Translation

[jeff.koh]

Hi guys,

what does the following translating and UNTRANSLATING means?

1: ICMP echo-request from inside:192.168.4.1 to 10.1.1.1 ID=3060 seq=4391 length=80

2: ICMP echo-request: translating inside:192.168.4.1 to outside:20.1.1.1

3: ICMP echo-request: untranslating inside:10.1.1.1 to outside:192.168.4.1

4: ICMP echo-reply from outside:192.168.4.1 to 20.1.1.1 ID=3060 seq=4391 length=80

5: ICMP echo-reply: translating outside:192.168.4.1 to inside:10.1.1.1

6: ICMP echo-reply: untranslating outside:20.1.1.1 to inside:192.168.4.1

7: ICMP echo-request from inside:192.168.4.1 to 10.1.1.1 ID=3061 seq=4391 length=80

8: ICMP echo-request: translating inside:192.168.4.1 to outside:20.1.1.1

9: ICMP echo-request: untranslating inside:10.1.1.1 to outside:192.168.4.1

10: ICMP echo-reply from outside:192.168.4.1 to 20.1.1.1 ID=3061 seq=4391 length=80

11: ICMP echo-reply: translating outside:192.168.4.1 to inside:10.1.1.1

12: ICMP echo-reply: untranslating outside:20.1.1.1 to inside:192.168.4.1

13: ICMP echo-request from inside:192.168.4.1 to 10.1.1.1 ID=3062 seq=4391 length=80

14: ICMP echo-request: translating inside:192.168.4.1 to outside:20.1.1.1

15: ICMP echo-request: untranslating inside:10.1.1.1 to outside:192.168.4.1

16: ICMP echo-reply from outside:192.168.4.1 to 20.1.1.1 ID=3062 seq=4391 length=80

thx!!

[JetSecPro]

Looks like an internal system was pinging external networks (I am assuming this is a router or firewall log). I would guess that the 192.168 network is your internal network using RFC1918 addressing. 192.168.4.1 appears to be pinging two class A networks (10.1.1.1 and 20.1.1.1). However, the 10.x.x.x is also RFC1918 private address. The 20 network is apparently owned by Computer Science Corp. I'd guess that "translating" and "untranslating" are related to NAT (from your private address space to the public).