topic Re: Scan traffic from Germany in Internet

Scan traffic from Germany

petru_garstea — Thu, 21 Dec 2023 13:59:15 GMT

Hi Bell,
There are a huge amount of the network flows originated from Germany. Basically these flows are scanning the router.

I issued a few abuse emails against the ISP who owns the IP block but I have never received any replies.

Can Bell do anything for instance to warn the ISP from where these flows are originated ?

Re: Scan traffic from Germany

Vanadiel — Thu, 21 Dec 2023 15:40:38 GMT

Looks like Ubiquiti information. Could be legitimate traffic to a client. Typically scans are only small amounts of data, and that looks like large amounts of data compared to the rest of the clients.

If it's Ubiquiti you should be able to see a list of clients, and the corresponding amount of data transfer and type.

Re: Scan traffic from Germany

petru_garstea — Thu, 21 Dec 2023 17:00:09 GMT

Greetings @Vanadiel

This information is exported by a PF firewall from a custom router and the report is generated by Graylog.

These are flows collected from the last 1 week, it shows the number of blocked traffic by the firewall.

When I rebooted the firewall it got another IP and the amount of blocked traffic has been reduced.

Regards