0

I was checking my Windows Firewall logs after receiving a website notice that my connection was banned for sending too many requests, and noticed the following entries:

    2017-05-18 03:39:23 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - RECEIVE
    2017-05-18 03:39:24 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - SEND
    2017-05-18 03:39:24 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - RECEIVE
    2017-05-18 03:39:25 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - SEND
    2017-05-18 03:39:25 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - RECEIVE
    2017-05-18 03:39:26 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - SEND
    2017-05-18 03:39:26 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - RECEIVE
    2017-05-18 03:39:27 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - SEND
    2017-05-18 03:39:27 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - RECEIVE
    2017-05-18 03:39:28 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - SEND
    2017-05-18 03:39:28 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - RECEIVE
    2017-05-18 03:39:29 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - SEND
    2017-05-18 03:39:29 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - RECEIVE
    2017-05-18 03:39:30 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - SEND
    2017-05-18 03:39:30 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - RECEIVE
    2017-05-18 03:39:31 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - SEND
    2017-05-18 03:39:31 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - RECEIVE
    2017-05-18 03:39:32 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - SEND
    2017-05-18 03:39:32 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - RECEIVE
    2017-05-18 03:39:33 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - SEND
    2017-05-18 03:39:33 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - RECEIVE
    2017-05-18 03:39:34 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - SEND
    2017-05-18 03:39:34 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - RECEIVE
    2017-05-18 03:39:35 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - SEND
    2017-05-18 03:39:35 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - RECEIVE
    2017-05-18 03:39:36 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - SEND
    2017-05-18 03:39:36 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - RECEIVE
    2017-05-18 03:39:37 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - SEND
    2017-05-18 03:39:37 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - RECEIVE
    2017-05-18 03:39:38 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - SEND
    2017-05-18 03:39:38 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - RECEIVE
    2017-05-18 03:39:39 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - SEND
    2017-05-18 03:39:39 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - RECEIVE
    2017-05-18 03:39:40 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - SEND
    2017-05-18 03:39:40 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - RECEIVE
    2017-05-18 03:39:41 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - SEND
    2017-05-18 03:39:41 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - RECEIVE
    2017-05-18 03:39:42 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - SEND
    2017-05-18 03:39:42 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - RECEIVE
    2017-05-18 03:39:43 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - SEND
    2017-05-18 03:39:43 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - RECEIVE
    2017-05-18 03:39:44 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - SEND
    2017-05-18 03:39:44 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - RECEIVE
    2017-05-18 03:39:45 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - SEND
    2017-05-18 03:39:45 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - RECEIVE
    2017-05-18 03:39:46 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - SEND
    2017-05-18 03:39:46 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - RECEIVE
    2017-05-18 03:39:47 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - SEND
    2017-05-18 03:39:47 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - RECEIVE
    2017-05-18 03:39:48 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - SEND
    2017-05-18 03:39:48 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - RECEIVE
    2017-05-18 03:39:49 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - SEND
    2017-05-18 03:39:49 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - RECEIVE
    2017-05-18 03:39:50 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - SEND
    2017-05-18 03:39:50 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - RECEIVE
    2017-05-18 03:39:51 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - SEND
    2017-05-18 03:39:51 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - RECEIVE
    2017-05-18 03:39:52 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - SEND
    2017-05-18 03:39:52 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - RECEIVE
    2017-05-18 03:39:53 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - SEND
    2017-05-18 03:39:53 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - RECEIVE
    2017-05-18 03:39:54 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - SEND
    2017-05-18 03:39:54 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - RECEIVE
    2017-05-18 03:39:55 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - SEND
    2017-05-18 03:39:55 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - RECEIVE
    2017-05-18 03:39:56 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - SEND
    2017-05-18 03:39:56 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - RECEIVE
    2017-05-18 03:39:57 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - SEND
    2017-05-18 03:39:57 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - RECEIVE
    2017-05-18 03:39:57 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - SEND
    2017-05-18 03:39:57 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - RECEIVE
    2017-05-18 03:39:58 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - SEND
    2017-05-18 03:39:58 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - RECEIVE
    2017-05-18 03:39:59 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - SEND
    2017-05-18 03:39:59 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - RECEIVE
    2017-05-18 03:40:00 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - SEND
    2017-05-18 03:40:00 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - RECEIVE
    2017-05-18 03:40:01 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - SEND
    2017-05-18 03:40:01 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - RECEIVE
    2017-05-18 03:40:02 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - SEND
    2017-05-18 03:40:02 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - RECEIVE
    2017-05-18 03:40:03 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - SEND
    2017-05-18 03:40:03 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - RECEIVE
    2017-05-18 03:40:04 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - SEND
    2017-05-18 03:40:04 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - RECEIVE
    2017-05-18 03:40:05 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - SEND
    2017-05-18 03:40:05 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - RECEIVE
    2017-05-18 03:40:06 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - SEND
    2017-05-18 03:40:06 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - RECEIVE
    2017-05-18 03:40:07 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - SEND
    2017-05-18 03:40:07 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - RECEIVE
    2017-05-18 03:40:08 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - SEND
    2017-05-18 03:40:08 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - RECEIVE
    2017-05-18 03:40:09 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - SEND
    2017-05-18 03:40:09 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - RECEIVE
    2017-05-18 03:40:10 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - SEND
    2017-05-18 03:40:10 ALLOW ICMP 127.0.0.1 127.0.0.1 - - 0 - - - - 8 0 - RECEIVE

Is this normal or is something fishy going on?

/copyitright

  • The source and destination both appear to be localhost, which does seem odd, but I'm doubtful this is the cause of the issue you're dealing with. – joeqwerty May 18 '17 at 11:14
  • Thank you for your input joeqwerty. I still want to figure out what's causing this though. Back to the drawing board i guess ;-) ;-( – script'n'code May 18 '17 at 14:32
0

That may actually be normal, however if it concerns you then you will want to go into your firewall and cut off ICMP entirely.

Clearly something inside your firewall is generating these outbound requests, and that is what can get you banned.

Incoming requests are outside of your control except that you can cause your system to not respond.

Seeing this, it might be instructive for you to run ShieldsUp! over at http://www.grc.com to see what ports are open on your side. (Just click through until you get to the page that says you can search "All Service Ports" then see what it responds with. It is a good guide to tweaking your firewall.

If you are unsure about how to control the firewall (and it might be as dangerous as Regedit if you don't do it right), then use Google to find others who have solved this.

| improve this answer | |
  • Hi SDsolar, i know grc.com so i'll definetely give that a go :-) I must say that i've never really bothered with M$'s firewall or its logs but after the ban incident i wanted to check on some things and that's when i found out about the local ICMP requests. They look very odd to me and i initially thought (well, still...) it was due to a messed up routing table. I'll keep you guys posted ;-) – script'n'code May 18 '17 at 14:39
  • GRC ShieldsUP result: i.imgur.com/qUwa66Y.png The opened port is in use by my HTTPS/SSL (TLS) web server – script'n'code May 18 '17 at 15:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.