Billion UK Forum

For years and years I've wondered from time to time what sort of traffic is constantly arriving at/going out of the WAN interface on the router when all the devices on my LAN are switched off, ie. with the router in the idle state. That's to say, the activity depicted by the constant blinking of the 'Internet' indicator on the router's frontpanel. The blinking of the indicator didn't used to bother me much with ADSL, but now that my connection uses VDSL the frequency of the blinking has increased and become more noticeable.

So what's the significance of this indicator blinking all the time? Bear in mind that this is noticeable only when the modem's effectively in an idle state, ie. the LAN computers/devices are all off. When I'm actually accessing the Internet, the 'Internet' indicator responds far more asynchronously and generally in bursts, of course.

Certainly, for a wired-Ethernet setup, these idle-state packets can't be getting any further than my end of the DSL connection when the LAN devices are all off and therefore the respective Ethernet interfaces are off too. I think a lot of people assume they're pings from auto-scanners on the Web that are looking for router vulnerabilities, but personally I think the likelihood of that is low.

Are these instead monitoring or test packets of some sort, involving DLM? Or maybe the router sending "I'm still here" packets back to the ISP's network?

I'd say that, on my 8800NL and in the so-called idle state, the 'Internet' indicator blinks at a fairly steady, but nevertheless asynchronous, rate of about 2 pulses per second.

gatekeeper wrote:For years and years I've wondered from time to time what sort of traffic is constantly arriving at/going out of the WAN interface on the router when all the devices on my LAN are switched off, ie. with the router in the idle state. That's to say, the activity depicted by the constant blinking of the 'Internet' indicator on the router's frontpanel. The blinking of the indicator didn't used to bother me much with ADSL, but now that my connection uses VDSL the frequency of the blinking has increased and become more noticeable.

So what's the significance of this indicator blinking all the time? Bear in mind that this is noticeable only when the modem's effectively in an idle state, ie. the LAN computers/devices are all off. When I'm actually accessing the Internet, the 'Internet' indicator responds far more asynchronously and generally in bursts, of course.

Certainly, for a wired-Ethernet setup, these idle-state packets can't be getting any further than my end of the DSL connection when the LAN devices are all off and therefore the respective Ethernet interfaces are off too. I think a lot of people assume they're pings from auto-scanners on the Web that are looking for router vulnerabilities, but personally I think the likelihood of that is low.

Are these instead monitoring or test packets of some sort, involving DLM? Or maybe the router sending "I'm still here" packets back to the ISP's network?

I'd say that, on my 8800NL and in the so-called idle state, the 'Internet' indicator blinks at a fairly steady, but nevertheless asynchronous, rate of about 2 pulses per second.

Could be bot scanners (our firewall keeps you protected, this is becoming more and more common) and also might be normal broadcast packets, saying your router is up and alive and connected to the internet. (most likely the later though) I wouldn't worry

When you say "our firewall", which one do you mean? Surely, unless we add a separate hardware firewall into the mix, the only firewall that exists by virtue of the router is that provided naturally by NAT? Or am I misinformed? [In a recent posting, I was also asking about a "LAN side firewall" setting in the 8800, but you definitely advised not to use that, for the usual configuration of the 8800].

As for ".... also might be normal broadcast packets, saying your router is up and alive and connected to the internet", that's also been put forward as a possibility by others to whom I've put the same question. However, why would the router need to keep sending "Hi, I'm still here" packets, because if the router wasn't up and running then surely by definition there wouldn't be DSL sync and therefore there wouldn't be an Internet indicator in any sort of On state in the first place? And anyway, why would the router need to be sending "I'm still here packets" at this sort of rate (around 2 every second)? I'm willing to summise that the router could be sending packets of this type to perhaps the ISP's network, on the Internet, but that's about all.

I think you must agree that it's remarkable that the Billion 7800, 8800 and 8900 series routers all have an Internet indicator on them (as do many other marques of routers on the market), but apart from the users manuals simply stating that it should normally be On or flashing, there's never been any explanation as to what should happen to this indicator when the router is in the idle state.

It'd be interesting to find out from other users of Billion routers if they too observe what I'm seeing. In all the many years that I've been on broadband Internet connectivity, I can't recall a time when this indicator didn't constantly flicker, so either I've always been pinged by bots or whatever, or the flickering represents some quite legitimate, benign background action.

Incidentally, where pings are concerned, the question's been raised as to whether, when I changed ISP and bb account, I could have inherited a WAN IP address that'd previously been a victim to a vulnerability. Indeed, this could be the case with countless thousands of other Internet users around the world. But although ISPs may offer to change WAN IPs if this is suspected, I can't see that any replacement IP would necessarily be any better, unless ISPs were to pre-vett every single WAN IP address that they assigned to their customers. Food for thought, eh?

gatekeeper wrote:When you say "our firewall", which one do you mean? Surely, unless we add a separate hardware firewall into the mix, the only firewall that exists by virtue of the router is that provided naturally by NAT? Or am I misinformed? [In a recent posting, I was also asking about a "LAN side firewall" setting in the 8800, but you definitely advised not to use that, for the usual configuration of the 8800].

As for ".... also might be normal broadcast packets, saying your router is up and alive and connected to the internet", that's also been put forward as a possibility by others to whom I've put the same question. However, why would the router need to keep sending "Hi, I'm still here" packets, because if the router wasn't up and running then surely by definition there wouldn't be DSL sync and therefore there wouldn't be an Internet indicator in any sort of On state in the first place? And anyway, why would the router need to be sending "I'm still here packets" at this sort of rate (around 2 every second)? I'm willing to summise that the router could be sending packets of this type to perhaps the ISP's network, on the Internet, but that's about all.

I think you must agree that it's remarkable that the Billion 7800, 8800 and 8900 series routers all have an Internet indicator on them (as do many other marques of routers on the market), but apart from the users manuals simply stating that it should normally be On or flashing, there's never been any explanation as to what should happen to this indicator when the router is in the idle state.

It'd be interesting to find out from other users of Billion routers if they too observe what I'm seeing. In all the many years that I've been on broadband Internet connectivity, I can't recall a time when this indicator didn't constantly flicker, so either I've always been pinged by bots or whatever, or the flickering represents some quite legitimate, benign background action.

Incidentally, where pings are concerned, the question's been raised as to whether, when I changed ISP and bb account, I could have inherited a WAN IP address that'd previously been a victim to a vulnerability. Indeed, this could be the case with countless thousands of other Internet users around the world. But although ISPs may offer to change WAN IPs if this is suspected, I can't see that any replacement IP would necessarily be any better, unless ISPs were to pre-vett every single WAN IP address that they assigned to their customers. Food for thought, eh?

I mean the routers WAN firewall, as long as it is ticked I wouldn't worry.

You could still have DSL sync but no PPP connection (these are two different things), hence it could be the ISP that sending messages to router and the routers broadcasting back, to see if the PPP connection is still up and working correctly, also monitoring line stats (DLM for example)

My test 8800NL does the same thing

I mean the routers WAN firewall, as long as it is ticked I wouldn't worry.

Isn't that simply the NAT firewall, or have I been labouring under a misapprehension all these years when it comes to Billion routers and there's actually more than one firewall in place, with standard router settings?

Your comments regarding DSL sync and the PPP connection seem a reasonable argument, and in the final analysis might be the explanation.

As for the DLM, if it was just the DSLAM and the user's router exchanging test packets to watch for changing conditions on the line to the cabinet/exchange, those packets wouldn't need involvement of the 'Internet', since they're only passing between DSLAM and router (the level at which I understand the DLM to work). The only instance of where the line status results might need to be passed to the Internet or WAN side of things would be - as you've summised - if the results are continuously passed back to the ISP. But if that's the case, then given that this would be happening in everyone else's situation as well, there must be one heck of a lot of statistics packets passing around on the Internet! Although I'm perfectly willing to be convinced otherwise, I don't find that plausible.

I'll press my ISP again, to see if I can find out vaguely how they monitor my connection, if at all. I've been under the impression that they rely on the network provider (basically Openreach) to obtain my and other customers' line stats.

gatekeeper wrote:I mean the routers WAN firewall, as long as it is ticked I wouldn't worry.

Isn't that simply the NAT firewall, or have I been labouring under a misapprehension all these years when it comes to Billion routers and there's actually more than one firewall in place, with standard router settings?

Your comments regarding DSL sync and the PPP connection seem a reasonable argument, and in the final analysis might be the explanation.

As for the DLM, if it was just the DSLAM and the user's router exchanging test packets to watch for changing conditions on the line to the cabinet/exchange, those packets wouldn't need involvement of the 'Internet', since they're only passing between DSLAM and router (the level at which I understand the DLM to work). The only instance of where the line status results might need to be passed to the Internet or WAN side of things would be - as you've summised - if the results are continuously passed back to the ISP. But if that's the case, then given that this would be happening in everyone else's situation as well, there must be one heck of a lot of statistics packets passing around on the Internet! Although I'm perfectly willing to be convinced otherwise, I don't find that plausible.

I'll press my ISP again, to see if I can find out vaguely how they monitor my connection, if at all. I've been under the impression that they rely on the network provider (basically Openreach) to obtain my and other customers' line stats.

Just found a interesting thread worth a look

http://www.overclockers.com/forums/show ... -connected