Windows Firewall log shows insane amount of ICMP SEND/RECEIVE requests. Normal?

Question

I was checking my Windows Firewall logs after receiving a website notice that my connection was banned for sending too many requests, and noticed the following entries:

    2017-05-18 03:39:23 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - RECEIVE
    2017-05-18 03:39:24 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - SEND
    2017-05-18 03:39:24 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - RECEIVE
    2017-05-18 03:39:25 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - SEND
    2017-05-18 03:39:25 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - RECEIVE
    2017-05-18 03:39:26 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - SEND
    2017-05-18 03:39:26 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - RECEIVE
    2017-05-18 03:39:27 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - SEND
    2017-05-18 03:39:27 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - RECEIVE
    2017-05-18 03:39:28 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - SEND
    2017-05-18 03:39:28 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - RECEIVE
    2017-05-18 03:39:29 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - SEND
    2017-05-18 03:39:29 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - RECEIVE
    2017-05-18 03:39:30 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - SEND
    2017-05-18 03:39:30 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - RECEIVE
    2017-05-18 03:39:31 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - SEND
    2017-05-18 03:39:31 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - RECEIVE
    2017-05-18 03:39:32 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - SEND
    2017-05-18 03:39:32 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - RECEIVE
    2017-05-18 03:39:33 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - SEND
    2017-05-18 03:39:33 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - RECEIVE
    2017-05-18 03:39:34 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - SEND
    2017-05-18 03:39:34 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - RECEIVE
    2017-05-18 03:39:35 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - SEND
    2017-05-18 03:39:35 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - RECEIVE
    2017-05-18 03:39:36 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - SEND
    2017-05-18 03:39:36 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - RECEIVE
    2017-05-18 03:39:37 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - SEND
    2017-05-18 03:39:37 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - RECEIVE
    2017-05-18 03:39:38 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - SEND
    2017-05-18 03:39:38 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - RECEIVE
    2017-05-18 03:39:39 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - SEND
    2017-05-18 03:39:39 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - RECEIVE
    2017-05-18 03:39:40 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - SEND
    2017-05-18 03:39:40 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - RECEIVE
    2017-05-18 03:39:41 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - SEND
    2017-05-18 03:39:41 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - RECEIVE
    2017-05-18 03:39:42 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - SEND
    2017-05-18 03:39:42 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - RECEIVE
    2017-05-18 03:39:43 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - SEND
    2017-05-18 03:39:43 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - RECEIVE
    2017-05-18 03:39:44 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - SEND
    2017-05-18 03:39:44 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - RECEIVE
    2017-05-18 03:39:45 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - SEND
    2017-05-18 03:39:45 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - RECEIVE
    2017-05-18 03:39:46 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - SEND
    2017-05-18 03:39:46 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - RECEIVE
    2017-05-18 03:39:47 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - SEND
    2017-05-18 03:39:47 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - RECEIVE
    2017-05-18 03:39:48 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - SEND
    2017-05-18 03:39:48 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - RECEIVE
    2017-05-18 03:39:49 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - SEND
    2017-05-18 03:39:49 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - RECEIVE
    2017-05-18 03:39:50 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - SEND
    2017-05-18 03:39:50 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - RECEIVE
    2017-05-18 03:39:51 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - SEND
    2017-05-18 03:39:51 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - RECEIVE
    2017-05-18 03:39:52 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - SEND
    2017-05-18 03:39:52 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - RECEIVE
    2017-05-18 03:39:53 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - SEND
    2017-05-18 03:39:53 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - RECEIVE
    2017-05-18 03:39:54 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - SEND
    2017-05-18 03:39:54 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - RECEIVE
    2017-05-18 03:39:55 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - SEND
    2017-05-18 03:39:55 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - RECEIVE
    2017-05-18 03:39:56 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - SEND
    2017-05-18 03:39:56 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - RECEIVE
    2017-05-18 03:39:57 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - SEND
    2017-05-18 03:39:57 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - RECEIVE
    2017-05-18 03:39:57 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - SEND
    2017-05-18 03:39:57 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - RECEIVE
    2017-05-18 03:39:58 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - SEND
    2017-05-18 03:39:58 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - RECEIVE
    2017-05-18 03:39:59 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - SEND
    2017-05-18 03:39:59 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - RECEIVE
    2017-05-18 03:40:00 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - SEND
    2017-05-18 03:40:00 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - RECEIVE
    2017-05-18 03:40:01 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - SEND
    2017-05-18 03:40:01 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - RECEIVE
    2017-05-18 03:40:02 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - SEND
    2017-05-18 03:40:02 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - RECEIVE
    2017-05-18 03:40:03 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - SEND
    2017-05-18 03:40:03 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - RECEIVE
    2017-05-18 03:40:04 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - SEND
    2017-05-18 03:40:04 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - RECEIVE
    2017-05-18 03:40:05 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - SEND
    2017-05-18 03:40:05 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - RECEIVE
    2017-05-18 03:40:06 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - SEND
    2017-05-18 03:40:06 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - RECEIVE
    2017-05-18 03:40:07 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - SEND
    2017-05-18 03:40:07 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - RECEIVE
    2017-05-18 03:40:08 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - SEND
    2017-05-18 03:40:08 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - RECEIVE
    2017-05-18 03:40:09 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - SEND
    2017-05-18 03:40:09 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - RECEIVE
    2017-05-18 03:40:10 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - SEND
    2017-05-18 03:40:10 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - RECEIVE

Is this normal or is something fishy going on?

/copyitright

The source and destination both appear to be localhost, which does seem odd, but I'm doubtful this is the cause of the issue you're dealing with. — joeqwerty, May 18, 2017 at 11:14
Thank you for your input joeqwerty. I still want to figure out what's causing this though. Back to the drawing board i guess ;-) ;-( — script'n'code, May 18, 2017 at 14:32

SDsolar · Accepted Answer · 2017-05-18 07:56:46Z

0

That may actually be normal, however if it concerns you then you will want to go into your firewall and cut off ICMP entirely.

Clearly something inside your firewall is generating these outbound requests, and that is what can get you banned.

Incoming requests are outside of your control except that you can cause your system to not respond.

Seeing this, it might be instructive for you to run ShieldsUp! over at http://www.grc.com to see what ports are open on your side. (Just click through until you get to the page that says you can search "All Service Ports" then see what it responds with. It is a good guide to tweaking your firewall.

If you are unsure about how to control the firewall (and it might be as dangerous as Regedit if you don't do it right), then use Google to find others who have solved this.

answered May 18, 2017 at 7:56

SDsolar

1551 gold badge1 silver badge11 bronze badges

Hi SDsolar, i know grc.com so i'll definetely give that a go :-) I must say that i've never really bothered with M$'s firewall or its logs but after the ban incident i wanted to check on some things and that's when i found out about the local ICMP requests. They look very odd to me and i initially thought (well, still...) it was due to a messed up routing table. I'll keep you guys posted ;-)
– script'n'code
May 18, 2017 at 14:39
GRC ShieldsUP result: i.imgur.com/qUwa66Y.png The opened port is in use by my HTTPS/SSL (TLS) web server
– script'n'code
May 18, 2017 at 15:41

Add a comment |

Stack Exchange Network

Windows Firewall log shows insane amount of ICMP SEND/RECEIVE requests. Normal?

1 Answer 1

Your Answer

Not the answer you're looking for? Browse other questions tagged
spam
icmp
requests
or ask your own question.

Hot Network Questions

Windows Firewall log shows insane amount of ICMP SEND/RECEIVE requests. Normal?

1 Answer 1

Your Answer

Sign up or log in

Post as a guest

Not the answer you're looking for? Browse other questions tagged spamicmprequests or ask your own question.

Related

Hot Network Questions

Not the answer you're looking for? Browse other questions tagged
spam
icmp
requests
or ask your own question.