[9.260][BUG] Lot of traffic wrong classified as freenet application

There is lot of traffic wrongly classified as "freenet" application from afcd as for example webadmin or some https access attempts...


2014:10:10-15:47:31 asg01 ulogd[16008]: id="2017" severity="info" sys="SecureNet" sub="packetfilter" name="AFC Alert" action="log" fwrule="6" outitf="eth2" mark="0x346b" app="1131" srcmac="0:c:29:56:b0:84" srcip="192.168.16.100" dstip="195.171.192.125" proto="6" length="40" tos="0x00" prec="0x00" ttl="127" srcport="64590" dstport="443" tcpflags="ACK" 
2014:10:10-15:47:33 asg01 ulogd[16008]: id="2017" severity="info" sys="SecureNet" sub="packetfilter" name="AFC Alert" action="log" fwrule="6" outitf="eth1" mark="0x346b" app="1131" srcmac="0:c:29[:D]a:0[:D]6" srcip="192.168.16.100" dstip="192.168.11.12" proto="6" length="40" tos="0x00" prec="0x00" ttl="127" srcport="57649" dstport="4444" tcpflags="ACK" 
2014:10:10-15:47:33 asg01 ulogd[16008]: id="2017" severity="info" sys="SecureNet" sub="packetfilter" name="AFC Alert" action="log" fwrule="6" outitf="eth2" mark="0x346b" app="1131" srcmac="0:c:29:56:b0:84" srcip="192.168.16.100" dstip="216.115.208.230" proto="6" length="40" tos="0x00" prec="0x00" ttl="127" srcport="60803" dstport="8200" tcpflags="ACK"

Parents

0 Michael Suhr over 9 years ago

Hi Sascha,

do you have a solution yet? Because i have also this strange behaviour. After some time (5 to 20 minutes) our vpn clients (L2tp) can't communicate any more. So i find in the logfiles, that the complete communication is identified as "freenet" and freenet is a blocked application. We use Windows7 Clients and the communication is only web, exchange and fileaccess. After disabling freenat as a blocked application. The data packets are identified correctly. (Sophos UTM 9.307-6)
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 JustinCredible over 9 years ago in reply to Michael Suhr

We are seeing a lot of this "Freenet" traffic, only coming from our wireless clients and the UTM itself. Don't know if I should block it or what
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

Reply

0 JustinCredible over 9 years ago in reply to Michael Suhr

We are seeing a lot of this "Freenet" traffic, only coming from our wireless clients and the UTM itself. Don't know if I should block it or what
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

Children

No Data