Alert delayed / time stamp wrong?

Follow

Seth Powsner

• February 27, 2019 23:17

Got an alert at work from my home Firewalla. It reported an iPhone abnormal upload. Very puzzling 'cause iPhone was in my pocket at the time. Got home. Looked at alert-- indeed said there was an abnormal upload to gateway.fe.apple-dns.net and the alert is dated Feb 27 (today) at 12:39p.

However, when I go to devices, and check network flow, history for my iPhone, it shows much more reasonable information (uploading & downloading) before I went to work, and after I got home. It does show an upload in the morning before work to gateway.fe.apple-dns.net

So, looks like the problem is something about the timing of the alert (about 3 hours late). Rest of the information looks ok.

Any suggestions?

Everything else about Firewalla operation looks OK.

0

• 

  Firewalla

  • February 27, 2019 23:49

  The upload alarms are behavior based...  Our algorithm does this analysis in a window ... so ... what's normal now, may not be normal few hours from now ... this is why you are getting the alarm.   

  0

  Comment actions Permalink
• 

  Seth Powsner

  • February 28, 2019 00:39

  Hmm... very interesting. Any simple way to understand why this interaction between an iPhone and an Apple related server tripped a trigger. I am assuming that the gateway.fe.apple-dns.net is a legitimately identified as belonging to Apple...

  0

  Comment actions Permalink
• 

  Firewalla

  • February 28, 2019 05:51

  The behavior part is just a behavior part ... so eventually, there will be automatic filtering for certain things.   Some people care about sending stuff to apple ... some care about Amazon ... some care about sending to other places besides apple.  So ... eventually, we will meet in the middle somewhere. 

  It is like cooking ... all different tastes

  0

  Comment actions Permalink

Please sign in to leave a comment.