×  Introducing Nighthawk RS700 WiFi 7 (BE) Router. For more details, please visit Nighthawk Tri-Band WiFi 7 Router.
Reply

Re: Orbi excessive pinging

j0ebeer
Guide

Orbi excessive pinging

Does anyone else see their Orbi satellites doing excessing pings to the default gateway?  In my firewall log I am getting thousand of them and I don't know why.  Or where to disable it.

 

Joe

Message 1 of 30
FURRYe38
Guru

Re: Orbi excessive pinging

What Firmware is currently loaded?
What is the Mfr and model# of the ISP modem the NG router is connected too?

My Setup ISP SparkLight | Internet Cable 1000↓/50↑ CAX30 Mode Mode  | Wifi Router XR500 and RBK863 Router mode | Switches NG GS105/8, GS308v3, GS110MX and XS505M | Additional NG HW: C7800/CAX3/CAX80/CM1100/CM1200/CM2000, Orbi: CBK40, CBK752, RBK50, RBK853, RBK752, RBK953, SXK30 | NightHawk: MK63, R7000, R7800, R7960P, R8000, R8500, RAXE500, RAX120v2, RAX50v2, XR450/500/700/1000, EX7500/EX7700

Message 2 of 30
CrimpOn
Guru

Re: Orbi excessive pinging


@j0ebeer wrote:

Does anyone else see their Orbi satellites doing excessing pings to the default gateway?  In my firewall log I am getting thousand of them and I don't know why.  Or where to disable it.


Am interested in which "firewall log" this is.  When Orbi is configured as a "router", it IS the gateway, and satellites never communicate past the Orbi.  So, this Orbi must be configured as an Access Point, in which case every device on the network, including the satellites, gets an IP address from whatever device is using DHCP to assign IPs (the gateway?)  One would expect that satellites would then do things like ARP requests, pings, etc. against the gateway.  "Thousands" sounds like a lot, but I have been surprised at how "chatty" an ethernet network is.

I love my Orbi.
Message 3 of 30
j0ebeer
Guide

Re: Orbi excessive pinging


@FURRYe38 wrote:

What Firmware is currently loaded?
What is the Mfr and model# of the ISP modem the NG router is connected too?


Firewall is latest on Main unit and satellites.  Main is v2.3.5.30 and Sats are v2.3.5.26.  The Main is not connected to a cable modem but my firewall instead.

Message 4 of 30
j0ebeer
Guide

Re: Orbi excessive pinging


@CrimpOn wrote:

@j0ebeer wrote:

Does anyone else see their Orbi satellites doing excessing pings to the default gateway?  In my firewall log I am getting thousand of them and I don't know why.  Or where to disable it.


Am interested in which "firewall log" this is.  When Orbi is configured as a "router", it IS the gateway, and satellites never communicate past the Orbi.  So, this Orbi must be configured as an Access Point, in which case every device on the network, including the satellites, gets an IP address from whatever device is using DHCP to assign IPs (the gateway?)  One would expect that satellites would then do things like ARP requests, pings, etc. against the gateway.  "Thousands" sounds like a lot, but I have been surprised at how "chatty" an ethernet network is.


The firewall log is my Fortinet sending logs into Splunk.  From a search of the past 4 hours the 2 satellites have ping my FW gateway over 6500 times.  My guess is its default behavior and I'm probably stuck with it.  I would call it poor coding.

Message 5 of 30
CrimpOn
Guru

Re: Orbi excessive pinging

I just now captured my Orbi LAN traffic.  My (one) satellite sends ICMP (ping) once per second to the Orbi router, which is also the "gateway".  I believe that the default behavior when Orbi is providing DHCP is to provide the Orbi IP address as both the gateway and the DNS for every device on the network that gets an IP from the Orbi.  60 time/min * 60min/hr = 3,600 pings/hr per satellite.  Two satellites = 7,200 pings/hr.  Thus, my analysis does not match what the firewall is reporting.  It should be seeing more than twice as much.

 

Yes, that sounds like "a lot".  On the other hand, we're talking about gig ethernet, so the actual portion of total bandwidth consumed is not "large".

 

I am still wondering how the firewall is capturing these pings.  Is the firewall the "gateway"?  Which device is providing DHCP?

I love my Orbi.
Message 6 of 30
FURRYe38
Guru

Re: Orbi excessive pinging

You might try updating FW to v2.5.1.8...See if this still happens. 

IS Orbi running in router or AP mode? 

 

My Setup ISP SparkLight | Internet Cable 1000↓/50↑ CAX30 Mode Mode  | Wifi Router XR500 and RBK863 Router mode | Switches NG GS105/8, GS308v3, GS110MX and XS505M | Additional NG HW: C7800/CAX3/CAX80/CM1100/CM1200/CM2000, Orbi: CBK40, CBK752, RBK50, RBK853, RBK752, RBK953, SXK30 | NightHawk: MK63, R7000, R7800, R7960P, R8000, R8500, RAXE500, RAX120v2, RAX50v2, XR450/500/700/1000, EX7500/EX7700

Message 7 of 30
dl42
Aspirant

Re: Orbi excessive pinging

I'm running  RBK13 in AP mode and I see the same high volume of pings on the gateway.   Orbi is not acting as dhcp server in my environment.

I also see a large number of pings to external IP addresses.   I have support cases open on these but have not had any responses.

Message 8 of 30
FURRYe38
Guru

Re: Orbi excessive pinging

@Blanca_O 

@ErnestTheGreat 

Maybe a forum moderator can chime in. 

My Setup ISP SparkLight | Internet Cable 1000↓/50↑ CAX30 Mode Mode  | Wifi Router XR500 and RBK863 Router mode | Switches NG GS105/8, GS308v3, GS110MX and XS505M | Additional NG HW: C7800/CAX3/CAX80/CM1100/CM1200/CM2000, Orbi: CBK40, CBK752, RBK50, RBK853, RBK752, RBK953, SXK30 | NightHawk: MK63, R7000, R7800, R7960P, R8000, R8500, RAXE500, RAX120v2, RAX50v2, XR450/500/700/1000, EX7500/EX7700

Message 9 of 30
CrimpOn
Guru

Re: Orbi excessive pinging


@dl42 wrote:

I'm running  RBK13 in AP mode and I see the same high volume of pings on the gateway.   Orbi is not acting as dhcp server in my environment.

I also see a large number of pings to external IP addresses.   I have support cases open on these but have not had any responses.


Since the Orbi is in AP mode, I believe it is entirely "normal" for the router and satellites to ping the gateway.  To us, once a second may seem excessive, but I have no idea what internet "standards" are for that kind of "keep alive" behavior.

 

Pings to external addresses are a different matter.  Are those from the Orbi equipment?

I love my Orbi.
Message 10 of 30
j0ebeer
Guide

Re: Orbi excessive pinging

I don't consider this "normal" for any manufacuter.  For me it is only the 2 Orbi satellites I have and they are only pinging the default gateway given by the dhcp server of my firewall.  I only started capturing the logs into Splunk yesterday but for 20 hours I show over 40,000 pings (screenshot attached) from the 2 sats.  Is it impacting my home network performance, probably not.  But does it need to be this excessive?  I am a security sales engineer and when I do demos I now have to filter out this excessive garbage so it doesn't skew graphs and reports.  Bit annoying.

 

Hopefully someone from Netgear sees this and can comment.  Otherwise I'll be looking to toss the system onto ebay. 

Message 11 of 30
dl42
Aspirant

Re: Orbi excessive pinging

you might want to take a look at the outbound traffic too.

 

this lot are from the router RBR10 running in AP mode.

2020-01-10 13:20:18 Allow 8.8.4.4 ICMP
2020-01-10 13:20:18 Allow 8.8.8.8 ICMP
2020-01-10 13:20:19 Allow 143.204.192.117 ICMP
2020-01-10 13:20:20 Allow 143.204.192.117 ICMP
2020-01-10 13:20:20 Allow 13.227.171.99 ICMP
2020-01-10 13:20:20 Allow 143.204.192.117 ICMP
2020-01-10 13:20:20 Allow 13.227.171.99 ICMP
2020-01-10 13:20:20 Allow 143.204.192.117 ICMP
2020-01-10 13:20:20 Allow 13.227.171.99 ICMP
2020-01-10 13:20:21 Allow 143.204.192.117 ICMP
2020-01-10 13:20:21 Allow 143.204.192.117 ICMP
2020-01-10 13:20:21 Allow 13.227.171.99 ICMP
2020-01-10 13:20:22 Allow 143.204.192.117 ICMP
2020-01-10 13:20:22 Allow 13.227.171.99 ICMP
2020-01-10 13:20:22 Allow 13.227.171.99 ICMP
2020-01-10 13:20:22 Allow 143.204.192.117 ICMP
2020-01-10 13:20:22 Allow 143.204.192.117 ICMP
2020-01-10 13:20:22 Allow 13.227.171.99 ICMP
2020-01-10 13:20:22 Allow 13.227.171.99 ICMP
2020-01-10 13:20:22 Allow 143.204.192.117 ICMP
2020-01-10 13:20:22 Allow 13.227.171.99 ICMP
2020-01-10 13:20:22 Allow 13.227.171.99 ICMP
2020-01-10 13:20:23 Allow 143.204.192.117 ICMP
2020-01-10 13:20:23 Allow 143.204.192.117 ICMP
2020-01-10 13:20:23 Allow 13.227.171.99 ICMP
2020-01-10 13:20:23 Allow 13.227.171.99 ICMP
2020-01-10 13:20:23 Allow 13.227.171.99 ICMP
2020-01-10 13:20:23 Allow 13.227.171.99 ICMP
2020-01-10 13:20:24 Allow 143.204.192.117 ICMP
2020-01-10 13:20:24 Allow 13.227.171.99 ICMP
2020-01-10 13:20:24 Allow 13.227.171.99 ICMP
2020-01-10 13:20:25 Allow 13.227.171.99 ICMP
2020-01-10 13:20:25 Allow 143.204.192.117 ICMP
2020-01-10 13:20:25 Allow 13.227.171.99 ICMP
2020-01-10 13:20:26 Allow 13.227.171.99 ICMP
2020-01-10 13:20:26 Allow 13.227.171.99 ICMP
2020-01-10 13:20:45 Allow 52.30.38.228 https/tcp
2020-01-10 13:20:45 Allow 52.30.38.228 HTTP
2020-01-10 13:20:46 Allow 52.30.38.228 HTTP
2020-01-10 13:20:46 Allow 52.211.208.165 https/tcp

this lot from the satellite RBS10;

2020-01-10 13:20:18 Allow 13.227.171.99 ICMP
2020-01-10 13:20:18 Allow 143.204.192.117 ICMP
2020-01-10 13:20:19 Allow 8.8.4.4 ICMP
2020-01-10 13:20:19 Allow 8.8.8.8 ICMP
2020-01-10 13:20:19 Allow 192.168.42.254 icmp
2020-01-10 13:20:19 Allow 13.227.171.99 ICMP
2020-01-10 13:20:19 Allow 143.204.192.117 ICMP
2020-01-10 13:20:20 Allow 143.204.192.117 ICMP
2020-01-10 13:20:20 Allow 8.8.4.4 ICMP
2020-01-10 13:20:20 Allow 8.8.8.8 ICMP
2020-01-10 13:20:20 Allow 13.227.171.99 ICMP
2020-01-10 13:20:20 Allow 143.204.192.117 ICMP
2020-01-10 13:20:20 Allow 143.204.192.117 ICMP
2020-01-10 13:20:21 Allow 143.204.192.117 ICMP
2020-01-10 13:20:21 Allow 8.8.4.4 ICMP
2020-01-10 13:20:21 Allow 8.8.8.8 ICMP
2020-01-10 13:20:21 Allow 13.227.171.99 ICMP
2020-01-10 13:20:21 Allow 143.204.192.117 ICMP
2020-01-10 13:20:21 Allow 143.204.192.117 ICMP
2020-01-10 13:20:22 Allow 143.204.192.117 ICMP
2020-01-10 13:20:22 Allow 143.204.192.117 ICMP
2020-01-10 13:20:22 Allow 13.227.171.99 ICMP
2020-01-10 13:20:22 Allow 13.227.171.99 ICMP
2020-01-10 13:20:22 Allow 143.204.192.117 ICMP
2020-01-10 13:20:22 Allow 143.204.192.117 ICMP
2020-01-10 13:20:22 Allow 13.227.171.99 ICMP
2020-01-10 13:20:22 Allow 143.204.192.117 ICMP
2020-01-10 13:20:22 Allow 143.204.192.117 ICMP
2020-01-10 13:20:22 Allow 13.227.171.99 ICMP
2020-01-10 13:20:23 Allow 143.204.192.117 ICMP
2020-01-10 13:20:23 Allow 143.204.192.117 ICMP
2020-01-10 13:20:23 Allow 13.227.171.99 ICMP
2020-01-10 13:20:23 Allow 143.204.192.117 ICMP
2020-01-10 13:20:24 Allow 13.227.171.99 ICMP
2020-01-10 13:20:24 Allow 143.204.192.117 ICMP
2020-01-10 13:20:24 Allow 13.227.171.99 ICMP
2020-01-10 13:20:25 Allow 143.204.192.117 ICMP
2020-01-10 13:20:25 Allow 13.227.171.99 ICMP
2020-01-10 13:20:25 Allow 143.204.192.117 ICMP
2020-01-10 13:20:25 Allow 13.227.171.99 ICMP
2020-01-10 13:20:26 Allow 13.227.171.99 ICMP
2020-01-10 13:20:26 Allow 13.227.171.99 ICMP

Message 12 of 30
j0ebeer
Guide

Re: Orbi excessive pinging

Ran a search for both satellites with a 4 hour window and I got 7880 pings and only one destination IP, the default gw.  Running same search (4 hours) on the main Orbi I get 213 events and 8 destination IPs.  91 are going to the default gw but the rest look valid.  Definately should not be normal behaviour for any satellite AP.

 

Joe

Message 13 of 30
FURRYe38
Guru

Re: Orbi excessive pinging

I would file a support ticket and make contact with NG support about this:

https://www.netgear.com/mynetgear/registration/login.aspx

 


@j0ebeer wrote:

Ran a search for both satellites with a 4 hour window and I got 7880 pings and only one destination IP, the default gw.  Running same search (4 hours) on the main Orbi I get 213 events and 8 destination IPs.  91 are going to the default gw but the rest look valid.  Definately should not be normal behaviour for any satellite AP.

 

Joe


 

My Setup ISP SparkLight | Internet Cable 1000↓/50↑ CAX30 Mode Mode  | Wifi Router XR500 and RBK863 Router mode | Switches NG GS105/8, GS308v3, GS110MX and XS505M | Additional NG HW: C7800/CAX3/CAX80/CM1100/CM1200/CM2000, Orbi: CBK40, CBK752, RBK50, RBK853, RBK752, RBK953, SXK30 | NightHawk: MK63, R7000, R7800, R7960P, R8000, R8500, RAXE500, RAX120v2, RAX50v2, XR450/500/700/1000, EX7500/EX7700

Message 14 of 30
j0ebeer
Guide

Re: Orbi excessive pinging

Unfortunately it shows as out of support.  Can't even submit an email ticket.  Not impressive but it is what it is.

Message 15 of 30
dl42
Aspirant

Re: Orbi excessive pinging

I already have tickets on both these issues with support as I have just bought them.

Apart from completely irrelevant questions from support no answers in over a week.

Message 16 of 30
CrimpOn
Guru

Re: Orbi excessive pinging

I checked my capture file again.  My (one) satellite generated an ICMP to the gateway at least once a second, plus some "extra" here and there. Extrapolating to two satellites and 20 hours, I would expect to see more than (60sec/min * 60min/hr * 20hrs * 2 sats 😃 144,000 pings.  Yet the firewall logged only 40,000.  Either (a) I captured at an unusual time and the satellite does not ping at the same rate all the time, (2) the satellite ping rate is adjusted when the Orbi is not the gateway (AP mode), or (3) the firewall is not capturing all of the pings.  I cannot test AP mode.  Just a mystery to me.

 

"Normal behavior" in terms of WiFi access points pinging the gateway is also a mystery.  The first time I used Wireshark on my network, I was astounded at the amount of "chatter" going on.  Even though I have disabled IPv6, there are IPv6 packets flying around my network.  Devices are ARPing their brains out.  My Tivo's seem inordinately curious, broadcasting incessantly.  The WiFi access points are transmitting broadcasts several times a second (even the hidden 5G WiFi backhaul link). I am not even sure what Google search terms would produce a standards document (if there is one).

 

Replacing the Orbi with "something else" is sort of a crap shoot.  The only way to find out what other systems do is to plug them in and see what happens.  What happens if the next system does the same thing?  Try another.  The "bay" is going to fill up with WiFi systems.  (LOVE the San Francisco pun!)

 

Surely the firewall has whitelist rules to exclude things from capture and reporting.  That sounds (to me) like the most direct way to the end result, and also an additional "selling point."  "Suppose we know that our point of sales terminals constantly contact the bank system.  See how easy it is to not mark those connections as suspect."

I love my Orbi.
Message 17 of 30
FURRYe38
Guru

Re: Orbi excessive pinging

I tagged a couple of forum moderators. You can send them PMs and see if you can make contact with them about this. 


@j0ebeer wrote:

Unfortunately it shows as out of support.  Can't even submit an email ticket.  Not impressive but it is what it is.


 

My Setup ISP SparkLight | Internet Cable 1000↓/50↑ CAX30 Mode Mode  | Wifi Router XR500 and RBK863 Router mode | Switches NG GS105/8, GS308v3, GS110MX and XS505M | Additional NG HW: C7800/CAX3/CAX80/CM1100/CM1200/CM2000, Orbi: CBK40, CBK752, RBK50, RBK853, RBK752, RBK953, SXK30 | NightHawk: MK63, R7000, R7800, R7960P, R8000, R8500, RAXE500, RAX120v2, RAX50v2, XR450/500/700/1000, EX7500/EX7700

Message 18 of 30
dl42
Aspirant

Re: Orbi excessive pinging

After support continually suggesting it was something on my network doing this.......

I used telnet onto the device and looked around.

 

Here is the reason why.

there are process/scripts running on th devices doing this pinging.

5382 root 1572 S ping -c 5 www.netgear.com
7040 root 1572 S ping -c 5 www.netgear.com
7463 root 1572 S ping -c 5 www.netgear.com
9276 root 1572 S ping -c 5 www.netgear.com
9712 root 1572 S ping -c 5 www.netgear.com
11029 root 1572 S ping -c 5 www.netgear.com
11032 root 1568 S ping -c 5 8.8.8.8
11033 root 1568 S ping -c 5 8.8.4.4
11942 root 1572 S ping -c 5 www.netgear.com
11943 root 1568 S ping -c 5 8.8.8.8
11944 root 1568 S ping -c 5 8.8.4.4
12148 root 1572 S ping -c 1 www.netgear.com
12199 root 1568 S grep ping
17785 root 1588 S {ping-netgear} /bin/sh /sbin/ping-netgear
18127 root 1580 S {ping-gateway} /bin/sh /sbin/ping-gateway

 

I have politely pointed this out to support and re-asked the question - why?

I'm not holding my breath.

 

Message 19 of 30
FURRYe38
Guru

Re: Orbi excessive pinging

Good Luck. 

My Setup ISP SparkLight | Internet Cable 1000↓/50↑ CAX30 Mode Mode  | Wifi Router XR500 and RBK863 Router mode | Switches NG GS105/8, GS308v3, GS110MX and XS505M | Additional NG HW: C7800/CAX3/CAX80/CM1100/CM1200/CM2000, Orbi: CBK40, CBK752, RBK50, RBK853, RBK752, RBK953, SXK30 | NightHawk: MK63, R7000, R7800, R7960P, R8000, R8500, RAXE500, RAX120v2, RAX50v2, XR450/500/700/1000, EX7500/EX7700

Message 20 of 30
dl42
Aspirant

Re: Orbi excessive pinging

Lost the will to live with support!

Getting absolutely nowhere with them.

I do have a certain sympathy with the front line guys are they are clearly not being backed up by the higher levels of support/engineering when they do not have the information to answer the questions.

Message 21 of 30
FURRYe38
Guru

Re: Orbi excessive pinging

Try contacting one of the forum moderators.

@Blanca_O 

 

My Setup ISP SparkLight | Internet Cable 1000↓/50↑ CAX30 Mode Mode  | Wifi Router XR500 and RBK863 Router mode | Switches NG GS105/8, GS308v3, GS110MX and XS505M | Additional NG HW: C7800/CAX3/CAX80/CM1100/CM1200/CM2000, Orbi: CBK40, CBK752, RBK50, RBK853, RBK752, RBK953, SXK30 | NightHawk: MK63, R7000, R7800, R7960P, R8000, R8500, RAXE500, RAX120v2, RAX50v2, XR450/500/700/1000, EX7500/EX7700

Message 22 of 30
kwiebe
Aspirant

Re: Orbi excessive pinging

V2.3.5.26 RBS20

 

I just noticed this too.  Disturbing and it's not normal.  This needs to be fixed.

 

Did it get fixed in 2.5.1.16?

Message 23 of 30
FURRYe38
Guru

Re: Orbi excessive pinging

Somthiing to try for your self and see. I recommend a factory reset and setup from scratch. I would ping test with out the RBS and ALL other devices disconnected from the RBR. use just a wired PC to test with initially. 


@kwiebe wrote:

V2.3.5.26 RBS20

 

I just noticed this too.  Disturbing and it's not normal.  This needs to be fixed.

 

Did it get fixed in 2.5.1.16?


 

My Setup ISP SparkLight | Internet Cable 1000↓/50↑ CAX30 Mode Mode  | Wifi Router XR500 and RBK863 Router mode | Switches NG GS105/8, GS308v3, GS110MX and XS505M | Additional NG HW: C7800/CAX3/CAX80/CM1100/CM1200/CM2000, Orbi: CBK40, CBK752, RBK50, RBK853, RBK752, RBK953, SXK30 | NightHawk: MK63, R7000, R7800, R7960P, R8000, R8500, RAXE500, RAX120v2, RAX50v2, XR450/500/700/1000, EX7500/EX7700

Message 24 of 30
kwiebe
Aspirant

Re: Orbi excessive pinging

I was hoping to find out from someone already running the later firmware whether the ping behavior was still exhibited.  Seems like a reasonable inquiry.  Are you running the newer firmware FURRYe38?

Message 25 of 30
Discussion stats
  • 29 replies
  • 2093 views
  • 2 kudos
  • 5 in conversation
Announcements

Orbi WiFi 6E