50M : Think Broadband Ping Monitor Results (POST YOURS)

[Sephiroth]

Everything you see in those categories. Just copy/paste into your next reply..

[roughbeast]

This is weird. I have full internet services. Speed test at 126Mb, yet a graph like this. I disabled this monitor, but the system won't let me create another. It says I am already monitoring this IP address.

[Sephiroth]

ICMP passthrough enabled on the router?

[roughbeast]

Originally Posted by Sephiroth

ICMP passthrough enabled on the router?

I haven't got network filter services switched on. Also all NAT passthroughs are enabled.

I've just traced problem back to the day I updated ASUS N66U firmware to latest revision. So what's changed I wonder? Last Saturday.

[qasdfdsaq]

You do NOT want passthrough, you want firewall allow and respond.

[roughbeast]

Originally Posted by qasdfdsaq

You do NOT want passthrough, you want firewall allow and respond.

Er. Going with what you said for now, rather than Seph.

What will have changed with the firmware update and where in the router firewall would I gain 'allow and respond'?

[Jumping]

Originally Posted by roughbeast

Er. Going with what you said for now, rather than Seph.

What will have changed with the firmware update and where in the router firewall would I gain 'allow and respond'?

Normally you have to enable allow wan ping request option as its often turned off by default settings.

On my Asus RT-N56U its labelled as "Respond Ping Request from WAN?" under firewall settings. So set this to enabled and the graph should start to work.

[roughbeast]

Originally Posted by Jumping

Normally you have to enable allow wan ping request option as its often turned off by default settings.

On my Asus RT-N56U its labelled as "Respond Ping Request from WAN?" under firewall settings. So set this to enabled and the graph should start to work.

OK! Thanks. Done that.

Weird that the setting must've changed with the update. I don't recall enabling it 9 months ago when I first got this router. Perhaps I did.

I should be able to tell in about 30 minutes if this has worked.

Edit.............................................. .................................

Working. (See above) Thanks again.

[qasdfdsaq]

Yeah some people/companies/manufacturers/PR jerks seem to think not responding to pings from the internet is a "security feature".

[Kushan]

There is such a thing as an ICMP flood, so I can see why that might be. Still, rather than just not responding at all, it's the kind of thing a good firewall should prevent.

[qasdfdsaq]

ICMP flood doesn't require a good firewall at all to prevent at all.

All it needs is a non-stupid ICMP responder.

[Kushan]

Well yeah, the point is that there's any number of ways to mitigate it without disabling the feature entirely.

[qasdfdsaq]

No, point is you shouldn't have to mitigate anything.

[Kushan]

Originally Posted by qasdfdsaq

No, point is you shouldn't have to mitigate anything.

Is that the point? The only reason you wouldn't have to mitigate an attack is if people didn't try to attack you. If someone does an ICMP flood, something has to mitigate it - even if it's the ICMP responder itself. It doesn't matter if it's the responder, the firewall or something else, there's multiple layers of security for a reason.

The real point is that disabling ICMP isn't a solution by any means. I think that much we can agree with.

[qasdfdsaq]

No.

Nobody "does" an ICMP flood to you.

For an ICMP flood to occur, your own router has to actively generate it itself.