Vyos send huge ICMP request

General questions
1

Hi,

Why vyos sending huge ICMP request to Public IP even no one do ping test to that IP

vyos@R1:~$ sudo tcpdump -n -i eth0 host 210.x.x.x
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
14:29:02.009509 IP 211.x.x.x > 210.x.x.x: ICMP echo request, id 38329, seq 41890, length 44
14:29:02.062476 IP 211.x.x.x > 210.x.x.x: ICMP echo request, id 38329, seq 42146, length 44
14:29:02.115773 IP 211.x.x.x > 210.x.x.x: ICMP echo request, id 38329, seq 42402, length 44
14:29:02.168700 IP 211.x.x.x > 210.x.x.x: ICMP echo request, id 38329, seq 42658, length 44
14:29:02.221624 IP 211.x.x.x > 210.x.x.x: ICMP echo request, id 38329, seq 42914, length 44
14:29:02.274630 IP 211.x.x.x > 210.x.x.x: ICMP echo request, id 38329, seq 43170, length 44
14:29:02.327570 IP 211.x.x.x > 210.x.x.x: ICMP echo request, id 38329, seq 43426, length 44
14:29:02.380438 IP 211.x.x.x > 210.x.x.x: ICMP echo request, id 38329, seq 43682, length 44
14:29:02.433273 IP 211.x.x.x > 210.x.x.x: ICMP echo request, id 38329, seq 43938, length 44
14:29:02.486208 IP 211.x.x.x > 210.x.x.x: ICMP echo request, id 38329, seq 44194, length 44
14:29:02.539098 IP 211.x.x.x > 210.x.x.x: ICMP echo request, id 38329, seq 44450, length 44
14:29:02.592025 IP 211.x.x.x > 210.x.x.x: ICMP echo request, id 38329, seq 44706, length 44
14:29:02.644965 IP 211.x.x.x > 210.x.x.x: ICMP echo request, id 38329, seq 44962, length 44
14:29:02.697947 IP 211.x.x.x > 210.x.x.x: ICMP echo request, id 38329, seq 45218, length 44
14:29:02.751004 IP 211.x.x.x > 210.x.x.x: ICMP echo request, id 38329, seq 45474, length 44
14:29:02.803913 IP 211.x.x.x > 210.x.x.x: ICMP echo request, id 38329, seq 45730, length 44
14:29:02.856884 IP 211.x.x.x > 210.x.x.x: ICMP echo request, id 38329, seq 45986, length 44
14:29:02.909783 IP 211.x.x.x > 210.x.x.x: ICMP echo request, id 38329, seq 46242, length 44
14:29:02.962677 IP 211.x.x.x > 210.x.x.x: ICMP echo request, id 38329, seq 46498, length 44
14:29:03.006615 IP 211.x.x.x > 210.x.x.x: ICMP echo request, id 38329, seq 46754, length 44

211 is my ip and 210 is other peer IP. We establised VPN IPsec and recently its down. During troubleshoot I found huge ICMP packet were sent via my Public interface and sometimes its stop.

2

By huge you mean multiple ICMP echo requests and not large ICMP packets? Length 44 should indicate a 36 byte ICMP packet.

3

Sorry my mistake. Yes it sending huge ICMP echo request. Is this normal?

4

VyOS itself does not send any ICMP echo’s
Check your scripts or find which process is sending it, or maybe someone from the LAN network does it.