Router pings Finland after upgrade to firmware 8.2

Product Discussion Peplink Balance
,
1

Balance 20x was just upgraded to firmware 8.2 now regularly pings Finland. It did not do this with firmware 8.1.2. A firewall log excerpt is below showing 3 pings every hour. The IP address 185.20.137.140 seems to be at UpCloud in Finland. The router could not possibly be further from Finland without being on Mars. Sherlock Holmes tells me this IP address is associated with Speed Fusion. Is this true? The router is not using Speed Fusion.

This was only caught because IP started with 185. Possibly other IPs are also being contacted.

Mar 17 11:00:06 Firewall: Denied DST=185.20.137.140 LEN=84 TOS=0x00 PREC=0x00 TTL=63 ID=7926 PROTO=ICMP TYPE=8 ID=798 SEQ=3
Mar 17 11:00:06 Firewall: Denied DST=185.20.137.140 LEN=84 TOS=0x00 PREC=0x00 TTL=63 ID=7914 PROTO=ICMP TYPE=8 ID=798 SEQ=2
Mar 17 11:00:06 Firewall: Denied DST=185.20.137.140 LEN=84 TOS=0x00 PREC=0x00 TTL=63 ID=7906 PROTO=ICMP TYPE=8 ID=798 SEQ=1
Mar 17 10:00:06 Firewall: Denied DST=185.20.137.140 LEN=84 TOS=0x00 PREC=0x00 TTL=63 ID=55136 PROTO=ICMP TYPE=8 ID=30642 SEQ=3
Mar 17 10:00:06 Firewall: Denied DST=185.20.137.140 LEN=84 TOS=0x00 PREC=0x00 TTL=63 ID=55134 PROTO=ICMP TYPE=8 ID=30642 SEQ=2
Mar 17 10:00:06 Firewall: Denied DST=185.20.137.140 LEN=84 TOS=0x00 PREC=0x00 TTL=63 ID=55122 PROTO=ICMP TYPE=8 ID=30642 SEQ=1
Mar 17 08:00:06 Firewall: Denied DST=185.20.137.140 LEN=84 TOS=0x00 PREC=0x00 TTL=63 ID=543 PROTO=ICMP TYPE=8 ID=25514 SEQ=3
Mar 17 08:00:06 Firewall: Denied DST=185.20.137.140 LEN=84 TOS=0x00 PREC=0x00 TTL=63 ID=524 PROTO=ICMP TYPE=8 ID=25514 SEQ=2
Mar 17 08:00:06 Firewall: Denied DST=185.20.137.140 LEN=84 TOS=0x00 PREC=0x00 TTL=63 ID=510 PROTO=ICMP TYPE=8 ID=25514 SEQ=1
Mar 17 06:30:27 Firewall: Denied DST=185.20.137.140 LEN=84 TOS=0x00 PREC=0x00 TTL=63 ID=36184 PROTO=ICMP TYPE=8 ID=5838 SEQ=3
Mar 17 06:30:27 Firewall: Denied DST=185.20.137.140 LEN=84 TOS=0x00 PREC=0x00 TTL=63 ID=36176 PROTO=ICMP TYPE=8 ID=5838 SEQ=2
Mar 17 06:30:26 Firewall: Denied DST=185.20.137.140 LEN=84 TOS=0x00 PREC=0x00 TTL=63 ID=36175 PROTO=ICMP TYPE=8 ID=5838 SEQ=1
Mar 17 06:00:06 Firewall: Denied DST=185.20.137.140 LEN=84 TOS=0x00 PREC=0x00 TTL=63 ID=5944 PROTO=ICMP TYPE=8 ID=13571 SEQ=3
Mar 17 06:00:06 Firewall: Denied DST=185.20.137.140 LEN=84 TOS=0x00 PREC=0x00 TTL=63 ID=5932 PROTO=ICMP TYPE=8 ID=13571 SEQ=2
Mar 17 06:00:06 Firewall: Denied DST=185.20.137.140 LEN=84 TOS=0x00 PREC=0x00 TTL=63 ID=5919 PROTO=ICMP TYPE=8 ID=13571 SEQ=1
Mar 17 05:00:06 Firewall: Denied DST=185.20.137.140 LEN=84 TOS=0x00 PREC=0x00 TTL=63 ID=3093 PROTO=ICMP TYPE=8 ID=10219 SEQ=3
Mar 17 05:00:06 Firewall: Denied DST=185.20.137.140 LEN=84 TOS=0x00 PREC=0x00 TTL=63 ID=3077 PROTO=ICMP TYPE=8 ID=10219 SEQ=2
Mar 17 05:00:06 Firewall: Denied DST=185.20.137.140 LEN=84 TOS=0x00 PREC=0x00 TTL=63 ID=3066 PROTO=ICMP TYPE=8 ID=10219 SEQ=1
Mar 17 04:00:06 Firewall: Denied DST=185.20.137.140 LEN=84 TOS=0x00 PREC=0x00 TTL=63 ID=27385 PROTO=ICMP TYPE=8 ID=7584 SEQ=3
Mar 17 04:00:06 Firewall: Denied DST=185.20.137.140 LEN=84 TOS=0x00 PREC=0x00 TTL=63 ID=27369 PROTO=ICMP TYPE=8 ID=7584 SEQ=2
Mar 17 04:00:06 Firewall: Denied DST=185.20.137.140 LEN=84 TOS=0x00 PREC=0x00 TTL=63 ID=27365 PROTO=ICMP TYPE=8 ID=7584 SEQ=1
Mar 17 03:00:06 Firewall: Denied DST=185.20.137.140 LEN=84 TOS=0x00 PREC=0x00 TTL=63 ID=30743 PROTO=ICMP TYPE=8 ID=5056 SEQ=3
Mar 17 03:00:06 Firewall: Denied DST=185.20.137.140 LEN=84 TOS=0x00 PREC=0x00 TTL=63 ID=30741 PROTO=ICMP TYPE=8 ID=5056 SEQ=2
Mar 17 03:00:05 Firewall: Denied DST=185.20.137.140 LEN=84 TOS=0x00 PREC=0x00 TTL=63 ID=30723 PROTO=ICMP TYPE=8 ID=5056 SEQ=1
Mar 17 02:00:06 Firewall: Denied DST=185.20.137.140 LEN=84 TOS=0x00 PREC=0x00 TTL=63 ID=10468 PROTO=ICMP TYPE=8 ID=2551 SEQ=3
Mar 17 02:00:06 Firewall: Denied DST=185.20.137.140 LEN=84 TOS=0x00 PREC=0x00 TTL=63 ID=10458 PROTO=ICMP TYPE=8 ID=2551 SEQ=2
Mar 17 02:00:05 Firewall: Denied DST=185.20.137.140 LEN=84 TOS=0x00 PREC=0x00 TTL=63 ID=10456 PROTO=ICMP TYPE=8 ID=2551 SEQ=1
Mar 17 01:00:06 Firewall: Denied DST=185.20.137.140 LEN=84 TOS=0x00 PREC=0x00 TTL=63 ID=9629 PROTO=ICMP TYPE=8 ID=32388 SEQ=3
Mar 17 01:00:05 Firewall: Denied DST=185.20.137.140 LEN=84 TOS=0x00 PREC=0x00 TTL=63 ID=9619 PROTO=ICMP TYPE=8 ID=32388 SEQ=2
Mar 17 01:00:05 Firewall: Denied DST=185.20.137.140 LEN=84 TOS=0x00 PREC=0x00 TTL=63 ID=9606 PROTO=ICMP TYPE=8 ID=32388 SEQ=1

2

its “a feature”

someone else already called this out and it has to do with measuring latency to SFC sites.

3

Thanks.
So that this happens without speed fusion being used is a feature???

1 Like