havokeachday Posted December 8, 2020 Posted December 8, 2020 I have an XR1000 running version 1.0.0.50_1.0.36 which I believe is the latest. When I visit settings -> monitoring -> logs, I just get a bunch of what I assume to be false positive DDoS attack warnings, device IP assignments,. and admin logon entries but no website connections even though "Attempted access to allowed sites" is enabled. Is this by design?
Netduma Liam Posted December 9, 2020 Posted December 9, 2020 Hey, welcome to the forum! Are you able to provide any examples of these log entries? Often we will see logs entries that sound sinister, but are actually just harmless system messages. Are you experiencing any issues currently or is it just the log entries?
Guest Killhippie Posted December 9, 2020 Posted December 9, 2020 16 hours ago, havokeachday said: I have an XR1000 running version 1.0.0.50_1.0.36 which I believe is the latest. When I visit settings -> monitoring -> logs, I just get a bunch of what I assume to be false positive DDoS attack warnings, device IP assignments,. and admin logon entries but no website connections even though "Attempted access to allowed sites" is enabled. Is this by design? System logs dont show websites visited and never have.
Administrators Netduma Fraser Posted December 9, 2020 Administrators Posted December 9, 2020 Hey, welcome to the forum! As above, logs won't show websites visited. The DoS entries are a known false reading across Netgear routers - they do actually show IPs you've come in contact with sometimes such as Facebook etc.
havokeachday Posted December 9, 2020 Author Posted December 9, 2020 What does "Attempted access to allowed sites" mean then? It seems like if the router has enough information to determine my network is being used for web, media, social media, etc, that it should at least be able to show DNS lookups in the router log. I understand that with SSL you're not going to get a URL, but you should have an IP address and matching DNS response (at some point).
Administrators Netduma Fraser Posted December 9, 2020 Administrators Posted December 9, 2020 22 minutes ago, havokeachday said: What does "Attempted access to allowed sites" mean then? It seems like if the router has enough information to determine my network is being used for web, media, social media, etc, that it should at least be able to show DNS lookups in the router log. I understand that with SSL you're not going to get a URL, but you should have an IP address and matching DNS response (at some point). Have you made any rules in Traffic Controller or in the Netgear settings for blocked/allowed sites. It certainly could but that isn't the function of the log file, it is to provide additional information to the developers should an issue arise that needs further investigation. We can certainly add that to our ideas list and look at implementing in the future.
havokeachday Posted December 10, 2020 Author Posted December 10, 2020 I have rules to just block devices at certain hours, but not to allow/disallow specific sites. When I went to add a rule for that, it looked like I could only allow categories such as social media, etc.
Administrators Netduma Fraser Posted December 10, 2020 Administrators Posted December 10, 2020 16 hours ago, havokeachday said: I have rules to just block devices at certain hours, but not to allow/disallow specific sites. When I went to add a rule for that, it looked like I could only allow categories such as social media, etc. It's likely in response to the block rules you made, yes that's right applications, categories or a port range currently.
Recommended Posts
Archived
This topic is now archived and is closed to further replies.