it is an attack?

 

Is this critical ? Is this a Ping attack? 

Should i take care of these, or remove these alerts from omada's alert emails ?

 

 

Thanks

 

E.A

  16      
 
  16      
 
#1
Options
2 Accepted Solutions
Re:Router detected Large Ping attack and dropped 7 packets.-Solution
2022-07-18 09:43:41 - last edited 2022-10-28 06:03:04

Dear @Danny909, @Callmedave, @MaximusMark, @TheUnF, @NeoCZ, @biomed32uk, @BCosse, and other community members,

 

TheUnF wrote

@FAE, what do we need to do in order to get a very simple change on these notifications : show the source IP of the detected attach ?

 

Thank you all for your valuable feedback!

 

First, the alert of "Router detected Large Ping attack and dropped 7 packets." or "Router detected Ping of Death attack and dropped 1 packets" is a result of the router firewall function. If this kind of log is NOT much frequently reported and did not affect your normal use of the network, you may just keep an eye on it and no need to worry about it too much.

 

However, if it's very frequent, it indicates that there are many such attack packets exist in your network topology, you may need to check whether such attack packets exist in your network and address the problem from the attack source.

 

It's a pity that the Omada log doesn't offer more details about such an attack at present. And it's reasonable to provide the source IP of the detected attack in the log to help things easier, which has already been forwarded as a feature request to the R&D team for evaluation. Now it's confirmed that Omada Controller v5.6 will support showing the source IP of the detected "Large Ping Attack" or "Ping of Death Attack". which requires to upgrade the Router to the adapted firmware.

 

Before the final release of controller v5.6, if you wish to figure out where is the attack source, you may capture packages to have a try.

Here is the documentation on How to capture packets using Wireshark on SMB router or switch

The following is the detection scope and matching rules for Large Ping and Ping of Death:

  • Large Ping: Ping packets larger than 1024 bytes, which could be from WAN or LAN.
  • Ping of Death: ICMP packets larger than 65535 bytes, which could be from WAN or LAN.

Note: In both cases, oversized ping and tracert packets will be dropped.

 

Hope the information above helps. Thank you for your great patience!

>> Omada EAP Firmware Trial Available Here << *Try filtering posts on each forum by Label of [Early Access]*
Recommended Solution
  17  
  17  
#22
Options
Re:Router detected Large Ping attack and dropped 7 packets.-Solution
2023-04-26 07:43:33 - last edited 2023-04-26 07:43:44

Hello @PruntWHAT,

 

PruntWHAT wrote

  @Fae I'm running the ER605 v1 on version 1.2.1. I'm still not getting the IP information for this in the logs, just that the router "detected Large Ping attack and dropped packets." Is the IP information still coming out in a new update?

 

Please ensure that both your Omada Controller and Router are updated to the firmware adapted to Controller v5.6 or later version.

 

For ER605 V1, the following new Beta firmware has added support for displaying the Source IP address of large Ping attack packets.

ER605 V1_1.2.3_Build 20230413 Beta Firmware For Trial (Released on Apr 14th, 2023)

>> Omada EAP Firmware Trial Available Here << *Try filtering posts on each forum by Label of [Early Access]*
Recommended Solution
  1  
  1  
#86
Options
88 Reply
Re:Router detected Large Ping attack and dropped 7 packets.
2021-07-10 10:56:53

@BravoMike31 have the same. this have to be some sort of a bug, all network clients in my omada network are properly configured and secured but controller alerts on large ping attack all the time (even if WAN is down, so this have to be related to packets exchanged within DMZ).

  9  
  9  
#2
Options
Re:Router detected Large Ping attack and dropped 7 packets.
2021-07-10 14:10:09

@Norbert_123 after my post above, i got more than 15 new emails with the same alerts and today 2-3 times.
 

As i saw there are many other posts with the same issues. It is not normal to have so many ping attacks in a n ew network without PCs running, without a static public ip.

 

TP-Link support must respond! 

  14  
  14  
#3
Options
Re:Router detected Large Ping attack and dropped 7 packets.
2021-07-14 10:15:54

Dear @BravoMike31,

 

BravoMike31 wrote

after my post above, i got more than 15 new emails with the same alerts and today 2-3 times.
 

As i saw there are many other posts with the same issues. It is not normal to have so many ping attacks in a n ew network without PCs running, without a static public ip.

 

Large Ping attack means the gateway receives multiple ping packets larger than 1500 bytes, not only PCs can send ping packets, other network equipment with IP addresses can also have such ability. And I think it's nice to know that the router has detected the Large Ping attacks and blocked them to protect the system from being crashed.

 

If you are curious about where the large ping attack comes from, you may try to capture the ingress & egress packets from the LAN and WAN ports, and check the ICMP packets to trace the attack. In addition, you may need to configure the gateway in Standalone mode and then configure the Port Mirror to capture the packets (the gateway in Controller mode doesn't support the port mirror feature at present).

 

By the way, the email notification for such alerts can be canceled if you don't want to receive them via email.

 

 

>> Omada EAP Firmware Trial Available Here << *Try filtering posts on each forum by Label of [Early Access]*
  0  
  0  
#4
Options
Re:Router detected Large Ping attack and dropped 7 packets.
2021-07-14 10:19:18

Dear @Norbert_123,

 

Norbert_123 wrote

@BravoMike31 have the same. this have to be some sort of a bug, all network clients in my omada network are properly configured and secured but controller alerts on large ping attack all the time (even if WAN is down, so this have to be related to packets exchanged within DMZ).

 

The large ping attack is not only coming from the WAN, but also from the LAN.

 

If you disconnect everything from the gateway, do you still get the large ping attack?

>> Omada EAP Firmware Trial Available Here << *Try filtering posts on each forum by Label of [Early Access]*
  1  
  1  
#5
Options
Re:Router detected Large Ping attack and dropped 7 packets.
2021-09-15 20:22:47

@Fae 

Please describe (or send a link to a TPLink document/article that details) HOW TO:

  • capture the ingress & egress packets from the LAN and WAN ports, and
  • check the ICMP packets to trace the attack. In addition, you may need to
  • configure the gateway in Standalone mode and then
  • configure the Port Mirror to capture the packets (the gateway in Controller mode doesn't support the port mirror feature at present).

and then...

  • How to reconfigure the gateway (from Standalone mode, back to...Omada controller managed state)

 

I have 1/EA TL-R605 router, 1/EA TL-SG2008-P, 3/EA EAP225 Access Points (2 wired POE, 1 Mesh), 1/EA OC200 Omada controller

Thanks! -Dan

  2  
  2  
#6
Options
Re:Router detected Large Ping attack and dropped 7 packets.
2021-10-19 10:49:09 - last edited 2021-10-19 10:49:26

 

Danny909 wrote

Please describe (or send a link to a TPLink document/article that details) HOW TO:

  • capture the ingress & egress packets from the LAN and WAN ports, and
    • Perform a Wireshark Capture.
  • check the ICMP packets to trace the attack. In addition, you may need to
    • Filter the Wireshark Capture to show only ICMP packets.
  • configure the gateway in Standalone mode and then
    • You will need to "unmanage" the TLR605 from the OC200 controller (note this will factory reset your Router).
    • Then navigatge to your routers Private IP (ie; 192.168.x.x).
  • configure the Port Mirror to capture the packets (the gateway in Controller mode doesn't support the port mirror feature at present).
    • Search for the forums, there is some documentation/guides on how to perform this.

and then...

  • How to reconfigure the gateway (from Standalone mode, back to...Omada controller managed state)
    • Perform the same steps you performed when you configured your OC200 to begin with so that TLR605 can be managed by the OC200

 

I have 1/EA TL-R605 router, 1/EA TL-SG2008-P, 3/EA EAP225 Access Points (2 wired POE, 1 Mesh), 1/EA OC200 Omada controller

Thanks! -Dan

 

 

Also to add to this topic, I'm having a similar issue, however its worse than "1 packet every 30min or so".

- See below just an example of a bad day.

 

This has been happening since around the 20/09/21.

The troubleshooting ive done thus far has not been throrough and im still troubleshooting the issue.

But when I spun up a 2nd service from another ISP (I have FTTP, 4 Ports ie; 4 Services) and cut over to the other provider in the 4 days i was with that provider i didn't have any "Large Ping of Death Attacks"

  • Which makes me think its something to do with my current provider.
  • I've tried to perform multiple "Wireshark" Traces however I have not been able to capture this as the large ICMP are coming through.
  • I've tried to isolate some of the devices on my network to identify what was the culprit (at first i thought it was my Ring Doorbell)
    • As there have been numerous forums fluttered with the same thing from people with a ring doorbell.
    • This was removed from my network immediately (obtained a new IP from my ISP) - it seemed good for 24hours but then they occurred again.

 

The next thing im gonna do is try to leave a laptop connected overnight running wireshark to see if i can track this down.

 

My 2cents anyway....

  1  
  1  
#7
Options
Re:Router detected Large Ping attack and dropped 7 packets.
2021-10-22 15:46:01

Same exact issue and quite bad in the span of a few hours...dont even know from where to start.

 

Home setup Setup:

ER605

TPlink switch TL-SG1016PE 2.0

4 omada access points

OC200 controller

 

  0  
  0  
#8
Options
Re:Router detected Large Ping attack and dropped 7 packets.
2022-01-14 19:42:46 - last edited 2022-01-14 19:44:47

I guess this is still happening for unknown reason(s). I just bought the ER7206 yesterday and I'm seeing these large ping attacks several times a day.

 

But what's more concerning is that I'm also seeing this message too, sometimes even more often: [SFP WAN] of ER7206 is down. My SFP WAN is connected to a Bell HH3000 SFP module but that shouldn't be an issue since it works perfectly fine in the HH3000 with no internet interruptions. I'm still monitoring this and weighing in on how much this affects my household's internet reliability. If this continues I will likely look for another product solution.

 

Curious, anyone else seeing this in their Controller log: "[SFP WAN] of ER7206 is down" ?? And if so are you with Bell Fibe?

 

  0  
  0  
#9
Options
Re:Router detected Large Ping attack and dropped 7 packets.
2022-02-26 22:28:02

I have had this from day one, sometimes one a day, sometimes many an hour. I tried to work out which device was causing it but there was no singular device that I could identify.

I then unplugged everything bar the controller and these messages were still logged. I just tend to clear them down.

Until the logs are updated to provide more detailed information, I don't know if there is any further investigation that can be done?

  2  
  2  
#10
Options
Re:Router detected Large Ping attack and dropped 7 packets.
2022-04-09 07:17:27

  @Fae thanks for the info. I can't help thinking that in the absence of a detailed router log, it would help considerably for the event message to include the router port or interface on which the Large Ping was detected.

 

I'm noticing these on our network, which is temporarily set double-NAT behind another router which is also set to not respond to ping, which makes me think the problematic packets originate from our LAN. Think I'll have to sort out a packet sniffer.

  8  
  8  
#11
Options
123...

Information

Helpful: 16

Views: 53825

Replies: 89

Tags

Highlighted Thread
Detected Large Ping Attack
About Us
Press
Copyright © TP-Link Corporation Limited. All rights reserved.