topic SMB appliance shows Infected hosts with public IPs in Spark Firewall (SMB)

SMB appliance shows Infected hosts with public IPs

Vladimir — Wed, 25 Oct 2017 23:17:20 GMT

This is happening for a while now on my home 600 appliance:

View Host Logs does not yield anything and since these events happening about once a month, running traffic capture to get better visibility into it is not practical.

What is the reason for this indicator being present if there is no possibility of path-through traffic hitting my gateway from inside?

Re: SMB appliance shows Infected hosts with public IPs

PhoneBoy — Fri, 27 Oct 2017 20:10:02 GMT

It could very well be a false positive of some sort, or that IP address probing.

I did move this to the SMB and SMP‌ space.

Re: SMB appliance shows Infected hosts with public IPs

Vladimir — Fri, 27 Oct 2017 20:26:48 GMT

If this was a probing attempt, I'd expect to see some drops in the log, but there is nothing at all.

I was thinking that maybe cell phones on WiFi may ID with the IP received from the carrier, but the protection name points to Windows hosts.

Re: SMB appliance shows Infected hosts with public IPs

PhoneBoy — Fri, 27 Oct 2017 20:33:24 GMT

The fact you're not seeing that is somewhat troubling.

Re: SMB appliance shows Infected hosts with public IPs

Vladimir — Fri, 27 Oct 2017 20:47:45 GMT

I've re-flushed the new firmware yesterday and will keep an eye for further occurrences. Should I see it again, I may have to run continuous filtered mirroring from the switches on all interfaces to get the raw packets matching that source network.

Re: SMB appliance shows Infected hosts with public IPs

Tom_Hinoue — Tue, 31 Oct 2017 03:59:08 GMT

Hi.

The infected host is triggered with the Anti-Bot, which can be detected from LAN(inbound) to WAN (outgoing), and also vice versa.

If the public IP trying to communicate to your gateway external IP might have a malicious network activity pattern, or bad reputation (such as C&C), it will come up in the infected hosts list.

Re: SMB appliance shows Infected hosts with public IPs

Vladimir — Tue, 31 Oct 2017 13:11:49 GMT

There is no reason logging the external hosts as "Infected". Consider the scenario when your network is under attack from the botnet. In this case you may have thousands hosts listed as such. It is not the business of this device to police the Internet, but to provide you with correct information about your environment.

But regardless of how these two hosts ended-up listed as such, I would expect to see the corresponding log entries and there are none.