- What Are Abnormal Upload Alarms?
- How Do I Identify 'Good' vs 'Bad' Alarms?
- How Do I Handle Abnormal Upload Alarms?
What Are Abnormal Upload Alarms?
Abnormal alarms are types of alarms that are telling you something different is happening.
Let's use a real-world scenario as an analogy. Assume you have a security camera at your front door and someone keeps walking in front of it. Your camera may alert you with an alarm. Then, based on if you recognize the person/thing, you can choose an appropriate response (e.g., investigating further, calling the police, or ignoring it).
Firewalla's abnormal alarms are generated by a similar mechanism, where we have software that detects how devices usually upload/transfer to the internet. If unusual behavior is detected, the abnormal upload alarm will be raised. Learn more about managing Alarms.
Additionally, as part of the 1.53 app release, we've introduced Large Upload Alarms. Unlike Abnormal Upload Alarms, Large Upload Alarms are simply raised if the data transfer between your devices and an external host exceeds a certain threshold. You can see a video tutorial or read more about this feature in our Firewalla App Release 1.53 notes.
How Do I Identify 'Good' vs 'Bad' Alarms?
This alarm identification process is complex. We are slowly enhancing the algorithm and may eventually automate this process. To evaluate an alarm, we recommend you:
- Look at the timestamp of the alarm and recall if it was triggered by known events.
- Were you the one who triggered the upload?
- Did someone or something you know trigger the upload?
- Tap into the alarm. You will see a bunch of detailed information. Check the following fields:
- Device & Destination Info:
- If your device is transferring data to its own servers (e.g., a Google device is uploading to Google), then the transfer is likely legit.
- If your device is transferring data to an unrecognized or questionable country, then the transfer may not be legit and you should block it.
- Data Transferred:
- If you get an alarm from a device and then a Firewalla alarm saying that the device is transferring data (e.g., your smart doorbell sends you an alert, then Firewalla sends you an abnormal upload alarm), then you know the transfer activity is normal.
- Device & Destination Info:
Additionally, if you want to learn more about the website or the IP address your device is communicating with, you can tap on the domain or IP address, and choose to look up more security info about the destination/source on a 3rd party website.
How Do I Handle Abnormal Upload Alarms?
For example, say you have an internet-enabled security camera.
- Most of the time a security camera won't detect motion, so it will generally stay silent or occasionally send little packets of data to the cloud server.
- Suppose you are outside and want to view your backyard. You remotely connect to the camera, and your camera uploads an image of your backyard to a cloud drive. Since this type of activity from your camera doesn't usually happen, Firewalla will classify it as 'abnormal' (this is just a simplified example, the actual detection algorithm is a bit more complex).
- Firewalla will send you an Abnormal Upload alarm.
- If you know you were the cause of this activity, you can ignore the alarm. However, if you were not, it's likely that someone may be looking at your camera and you should block it.
- Abnormal Upload alarms may be delayed. The abnormal upload detection algorithm needs time to run, so it is possible that your equipment is off-site when the alarm is triggered. At times, the time at which the alarm is generated may be different from the time at which the suspicious activity occurred. The computation of "abnormal" is relative to a time period, so it is highly possible that something in the past may later be classified as abnormal
Please note that if any block is preventing services from working, it may be best to lift the block.