**Smurf** ?

[Sebby]

Glad you like the forum! Let us know if the smurf returns. 

[Rik]

If he's singing that awful song, please don't tell us. 

[madasahatter]

I'll have you know I bought that Rik - absolutely loved it.

[Rik]

It must be something to do with Hoobism.

[dlorde]

Well I found the source of the smurf messages - it wasn't the PC after all, it's the NAS, a Synology Disk Station 106e. The messages stopped when it was disconnected - I've verified this a couple of times. Now I've disabled all the optional network services on the Disk Station, but it's still smurfing every 12 minutes. I can only guess that it's what it does.

I'll see what they say on the Synology forums...

[Philip]

so what were the little blue men (that no one else can see) saying to you then,     you can tell me, I'm the Doctor

[Rik]

I'll see what they say on the Synology forums...

Let us know, will you. I'm intrigued now.

[Sebby]

I wonder if it could be the router incorrectly identifying whatever the NAS is doing as a smurf attack.

[Rik]

That's entirely possible, of course. Life is so complicated. 

[scook94]

I wonder if it could be the router incorrectly identifying whatever the NAS is doing as a smurf attack.

I used to get smurf attacks being reported by my old router, I can't however remember the cause, but it was definitely something innocuous being misreported...

[dlorde]

I used to get smurf attacks being reported by my old router, I can't however remember the cause, but it was definitely something innocuous being misreported...

I've had no response from the Synology forums, but I'm pretty sure it must be something innocuous - there's nothing but standard software on there, and the single messages are only appearing about every 12 mins.

[Rik]

Such regularity suggests hardware rather than software to me.

[dlorde]

It turned out to be an old SlimServer service still running, perhaps accessing SqueezeNetwork. When I deleted it and rebooted the Disk Station, the messages stopped 

[Lance]

Thats good! Thanks for letting up know!

[Sebby]

It turned out to be an old SlimServer service still running, perhaps accessing SqueezeNetwork. When I deleted it and rebooted the Disk Station, the messages stopped 

Excellent.

[dlorde]

Yes, given the low frequency and regularity of the messages, it was unlikely to be an ICMP attack, and given that the Disk Station was the source, it was likely to be something running on it...

Despite my telling them that the messages were outgoing, regular, relatively infrequent, and clearly originated from the DS106e (I posted an example and gave them the timings), the Synology forum eventually replied to say:

"Our engineers believe you are experiencing a ICMP Attack, and is not originating from the DS106e. Please look <here> for further information."

<here> was a link to the WikiPedia article on ICMP attacks... <sigh>.

To say I'm disappointed with Synology 'engineers' is an understatement. You guys did better than that with commonsense, in a fraction of the time 

[Rik]

Commonsense beats scripts any day.

[Lance]

We try our best! 

[Mytheroo]

aint all that common thesedays though