Unusual Security Alert

Follow

Michael Clark

• March 25, 2020 01:47

Just started getting a malware alert for :pool.ntp.org." Isn't that a common time service?

1

• 

  Firewalla

  • March 25, 2020 02:39

  The current code (as of 1.966) does not check the protocol, only the src/dst.  So in this case, it is very likely one of the servers (there are many ... many) NTP servers in the pool.ntp.org domain set is marked to be malicious.   In this case, I'd just block that IP, NTP will use the next one anyway

  0

  Comment actions Permalink
• 

  Christopher J. Shaker

  • May 06, 2020 23:21

  I saw this, too
  
  

  0

  Comment actions Permalink

Please sign in to leave a comment.