Business Community > Routers > ER605 System Log: [osg:E8-48-B8-xx-xx-xx] detected Large Ping attack and dropped 60 packets.
< Routers

ER605 System Log: [osg:E8-48-B8-xx-xx-xx] detected Large Ping attack and dropped 60 packets.

This thread has been locked for further replies. You can start a new thread to share your ideas or ask questions.

ER605 System Log: [osg:E8-48-B8-xx-xx-xx] detected Large Ping attack and dropped 60 packets.

This thread has been locked for further replies. You can start a new thread to share your ideas or ask questions.
ER605 System Log: [osg:E8-48-B8-xx-xx-xx] detected Large Ping attack and dropped 60 packets.
ER605 System Log: [osg:E8-48-B8-xx-xx-xx] detected Large Ping attack and dropped 60 packets.
2022-09-12 23:34:51 - last edited 2022-09-13 00:06:03
Model: ER605 (TL-R605)  
Hardware Version: V1
Firmware Version: 1.1.1 Build 20210723 Rel.64608

Hello.  I'm bothered by the entries in my System log so I searched for MAC address lookup for the company responsible for E8-48-B8 MAC.  It turns out that it is TP-Link! Is TP-Link trying to attack my ER605?  Why is TP-Link doing this?  This is very alarming!

 

OUI: E8:48:B8

Vendor name: TP-Link Corporation Limited

Address:

Room 901
9/F.New East Ocean Centre
9 Science Museum Road
Tsim Sha Tsui Kowloon 999077
HK.

  0      
 
  0      
 
#1
Options
2 Reply
Re:ER605 System Log: [osg:E8-48-B8-xx-xx-xx] detected Large Ping attack and dropped 60 packets.
2022-09-13 02:04:12
After further research, I am surprised to see the MAC of the WAN port of my ER605 is E8-48-B8-xx-xx-FF and the MAC address of the perpetrator is E8-48-B8-xx-xx-FE. So it could be from a device inside my LAN that is sending Large ping packets which is being NAT'ed by the LAN IP address of my ER605. How do I find the LAN MAC address of the ER605???? I wish the log could show more detail of this entry - like the MAC of the originating packet.
  0  
  0  
#2
Options
Re:ER605 System Log: [osg:E8-48-B8-xx-xx-xx] detected Large Ping attack and dropped 60 packets.
2022-09-13 05:01:30

Dear @firefox111 ,

 

firefox111 wrote

After further research, I am surprised to see the MAC of the WAN port of my ER605 is E8-48-B8-xx-xx-FF and the MAC address of the perpetrator is E8-48-B8-xx-xx-FE. So it could be from a device inside my LAN that is sending Large ping packets which is being NAT'ed by the LAN IP address of my ER605. How do I find the LAN MAC address of the ER605???? I wish the log could show more detail of this entry - like the MAC of the originating packet.

 

Thanks for your feedback on this issue in the community!


You may have misunderstood the log message, the MAC address you see refers to your current ER605 device, you can confirm this by going to the Devices List and comparing MAC addresses.

 

The logs mean that the ER605 has detected a Large Ping attack, not that the source of the attack is the ER605 itself.

 

In addition, the current controller version does not support displaying the source of the attack, for more detailed information please refer to this post:

https://community.tp-link.com/en/business/forum/topic/269886?replyId=1113552

 

Best Regards!

Best Regards! >> Omada EAP Firmware Trial Available Here << >> Get the Latest Omada SDN Controller Releases Here << *Try filtering posts on each forum by Label of [Early Access]*
  0  
  0  
#3
Options

Information

Helpful: 0

Views: 536

Replies: 2

About Us
Press
Copyright © TP-LINK CORPORATION PTE. LTD. All rights reserved.