ICMP Flood - Spark wireless 4G

Forums › Spark New Zealand (including Skinny and BigPipe) › ICMP Flood - Spark wireless 4G

hebman

16 posts

Geek
+1 received by user: 3

#323225 9-Nov-2025 13:38

Hi,

Long term member but an infrequent poster so - hello!

I have a Spark 4G wireless modem, it largely runs problem free until recently when I connected up a Google WiFi 3 device Mesh. Now it goes down every few minutes. I'm not that experienced with networking just the basics so it's probably something I've done wrong.

Basic overview:

Spark modem Smart Modem 2(Quectel) wired to the main Google Wifi point by ethernet.

Google WiFi points placed around one of them with a backhaul cable to the spark modem's switch port.

NAT mode turned off on the Smart Modem 2(Quectel)

DHCP on the Google Wifi and on the Smart Modem (though I have tried with this one off and it didn't seem any better)

In the system logs I'm now seeing regular occurrence of the following - is this my modem getting confused by the Google devices?:

09.11.2025 13:23:04 [Firewall][SPI] Firewall has recognized a known attack vector [ICMP FLOOD IP] : from WAN side. The attack was initiated from 210.55.111.1 : 0. The attack was aimed at 10.29.243.161 : 0.
09.11.2025 13:23:04 [Firewall][SPI] Firewall has recognized a known attack vector [ICMP FLOOD IP] : from WAN side. The attack was initiated from 122.56.237.1 : 0. The attack was aimed at 10.29.243.161 : 0.

When this happens I generally lose internet access, though the Smart Modem says it's up I have no pings out (Speedtest fails to connect) after a restart of the Smart Modem all is restored for a time until it goes again. Sometimes, waiting and the internet will become available again.

Any ideas? It's beyond my abilities.

gzt

18672 posts

Uber Geek
+1 received by user: 7809

Lifetime subscriber

#3432410 9-Nov-2025 14:07

Is it unintentionally connected to the WAN port on your spark router?

hebman

16 posts

Geek
+1 received by user: 3

#3432415 9-Nov-2025 14:39

no, that port is unused deliberately as I'm never sure if I can use it.

freitasm

BDFL - Memuneh
80646 posts

Uber Geek
+1 received by user: 41029

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#3432416 9-Nov-2025 15:11

Hi disable NAT on the device facing the Internet? Why not disable NAT on the Google device? And also make sure the Google device is not acting as a router too.

Referral links: Quic Broadband (free setup code: R587125ERQ6VE) | Samsung | AliExpress | Wise | Sharesies

Support Geekzone by subscribing (browse ads-free), or making a one-off or recurring donation through PressPatron.

yitz

2238 posts

Uber Geek
+1 received by user: 594

#3432462 9-Nov-2025 15:27

210.55.111.1 and 122.56.237.1 are Spark's DNS resolver IPs so if traffic to those IPs are getting blocked / rate limited then that could explain the issues you are seeing.

Check if there is a way to whitelist those IPs?

hebman

16 posts

Geek
+1 received by user: 3

#3432853 10-Nov-2025 16:18

@freitasm

I disabled NAT on the Spark 4G modem as it doesn't seem to have a bridge mode option and I wanted to remove the double NAT risk. I can't figure out how to do that on the Google Wifi mesh without disabling the mesh function.

update:

I removed the Google Wifi mesh from my network and reverted to the onboard wifi. The ICMP flood messages went away and internet is stable again. Unsure how this is a problem, and I'm not sure how to fix it. Basically I had a Google Wifi with one unit wired in to the modem as the main unit with 3 others around, one with a wired backhaul ethernet cable to the modem. The IP range on the Google is 192.168.86.xx. the range on the Spark wifi is 192.168.1.xx (for wired and wireless devices). I tried with just one Google DHCP server covering both subnets vs two one on each the spark and google units - didn't make any difference. Not sure on the ideal setup but I'm not doing anything non-standard here.