# Interesting blocklist traffic

**URL:** <https://community.ipfire.org/t/interesting-blocklist-traffic/15393>\
**Category:** Security\
**Created:** [8 January 2026 07:09 UTC](https://community.ipfire.org/t/interesting-blocklist-traffic/15393 "2026-01-08T07:09:58Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![peppetech](https://community.ipfire.org/user_avatar/community.ipfire.org/peppetech/32/12711_2.png) [@peppetech](https://community.ipfire.org/u/peppetech)\
**Post date:** [8 January 2026 07:09 UTC](https://community.ipfire.org/t/interesting-blocklist-traffic/15393/1 "2026-01-08T07:09:58Z")

</div>

I just started using a [new IP Blocklist](https://community.ipfire.org/t/add-additional-sources-to-ipfire-blocklist-feature/8416/49) and while reviewing Firewall log (blocklist), I found very interesting traffic involving Protocol 47

 ![image](https://community.ipfire.org/uploads/default/original/2X/2/2a196d705c83bb4bfd0157580931c7367b583dea.jpeg)

---

<div class="post-metadata">

**Author:** ![tphz](https://community.ipfire.org/user_avatar/community.ipfire.org/tphz/32/16551_2.png) [@tphz](https://community.ipfire.org/u/tphz)\
**Post date:** [8 January 2026 09:33 UTC](https://community.ipfire.org/t/interesting-blocklist-traffic/15393/2 "2026-01-08T09:33:14Z")

</div>

Just for information

> **[List of IP protocol numbers](https://en.wikipedia.org/wiki/List_of_IP_protocol_numbers)**
>
> This is a list of the IP protocol numbers found in the 8-bit Protocol field of the IPv4 header and the 8-bit Next Header field of the IPv6 header. It is an identifier for the encapsulated protocol and determines the layout of the data that immediately follows the header. Because both fields are eight bits wide, the possible values are limited to the 256 values from 0 (0x00) to 255 (0xFF), of which just over half had been allocated as of 2025.\[update\]
> Protocol numbers are maintained and publishe...

It is possible that the attacker is attempting to exploit vulnerabilities in the GRE protocol.

> **[Generic routing encapsulation](https://en.wikipedia.org/wiki/Generic_routing_encapsulation)**
>
> Generic routing encapsulation (GRE) is a tunneling protocol developed by Cisco Systems that can encapsulate a wide variety of network layer protocols inside virtual point-to-point links or point-to-multipoint links over an Internet Protocol network.
> Based on the principles of protocol layering in OSI, protocol encapsulation, not specifically GRE, breaks the layering order. It may be viewed as a separator between two different protocol stacks, one acting as a carrier for another.
> GRE packets tha...

e.g.

> **[CERT/CC Vulnerability Note VU#199397](https://www.kb.cert.org/vuls/id/199397)**
>
> Insecure Implementation of Tunneling Protocols (GRE/IPIP/4in6/6in4)

Regards

---

<div class="post-metadata">

**Author:** ![peppetech](https://community.ipfire.org/user_avatar/community.ipfire.org/peppetech/32/12711_2.png) [@peppetech](https://community.ipfire.org/u/peppetech)\
**Post date:** [8 January 2026 22:55 UTC](https://community.ipfire.org/t/interesting-blocklist-traffic/15393/3 "2026-01-08T22:55:29Z")

</div>

What would be the reason behind an attack using Protocol 47 ?

There is not even a destination port recorded.

---

<div class="post-metadata">

**Author:** ![tphz](https://community.ipfire.org/user_avatar/community.ipfire.org/tphz/32/16551_2.png) [@tphz](https://community.ipfire.org/u/tphz)\
**Post date:** [9 January 2026 17:17 UTC](https://community.ipfire.org/t/interesting-blocklist-traffic/15393/4 "2026-01-09T17:17:40Z")

</div>

GRE doesn’t use ports.

[https://david-waiting.medium.com/a-beginners-guide-to-generic-routing-encapsulation-fb2b4fb63abb](https://david-waiting.medium.com/a-beginners-guide-to-generic-routing-encapsulation-fb2b4fb63abb)