SillyDog701

[Anonymosity]

I am using a Siemens SE567 modem/router and I have a firewall running on one of the 2 computers hooked up to it. The firewall has been logging attempted echo requests from time to time. I tried Steve Gibson's stealth test and the router passed it. That test includes attempted pinging. The firewall logged nothing at all during that test. At other times, it is logging echo requests. Is that router pinging my computer, and if so, why? What would be the point of that?

UserAgent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X; rv:1.9.1.5) Gecko Firefox/3.5.5

[Don_HH2K]

Some routers will do a broadcast ping to determine what devices are communicating on the network. If you passed the stealth test then there's a good chance the ping data is coming from inside your network instead of outside, so it's probably just a normal mode of operation for your router.

If you're still suspicious, you can refer to your router manual and see if there's any mention of it sending out pings, or take a look at your computer's network activity using Wireshark to determine what the requests are and where they're coming from.

UserAgent: Mozilla/5.0 (Windows; U; Windows NT 6.1 x64; en-US; rv:1.9.3a1pre) Gecko/20091116 Minefield/3.7a1pre

[Anonymosity]

The manual is minimal. It was one sheet explaining how to hook it up.
I am not running a network. I have 2 computers plugged into the router, but they do not talk to each other. The internet service is working fine in spite of the fact that the firewall is blocking those pings.

UserAgent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X; rv:1.9.1.5) Gecko Firefox/3.5.5

[Don_HH2K]

Unless you're given two distinct IP addresses from your ISP (which is very unlikely if you're on a home package), the router is probably still configured as a NAT gateway. You can confirm this by checking the IP address of either machine, as reported by a tool like Windows' [tt]ipconfig[/tt], against your public IP, as reported by a site like WhatIsMyIP.com.

UserAgent: Mozilla/5.0 (Windows; U; Windows NT 6.1 x64; en-US; rv:1.9.3a1pre) Gecko/20091116 Minefield/3.7a1pre

[Anonymosity]

I can get the router itself to tell me what my IP address is, both externally and the address of the router, as well as the address of the computer behind the router. I am sure the router is acting as a NAT gateway. So what? How is that going to tell me whether it is the router itself trying to ping me?
The firewall on the Windows PC is set to block all incoming probes, including echo requests, and the Mac firewall is set on stealth mode, which should be blocking pings as well. So with both computers running firewalls which are blocking pings, why would the router keep trying from time to time? Why are there hours of no attempts and then sequences of pings every few minutes for short intervals?

UserAgent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X; rv:1.9.1.5) Gecko Firefox/3.5.5

[Don_HH2K]

Like I said earlier, some routers will send out pings to determine what's talking on the network. Even if it doesn't find anything, it'll keep going every so often to try and locate new machines. Our old router used to do this, and it would show up in ZoneAlarm logs on my dad's PC every day.

Since you're running NAT services on the router, a ping request from the outside would be answered (or dropped, if it has its own firewall) by your router, not forwarded along to PCs on the inside. That would mean pings on the inside are coming from the inside. Are you able to check what IP address those pings are coming from?

UserAgent: Mozilla/5.0 (Windows; U; Windows NT 6.1 x64; en-US; rv:1.9.3a1pre) Gecko/20091116 Minefield/3.7a1pre

[Anonymosity]

The firewall on the PC (the only one logging anything) simply logs the pings as coming from the address of the router. It would do that anyway, would it not? To the firewall, anything incoming would appear to be coming from that address.

UserAgent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X; rv:1.9.1.5) Gecko Firefox/3.5.5

[Don_HH2K]

In NAT mode, the router would be answering pings from the outside on its own. That would tell you that the pings are probably originating at the router, and not on the outside.

UserAgent: Mozilla/5.0 (Windows; U; Windows NT 6.1 x64; en-US; rv:1.9.3a1pre) Gecko/20091116 Minefield/3.7a1pre

[Anonymosity]

I see. Thanks for the info. The router is not answering pings from outside. I know that because it passed Steve Gibson's stealth test, which includes echo requests.

UserAgent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X; rv:1.9.1.5) Gecko Firefox/3.5.5