FIrewalla port scans

Follow

David Kilgore

• November 17, 2023 00:54

I have Firewalla Blue running in simple mode. with the router doing the DHCP. Most of the items on its network are IoT. Recently rebooted. Now I am getting multiple Security Alarms saying the Firewalla device is scanning ports on different devices. There has been an alarm for almost every item. 

The other thing I have noticed: The FW box has IP address x.x.x.11 in the About tab. The alarms all list it as X.X.X.13. No other device is listed as X.13 in the device tab, and the FW box isn't listed in the Device tab.

Should I be concerned about the alarms or just ignore them?

0

• 

  Firewalla

  • November 17, 2023 03:32

  Are these alarms from your router? if they are, then likely it is from arp spoofing used by simple mode. You can leave the alarms as is, or you can switch the dhcp mode, which does not use arp spoofing

  0

  Comment actions Permalink
• 

  David Kilgore

  • November 17, 2023 16:47

  No, this is a Firewalla generated Security Alert, titled  Port Scan Activity.

  I can archive and presumably turn them off. New alert, and didn't want to ignore something significant. The alert says the FW Blue Box is port scanning the various IOT boxes. Things like Nest cameras, Smart switches, Wifi Extender box, Backup generator monitor.  None are new. Config unchanged. Only thing recent was that the FW blue box got rebooted after several months of flawless activity.

  0

  Comment actions Permalink
• 

  David Kilgore

  • November 17, 2023 16:51

  It is like the FW is reporting on itself, that it is port scanning things on its network.

  0

  Comment actions Permalink
• 

  Firewalla

  • November 17, 2023 19:24

  What is the make and model of your router? 

  Are you running any Windows boxes inside that has antivirus that also scans the network? 

  0

  Comment actions Permalink
• 

  David Kilgore

  • November 17, 2023 19:36

  It is a netgear R7000, with a netgear AC1900 extender. No windows boxes on that LAN. Just IOT.  The netgear does the DHCP. No screening or antivirus capabilities.

  0

  Comment actions Permalink

Please sign in to leave a comment.