pia-daemon ICMP Flood
2025-10-28 by Henry Lee (@nynxz)
pia-daemon emits 'ICMP Flood' behavior every minute. This is a 'latency check' which is used for server selection.
pia-daemon emits 'ICMP Flood' behavior every minute. This is a 'latency check' which is used for server selection. This occurs when PIA is installed & disconnected. The GUI/frontend is not required to be running, only the pia-daemon.
Unifi IPS detects some IPs from this latency check as IPS Alert 2: Misc Attack. Signature ET CINS Active Threat Intelligence Poor Reputation IP group 46. From: <source ip>:0, to: <dest ip>:0, protocol: ICMP