Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

is it normal for AD authentication between a workstation and AD server to generate a lot of ICMP traffic? I have a network intrusion prevention in place that is constantly detecting huge amount of ICMP / ping traffic from AD to workstation; vice versa. So much so that it detects them as 'flood' attack.

I've checked on both the AD and workstation both seems to be fine. No trojans, viruses, malware and the endpoint protection is working fine.

Any opinions on this kind of behavior? Possible false positives?

share|improve this question
1  
Please don't cross-post. Mm'kay? security.stackexchange.com/q/16769/618 –  Scott Pack Jul 3 '12 at 16:48

3 Answers 3

There really shouldn't be much ICMP traffic during a typical client logon to AD. It is really only used for slow link detection, and it's hardly enough to trigger an ICMP flood alert on most sane IPS systems.

Do you have any logon scripts that have ping loops to make sure that servers and the client network link are up before accessing network resources? That's a pretty common trick, and could cause the behavior that you're seeing.

share|improve this answer
    
About logon scripts, I doubt there is any. But good point. I'll check with our technical services guys on this. The slow link detection makes sense as it is mostly triggered by workstations in branch level. Also a quick question. For slow link detection, is the communication 2 way? As in AD sends ICMP packets to the workstations and the workstations will in turn reply back with ICMP packets as well? Thanks. –  JoeST Jul 3 '12 at 16:22
    
@JoeST Yeah, that's how the detection works. It measures the round trip time of three sets of ICMP echos. Then, uses that time to determine the link speed. –  MDMarra Jul 3 '12 at 16:24

You might be seeing the slow link detection that group policy does. It will transmit very large icmp packets that end up getting fragmented to determine if the user is logging in over a slow link or not.

Check out:

http://support.microsoft.com/kb/227260

and

http://technet.microsoft.com/en-us/library/cc781031(v=ws.10).aspx

share|improve this answer
2  
Just for completeness, it should be noted that Windows 7/Vista no longer use ICMP during slow link detection. support.microsoft.com/kb/2008977 –  Greg Askew Jul 3 '12 at 17:13

Perhaps your AD server is also your DHCP server?

It is common for a DHCP server to ping addresses before offering them up as new leases.

http://technet.microsoft.com/en-us/library/dd380200(v=ws.10).aspx

However, this shouldn't generate too many packets. (Though if you have very low lease times and a lot of turn over, it could show up.)

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.