Does anyone else see their Orbi satellites doing excessing pings to the default gateway? In my firewall log I am getting thousand of them and I don't know why. Or where to disable it.
Does anyone else see their Orbi satellites doing excessing pings to the default gateway? In my firewall log I am getting thousand of them and I don't know why. Or where to disable it.
Am interested in which "firewall log" this is. When Orbi is configured as a "router", it IS the gateway, and satellites never communicate past the Orbi. So, this Orbi must be configured as an Access Point, in which case every device on the network, including the satellites, gets an IP address from whatever device is using DHCP to assign IPs (the gateway?) One would expect that satellites would then do things like ARP requests, pings, etc. against the gateway. "Thousands" sounds like a lot, but I have been surprised at how "chatty" an ethernet network is.
What Firmware is currently loaded? What is the Mfr and model# of the ISP modem the NG router is connected too?
Firewall is latest on Main unit and satellites. Main is v2.3.5.30 and Sats are v2.3.5.26. The Main is not connected to a cable modem but my firewall instead.
Does anyone else see their Orbi satellites doing excessing pings to the default gateway? In my firewall log I am getting thousand of them and I don't know why. Or where to disable it.
Am interested in which "firewall log" this is. When Orbi is configured as a "router", it IS the gateway, and satellites never communicate past the Orbi. So, this Orbi must be configured as an Access Point, in which case every device on the network, including the satellites, gets an IP address from whatever device is using DHCP to assign IPs (the gateway?) One would expect that satellites would then do things like ARP requests, pings, etc. against the gateway. "Thousands" sounds like a lot, but I have been surprised at how "chatty" an ethernet network is.
The firewall log is my Fortinet sending logs into Splunk. From a search of the past 4 hours the 2 satellites have ping my FW gateway over 6500 times. My guess is its default behavior and I'm probably stuck with it. I would call it poor coding.
I just now captured my Orbi LAN traffic. My (one) satellite sends ICMP (ping) once per second to the Orbi router, which is also the "gateway". I believe that the default behavior when Orbi is providing DHCP is to provide the Orbi IP address as both the gateway and the DNS for every device on the network that gets an IP from the Orbi. 60 time/min * 60min/hr = 3,600 pings/hr per satellite. Two satellites = 7,200 pings/hr. Thus, my analysis does not match what the firewall is reporting. It should be seeing more than twice as much.
Yes, that sounds like "a lot". On the other hand, we're talking about gig ethernet, so the actual portion of total bandwidth consumed is not "large".
I am still wondering how the firewall is capturing these pings. Is the firewall the "gateway"? Which device is providing DHCP?
I'm running RBK13 in AP mode and I see the same high volume of pings on the gateway. Orbi is not acting as dhcp server in my environment.
I also see a large number of pings to external IP addresses. I have support cases open on these but have not had any responses.
Since the Orbi is in AP mode, I believe it is entirely "normal" for the router and satellites to ping the gateway. To us, once a second may seem excessive, but I have no idea what internet "standards" are for that kind of "keep alive" behavior.
Pings to external addresses are a different matter. Are those from the Orbi equipment?
I don't consider this "normal" for any manufacuter. For me it is only the 2 Orbi satellites I have and they are only pinging the default gateway given by the dhcp server of my firewall. I only started capturing the logs into Splunk yesterday but for 20 hours I show over 40,000 pings (screenshot attached) from the 2 sats. Is it impacting my home network performance, probably not. But does it need to be this excessive? I am a security sales engineer and when I do demos I now have to filter out this excessive garbage so it doesn't skew graphs and reports. Bit annoying.
Hopefully someone from Netgear sees this and can comment. Otherwise I'll be looking to toss the system onto ebay.
Ran a search for both satellites with a 4 hour window and I got 7880 pings and only one destination IP, the default gw. Running same search (4 hours) on the main Orbi I get 213 events and 8 destination IPs. 91 are going to the default gw but the rest look valid. Definately should not be normal behaviour for any satellite AP.
Ran a search for both satellites with a 4 hour window and I got 7880 pings and only one destination IP, the default gw. Running same search (4 hours) on the main Orbi I get 213 events and 8 destination IPs. 91 are going to the default gw but the rest look valid. Definately should not be normal behaviour for any satellite AP.
I checked my capture file again. My (one) satellite generated an ICMP to the gateway at least once a second, plus some "extra" here and there. Extrapolating to two satellites and 20 hours, I would expect to see more than (60sec/min * 60min/hr * 20hrs * 2 sats 😃 144,000 pings. Yet the firewall logged only 40,000. Either (a) I captured at an unusual time and the satellite does not ping at the same rate all the time, (2) the satellite ping rate is adjusted when the Orbi is not the gateway (AP mode), or (3) the firewall is not capturing all of the pings. I cannot test AP mode. Just a mystery to me.
"Normal behavior" in terms of WiFi access points pinging the gateway is also a mystery. The first time I used Wireshark on my network, I was astounded at the amount of "chatter" going on. Even though I have disabled IPv6, there are IPv6 packets flying around my network. Devices are ARPing their brains out. My Tivo's seem inordinately curious, broadcasting incessantly. The WiFi access points are transmitting broadcasts several times a second (even the hidden 5G WiFi backhaul link). I am not even sure what Google search terms would produce a standards document (if there is one).
Replacing the Orbi with "something else" is sort of a crap shoot. The only way to find out what other systems do is to plug them in and see what happens. What happens if the next system does the same thing? Try another. The "bay" is going to fill up with WiFi systems. (LOVE the San Francisco pun!)
Surely the firewall has whitelist rules to exclude things from capture and reporting. That sounds (to me) like the most direct way to the end result, and also an additional "selling point." "Suppose we know that our point of sales terminals constantly contact the bank system. See how easy it is to not mark those connections as suspect."
I do have a certain sympathy with the front line guys are they are clearly not being backed up by the higher levels of support/engineering when they do not have the information to answer the questions.
Somthiing to try for your self and see. I recommend a factory reset and setup from scratch. I would ping test with out the RBS and ALL other devices disconnected from the RBR. use just a wired PC to test with initially.
I was hoping to find out from someone already running the later firmware whether the ping behavior was still exhibited. Seems like a reasonable inquiry. Are you running the newer firmware FURRYe38?
