Fibaro HC2 and IDS

[candrea77 26]

Anyone are using Fibaro in a Network where is present an IDS ?

 

I can see a lot of PSNG_TCP/UDP/ICMP_PORTSWEEP_FILTERED all started from the IP address of my HC2

 

I'm free to block this packet ?

Why my HC2 is doing portsweep over Internet ?

[candrea77 26]

This is the destination address of the PORTSWEEP traffic :

 

98.137.200.255

149.3.177.57

54.88.155.198

109.95.152.167

 

Maybe some Fibaro Guys can help us to understand this traffic ?

[chaicka 195]

98.137.200.255 - Yahoo, may be this is for the Yahoo weather API?

149.3.177.57 - Hong Kong? No idea, suspicious traffic.

54.88.155.198 - ??? Suspicious traffic.

109.95.152.167 - Poland, may be this is Fibaro's servers.

[fi-bar-oh 47]

This is the destination address of the PORTSWEEP traffic :

98.137.200.255

149.3.177.57

54.88.155.198

109.95.152.167

Maybe some Fibaro Guys can help us to understand this traffic ?

You use thingspeak and have Italian ISP

[candrea77 26]

Yes , you are right ....

I use thingspeak and I'm using italian ISP. 

 

So I can assume the traffic is OK and leave it unblocked ?

 

But no other PC i my network are doing portscan over internet .... and all the device are using DNS .....

Also all device are using some service on internet (netflix / ssh / citrix / and so on) .... and no other one trigger the IDS with portscan.

 

So , What's the meaning ?