Question on ICMP inspection ASA 5505

[Mike Hinson]

I checked under our service policy in March and the icmp packets were at 13,743

Inspect: icmp, packet 13743, drop 0, reset-drop 0

I checked it again today and its now at 1,608,004

Inspect: icmp, packet 1608004, drop 24, reset-drop 0

Anybody know what could have caused the ICMP packets to jump that high in a few months? I don't think anything's been added to go through that firewall.

[Marius Gunnerud]

That is quite a jump, but would't say it is cause for concern. had it been an attack that number would be much higher than what it is over that period of time.

But to find out what is going on I would suggest checking the logs for ICMP traffic and see if there are some IPs that repeatedly appear and then inspect those PCs.

..

Please remember to select a correct answer and rate helpful posts