is it normal for AD authentication between a workstation and AD server to generate a lot of ICMP traffic? I have a network intrusion prevention in place that is constantly detecting huge amount of ICMP / ping traffic from AD to workstation; vice versa. So much so that it detects them as 'flood' attack.
I've checked on both the AD and workstation both seems to be fine. No trojans, viruses, malware and the endpoint protection is working fine.
Any opinions on this kind of behavior? Possible false positives?