× NETGEAR is aware of a growing number of phone and online scams. To learn how to stay safe click here.
Orbi WiFi 7 RBE973
Reply

Orbi satellite pinging: 1.0.254.169

jfitty
Aspirant

Orbi satellite pinging: 1.0.254.169

Does anyone know why my Orbi is trying to ping: 1.0.254.169 and also why it is trying to FTP to Ireland at 52.208.82.166?

Message 1 of 10
FURRYe38
Guru

Re: Orbi satellite pinging: 1.0.254.169

What model RBS and RBR do you have? 

What Firmware version is currently loaded?

 

Do you have anything connected behind the RBS? 

Message 2 of 10
jfitty
Aspirant

Re: Orbi satellite pinging: 1.0.254.169

Orbi Hardware version: RBR50

Running firmware: V2.5.1.16

It is in access point mode

I have an enterprise network firewall acting as my router and is giving the visibility as to what the network traffic from the router is generated.  

I am also seeing that there is a good amount of traffic going to AWS for a URL for IoT on port 8883. 

Model: RBR50|Orbi AC3000 Tri-band WiFi Router
Message 3 of 10
FURRYe38
Guru

Re: Orbi satellite pinging: 1.0.254.169

Do you have anything connected behind the RBS? 

Whois that IP address belonging too?

 

Message 4 of 10
jfitty
Aspirant

Re: Orbi satellite pinging: 1.0.254.169

I keep trying to respond, but my replies are not showing up... the whois shows the IP is registered to Thailand it says it is registered to Dynamic IP Address for residential broadband customers

Message 5 of 10
jfitty
Aspirant

Re: Orbi satellite pinging: 1.0.254.169

The AWS IoT traffic is going to the US AWS address space on port 8883

The FTP traffic is going to AWS address space in Ireland and is using default FTP credentials.

Model: RBR50|Orbi AC3000 Tri-band WiFi Router
Message 6 of 10
CrimpOn
Guru

Re: Orbi satellite pinging: 1.0.254.169


@jfitty wrote:

Orbi Hardware version: RBR50

Running firmware: V2.5.1.16

It is in access point mode

I have an enterprise network firewall acting as my router and is giving the visibility as to what the network traffic from the router is generated.  

I am also seeing that there is a good amount of traffic going to AWS for a URL for IoT on port 8883. 


Well, this is unusual.  I have collected every packet that passes through my Orbi router for hours and the satellite appears to ping only the router.  My Orbi is in router mode, but it is hard to imagine the satellite behaving differently no matter what the router mode is.

 

The firewall definitely shows these ICMP packets coming from the IP address of the Orbi satellite?

Message 7 of 10
jfitty
Aspirant

Re: Orbi satellite pinging: 1.0.254.169

Yes, it is definitely ICMP and it seems to be 50 packets each time.  They tried to ping the same IP 19 times since 6/10 and today is 7/1.  It is both of my satellites that are pinging this IP.

Model: RBR50|Orbi AC3000 Tri-band WiFi Router
Message 8 of 10
CrimpOn
Guru

Re: Orbi satellite pinging: 1.0.254.169

Does the firewall report a "pattern" in what time of day these pings happen?

 

There are some linux commands that will indicate which process is using ports, but I am not sophisticated enough to know how to capture a historical record over a period of time.

Message 9 of 10
jfitty
Aspirant

Re: Orbi satellite pinging: 1.0.254.169

No, there is no obious pattern.  Here is from one sattellite:

2020/06/29 10:26:11
2020/06/19 14:38:02
2020/06/18 07:54:49
2020/06/18 07:54:44
2020/06/17 22:15:07
2020/06/17 22:15:02
2020/06/15 09:14:15
2020/06/15 09:14:10
2020/06/14 05:06:14
2020/06/10 18:09:23

Model: RBR50|Orbi AC3000 Tri-band WiFi Router
Message 10 of 10
Top Contributors
Discussion stats
  • 9 replies
  • 1365 views
  • 0 kudos
  • 3 in conversation
Announcements

Orbi WiFi 7