How to detect a cyber attack
-
I believe it's recommended to use the gateway provided by your ISP as the monitor IP, since it's the first router/hop before your traffic hits the actual internet. If that's down, it truly means your connection is DOWN.
Jeff
-
It depends. Sometimes you want to know that the WAN can actually reach the internet, not just the ISP gateway.
-
@Derelict Instead Google DNS or ISP DNS what IP could I use to monitor? Any suggestion?
-
Perhaps one of your ISPs core routers. Do a traceroute somewhere and see what the second or third hop is.
-
I've never seen an issue using 8.8.8.8 personally.
The fact that you have some SWAP usage shown in that screenshot shows that at some point you exhausted the RAM. That can make things go waaaay slower.
Check the Status > Monitoring graphs for memory usage. Does it peak when you see these incidents?Steve
-
@stephenw10 said in How to detect a cyber attack:
I've never seen an issue using 8.8.8.8 personally.
Yeah I like to use 8.8.8.8, 8.8.4.4 and 1.1.1.1 for monitoring too.
-Rico
-
@KOM Great!
-
@Rico I am not sure but is possible that "You will get false positives using Google's DNS servers." as said @tim-mcmanus.
But I liked @KOM suggestion.
-
I never heard of Google deliberately dropping ICMP traffic to their DNS Servers and personally I never had any issues with it.
WANGW is using 8.8.8.8 atm.-Rico
-
Monitoring any ISP router does not really show a reliable route to the Internet.
Your ISP could have any routing/peering issue, even if their (core) router is perfectly reachable from your side.-Rico
-
It shows you if there is a problem between you and your ISP. Anything past that is out of your control. The whole point of the thing is to be a gateway monitor, not a 5-hops-away monitor. The farther away you monitor, the more likely you will get a false positive of some sort, and I wouldn't want my gateway going down because there is a routing problem many hops away from me.
-
On the monitor IP topic, I agree with @Rico and @stephenw10. I have not had issue so far with google DNS. In fact I switched to Google DNS because I suddenly had issues with my ISP's (third hop router). After months of working fine, we had power failures in the area which I suspect also caused issues with that route on the ISP's network. My gateway was marked as down when it wasn't. Switched to 8.8.8.8 and it's been good since then. Is it a perfect solution? No. Will this happen to you? Probably not, but using a device IP on a specific route on the ISP's network to me seems like trouble. If that route goes down like in my case, the traffic will get rerouted and still reach where it needs to go on the web. But that can't happen if my gateway is marked as down and monitoring action is enabled. Ideally, I would like to be able to put in multiple monitor IPs, so if one is not responding another one could.
-
I will say that whilst I've never seen an issue with it on numerous pfSense installs, including my own, Google respond to ping there more as a courtesy. They could just stop responding. Also when you ping 8.8.8.8 you are hitting a machine via anycast so the service may vary depending on where you are pinging from.
Steve
-
@stephenw10 said in How to detect a cyber attack:
I will say that whilst I've never seen an issue with it on numerous pfSense installs, including my own, Google respond to ping there more as a courtesy. They could just stop responding. Also when you ping 8.8.8.8 you are hitting a machine via anycast so the service may vary depending on where you are pinging from.
Steve
Let's hope they don't pull the rug out from under us. I think a lot of gateways would be marked as down :)
-
@Raffi_ said in How to detect a cyber attack:
Let's hope they don't pull the rug out from under us. I think a lot of gateways would be marked as down
I hope so too!
I tried monitoring White House and Pentagon IP´s but it did not succedd.
Those IP´s, I believe, would be the last to be down. :)
Thank you everybody.
I love pfSense!
Hugo Eyng
Datamais Sistemas -
@hugoeyng said in How to detect a cyber attack:
@Raffi_ said in How to detect a cyber attack:
Let's hope they don't pull the rug out from under us. I think a lot of gateways would be marked as down
I hope so too!
I tried monitoring White House and Pentagon IP´s but it did not succedd.
Those IP´s, I believe, would be the last to be down. :)
Thank you everybody.
haha I hope you don't get a knock on the door from people in black suits.
-
@hugoeyng said in How to detect a cyber attack:
I tried monitoring White House and Pentagon IP´s but it did not succedd.
So, White House Down?
https://www.imdb.com/title/tt2334879/
Jeff
-
@Raffi_ :))))))
-
@akuma1x hahaha The first to be under attack. Is not a good idea use it to monitoring. Is more secure using the butcher shop next door IP.
-
In most cases, a cyberattack is almost impossible to notice. This operation takes place instantly and the user does not even understand how the intruders entered the system and control it. This situation happened in the office where I work a few months ago. Cybercriminals tried to get hold of our customer base and spread this information online. They penetrated the network and got all the access codes and passwords from our system, which is why the programs crashed and, by chance, they were unable to commit theft. Since then, we've turned to Cyber Essentials to help protect and support our system from potential threats. I hope this will not happen again.
