ICMP "Flood" on ASA 5516

[DanTee]

Hi Community,

i do have an ASA 5516 and can see an active connection from the source adress 10.88.72.11 which is causing several GB of ICMP Traffic to one of our internal IPs.

The strange thing is, I cannot find this address either in real-time log or elsewhere. Also the IP is unknown, so it shouldn´t be in our subnet. NMAP Scan from my Admin workstation is showing host down. 

Do you guys have any idea on how to find out where this IP adress is coming from and how it is establishing a connection through the FW? Also why can´t I see it in real-time log?

Many Thanks,
Daniel

[balaji.bandi]

you mean this ICMP going from LAN to External ?

or source is external to internal ?

or LAN to ASA inside interface ?

check the before Hop of ASA - can the device learn this IP in the routing table ?

[MHM Cisco World]

Why it not appear in log, it can it appear but you config acl log with high interval that make traffic even if it hit acl not generating log. 

What solution

Run thread detection or shun this IP. 

MHM