Weird Hourly activity from Merlin Firmware 378.56_2

[BugsXor]

Hi,

I have an AC87U running Merlin Firmware 378.56_2
I am running 2x IDS on my network (One Suricata based and one Snort based), in the past month I have noticed an IDS alert that originate from my ASUS router and directed to my internal server.
I have only noticed it because some of my internal server started generating some "403 error" as a response.

Basically, it looks as if every hour and sometimes every minute the ASUS router issue an HTTP request:
GET / HTTP/1.1
Somehow it is only aimed at servers that do have an HTTP server.

Please note that I am not running NAT on ASUS so I can see all internal source IP addresses. These requests therefore do come from the router.
Is there some kind of services/cronjob on the ASUS router that could generate such HTTP requests?
Has anyone any ideas of how I could troubleshoot this?

I found this "weird" rather than "suspicious", it looks more like a ping of some sort...
Thanks,
B..

 

[ColinTaylor]

This has been reported many times. It's the "network map" function on the router.

 

[BugsXor]

Thanks Colin!

 

[BugsXor]

Just to add to that... thanks for the info, it confirms it isn't malicious... yet I still find it weird. As a router, why would it need to do some kind of active scanning (ping or HTTP requests) to find out what is connected to it?it would be more logical to look at data already stored/passing through the Router such as DHCP clients list, Mac addresses routing table, etc. instead of generating extra traffic on the network.
Is there an option to turn that "network map" off?

 

[ColinTaylor]

I believe RMerlin is working on that option. Have a look here: http://www.snbforums.com/threads/37...ork-attached-printer.26529/page-2#post-236656

 

[BugsXor]

Excellent news! thanks for the link.
And that also explains why I had some devices waking up! never made the connection and was attributing that to IT gremlins... ;o)